HPHConnect for Providers Enrollment Form

Transcription

1 HPHConnect for Providers Enrollment Form Please complete all of the steps listed below to register your organization for HPHConnect. Step 1: Provide the following required information. All fields are required except as noted. Organization Name (as registered in HPHConnect) Mailing Address 1 Mailing Address 2 (if applicable) City, State, Zip Code Tax Identification Number(s) Is this a new request? Yes No Is this an update to an existing account? Yes No Contact Name Contact Title Contact Phone Contact Fax Contact Step 2: Respond to the following questions and proceed as indicated: ARE YOU A BILLING AGENCY? YES NO If Then Yes Complete and submit an Identification of Third Party Representative Form for each entity or organization for which you are requesting access in HPHConnect. Go to Step 3. No Continue to Step 2, Part B. DO YOU REQUIRE ACCESS TO ALL PROVIDERS ON THE TIN(S) LISTED ABOVE? YES NO If Then Yes Go to Step 4. No Continue to Step 3 to supply the information of the providers for which you require access. ARE YOU A CLINICIAN REQUESTING ACCESS TO YOUR OWN DATA? YES NO If Then Yes Enter your NPI: Go to Step 4. No Go to Step 3. Step 3: IF YOU ARE A BILLING AGENCY, OR YOU HAVE INDICATED YOU ARE REQUESTING ACCESS TO A SUBSET OF PROVIDERS WITHIN THE TIN(S) REPORTED ON PAGE ONE: Please provide the TIN, provider name and NPI for those individual providers or organizations for which you are requesting access. If you have more than 5 providers or organizations please attach an excel spreadsheet. The spreadsheet should contain the same information as requested below. * Tax ID(s) for provider(s) you represent * Provider / Practice / Facility Name * NPI * Indicates a required field (continued) Harvard Pilgrim Health Care Provider Manual E.17 March 2011

2 HPHCONNECT FOR PROVIDERS ENROLLMENT FORM (cont.) Step 4: Please be sure you have completed the entire HPHConnect registration process: Downloaded the registration instructions and documentation including the Identification of Third Party Representative Form and Privacy and Security Agreement available at Completed the online registration. Fax your completed HPHConnect registration documents to or attachments to Required registration documents include: If your provider organization is Contracted Then, this is required 1. A completed HPHConnect for Providers Enrollment Form 2. Signed and completed User Agreement(s) for all Users registered and not yet confirmed: pages 2 and 3 Non-Contracted 1. Signed Privacy and Security Agreement: pages 1 through 6 2. A completed HPHConnect for Providers Enrollment Form 3. Signed and completed User Agreement(s) for all Users registered and not yet confirmed: pages 2 and 3 Billing Agencies and Third Party Representatives 1. Signed Privacy and Security Agreement: pages 1 through 6 2. A completed HPHConnect for Providers Enrollment Form 3. Signed and completed User Agreement(s) for all Users registered and not yet confirmed: pages 2 and 3 4. Identification of Third Party Representative Form (if applicable) Harvard Pilgrim Health Care Provider Manual E.18 March 2011

3 IDENTIFICATION OF PROVIDER THIRD-PARTY REPRESENTATIVE Provider Organization Name: Provider Organization TIN: Provider Organization (Provider) hereby authorizes the following third-party representative (i.e., billing agency, vendor, clearinghouse, application service provider) to represent the Provider in order to carry out administrative functions with Harvard Pilgrim Health Care that involve the use and disclosure of Protected Health Information (PHI) on behalf of the Provider: Third Party Representative Information Authorizations Third Party Company Name & Mailing Address Contact Name & Title Contact Phone Number Contact Address EDI Solutions HPHConnect Access Y N Y N EDI Solutions is performing any Electronic Data Interchange on behalf of the provider using standard EDI transactions, e.g., 837 claims submission, receive 835 remittance advice, 270/271 eligibility inquiry and response, 276/277 claims status inquiry and response, 278 referral/authorization/notification request or inquiry, etc. HPHConnect Access is access to any provider self-service function in this online application. Please note third-party access includes the authority of the third-party representative to manage access to your information for others within, or external to, their organization. Provider hereby acknowledges that Harvard Pilgrim will only release to a third-party representative what could be released directly to the Provider per Harvard Pilgrim s disclosure policy. Provider and its representative will adhere to all applicable HIPAA regulations, including the execution of Business Associate Agreements where applicable. Third-party representative will adhere to all applicable Harvard Pilgrim policies for EDI Solutions and/or HPHConnect Access as defined in the Harvard Pilgrim Provider Manual. The Provider hereby agrees to notify Harvard Pilgrim, immediately, in writing, if any of these designations change. Upon such notice to Harvard Pilgrim, third-party representative access will be terminated as of the date specified by the Provider. Third Party Access Date Authorized Provider Organization Signature Print Name Title Phone Address Mailing Address Are you granting the third party representative access to your entire TIN? Y N Harvard Pilgrim cannot release or provide ANY Provider information to a Third-Party unless this form is completed. Provider Organization Representative please complete, sign, and return this form to: ATTN: Provider ebusiness Services OR Fax to: Harvard Pilgrim Health Care ATTN: Provider ebusiness Services 1600 Crown Colony Drive Quincy, MA provider_ebusiness_services@hphc.org 09/09

4 HARVARD PILGRIM HEALTH CARE, INC. PRIVACY AND SECURITY AGREEMENT THIS PRIVACY AND SECURITY AGREEMENT ( Agreement ) is made effective as of, 20 (the Effective Date ) by and between Harvard Pilgrim Health Care, Inc., a Massachusetts corporation with a place of business at 93 Worcester Street, Wellesley, MA (hereinafter HPHC ) and, a [insert type of entity] with a place of business at (hereinafter Contractor ) RECITALS WHEREAS, the parties recognize their legal obligation to protect the privacy and security of health information concerning individual persons; WHEREAS, the Health Insurance Portability and Accountability Act of 1996, Public Law ( HIPAA ) and regulations promulgated thereunder in Title 45, Parts 160 and 164 of the Code of Federal Regulations contemplate that payors, providers, providers Business Partners and others given access to such health information will enter into agreements with each other to maintain information security and protect the privacy of such health information; WHEREAS, the parties will be accessing or sharing such information in conjunction with a number of aspects of HPHC s relationship with providers, including without limitation claims submission and payment activities; and WHEREAS, the parties to this agreement will be accessing or sharing such information through a number of media, including without limitation electronic data interchange via secure File Transfer Protocol (FTP), Virtual Private Network (VPN), secure modems or various other electronic channels, and the Contractor will be responsible for managing and monitoring its user access. NOW THEREFORE, the parties, intending to be legally bound, agree as follows: 1. DEFINITIONS 1.1 Authorized Employees or Agents shall mean Contractor s employees and agents with a need to know Protected Information and who have been authorized by Contractor to have access to Protected Information. 1.2 Business Partner or Business Associate shall mean a person or entity (other than an employee of Contractor) that performs, or assists in the performance of a function or activity involving the use or disclosure of Protected Information, including without limitation claims processing or administration, data analysis, processing or administration, billing, or practice management, or a person or entity (other than an employee of Contractor) that provides legal, actuarial, accounting, consulting, management, administrative, or financial services to or for Contractor, where the provision of the service involves the disclosure of Protected Information. 1.3 Protected Information shall mean information obtained from HPHC, whether oral or recorded in any form or medium, that relates to the past, present, or future physical or

5 mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual, including demographic information collected from an individual, which information either identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual. Protected Information shall also include but not be limited to (whether or not specifically designated as confidential by HPHC) enrollment information, claims data, demographic data and any and all patient specific information and rate information or specific utilization information relating to clinical practices. 2. CONFIDENTIALITY AND SECURITY 2.1 Maintaining Confidentiality of Protected Information. Contractor shall not, without the prior written consent of HPHC: i. use or access any Protected Information except (i) in the conduct of its business as a provider of health care or (ii) as a Business Partner or Business Associate of a health care provider, and as provided herein; or ii. disclose any portion of the Protected Information to any persons or entities other than to Contractor s Authorized Employees, Business Partners, or Business Associates as provided herein. 2.2 Confidentiality Safeguards. Contractor shall use its best efforts, including employment of all reasonable safeguards, to prevent any use, access or disclosure of the Protected Information not authorized by this Agreement. Such safeguards shall include, but not be limited to: i. limiting Authorized Employees to those having a need to know such information, ii. limiting the number of Authorized Employees, iii. ensuring that access to such information of any Authorized Employee who is no longer employed by Contractor is terminated immediately upon their departure, iv. ensuring that Authorized Employees understand the obligations of Contractor under this Agreement, v. establishing a disciplinary policy for breach of confidentiality, vi. instituting appropriate password controls, vii. immediately notifying HPHC in the event Contractor has knowledge that any employee or agent has breached this Agreement. Contractor shall immediately notify HPHC of the identity of such individuals, the nature of the breach, and the action taken by Contractor. 2.3 Security Standards. Contractor further agrees that it shall employ all reasonable

6 safeguards, including those safeguards Contractor takes to protect its own confidential information, to prevent any use, access or disclosure of the Protected Information that would result in a breach of this Agreement. With respect to Contractor s facilities where it receives, maintains or transmits Protected Information, Contractor shall implement the administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of such Protected Information as required by, and as more specifically set forth in, the Final Security Regulations issued under HIPAA. Contractor will provide to HPHC copies of its confidentiality and information security policies upon the request of HPHC. In addition, Contractor will report in writing to HPHC, and to any state or federal authority as required by law, any security incident of which it becomes aware relating to a breach of security and/or privacy of the Protected Information including, but not limited to, any attempted or successful unauthorized use or disclosure of the Protected Information. 2.4 Practices for Information Security. HPHC has developed a list of security and confidentiality practices which Contractor may use to develop confidentiality and security procedures. The list of security and confidentiality practices is in HPHC s Provider Manual, in the Chapter captioned Requirements for EDI and Online Solutions. The Provider Manual can be reached at the following link: [place link address here] 2.5 Return or Destruction of Protected Information. Protected Information shall remain the property of HPHC and shall, at HPHC's request (which may be at any time), be returned forthwith to HPHC or be destroyed if so directed by HPHC together with all copies made by Contractor and by anyone to whom such Protected Information has been made available by Contractor. Upon request, Contractor shall provide to HPHC a certificate as to the return or destruction of such Protected Information. 2.6 Compliance with Policy and Laws. Contractor agrees to comply with all applicable and effective state and federal regulatory and statutory requirements related to the confidentiality of Protected Information, including but not limited to, the Massachusetts privacy statute (M.G.L. ch B), the Standards for the Protection of Personal Information of Residents of the Commonwealth (201 CMR 17.00), and comparable applicable state laws in other states in which Contractor receives Protected Information, and HIPAA and related regulations. 2.7 Required Disclosure. Notwithstanding the foregoing, if Contractor is requested or required in a judicial, administrative or governmental proceeding to disclose any Protected Information, Contractor will notify HPHC as promptly as practicable so that HPHC may either seek an appropriate protective order or waive the provisions of this Agreement. If HPHC promptly seeks and is unable to obtain a protective order or waiver, and Contractor, in the opinion of its counsel, is required to disclose Protected Information in any court, governmental agency or tribunal or else stand liable for contempt under penalty, Contractor may disclose such Protected Information without liability hereunder. 2.8 Costs. Contractor, at its own expense, shall provide and maintain the personnel, equipment, software, services and testing necessary to effectively and reliably implement the confidentiality and security standards contemplated by this Agreement.

7 Contractor shall be responsible for all equipment necessary to maintain the security of Protected Information, including hardware, software and telecommunication services. 2.9 Certification. Contractor shall upon request certify to HPHC that it complies with the terms of this Agreement, which may be in the form of self-certification Business Partners/Business Associates. (i) Direct access. If Contractor engages any Business Partners or Business Associates, and such Business Partner or Business Associate has a need to know and will have access to Protected Information directly from HPHC, then any such Business Partner will be required to execute a Privacy and Security Agreement with HPHC prior to being given such access, and any such Business Associate will be required to execute a Business Associate Agreement with Contractor prior to being given such access by HPHC. (ii) Other. If Contractor engages any other Business Partner or Business Associate who has a need to know and will have access to Protected Information from Contractor, then Contractor shall be responsible for ensuring that each such Business Partner complies with the terms of this Agreement and that each such Business Associate complies with the terms of HIPAA to the same extent as if they were covered entities Prior Confidentiality. The parties may have previously entered into a confidentiality agreement with respect to the Protected Information or other HPHC confidential information. Such agreements shall continue in full force and effect, provided, however, that to the extent the terms of such previous agreement conflict with this Agreement as to the Protected Information, the terms of this Agreement will govern Contractor Responsibility for Employees and Agents. In connection with access to HPHC s secured provider web portal (HPHConnect), Contractor shall be responsible for assuring that its employees and agents fully comply with all of the obligations of Contractor under this Agreement, including the User Agreement, as set forth in the Provider Manual, in the Chapter captioned Requirements for EDI and Online Solutions. Any violations by Contractor s employees or agents shall be considered violations by the Contractor. 3.0 MISCELLANEOUS TERMS 3.1 Term and Termination. The term of this Agreement shall commence upon the Effective Date and shall continue until Contractor no longer receives Protected Information from HPHC ( Term ). HPHC shall have the right to stop providing Protected Information at any time. Any termination will not alter the rights or duties of the parties with respect to Protected Information received before the effective date of the termination. 3.2 Severability. Any provision of this Agreement, which is determined to be invalid or unenforceable, will be ineffective to the extent of such determination without invalidating the remaining provisions of this Agreement or affecting the validity or enforceability of such remaining provisions.

8 3.3 Entire Agreement. This Agreement constitutes the complete agreement of the parties relating to the matters specified in this Agreement and, except as otherwise provided herein, supersedes all prior representations or agreements, whether oral or written, with respect to such matters. This Agreement may be amended only by a written instrument signed by HPHC and Contractor. This Agreement is for the benefit of, and shall be binding upon, the parties and their respective successors and assigns. 3.4 Governing Laws. This Agreement shall be governed by and interpreted in accordance with the laws of the Commonwealth of Massachusetts, without regard to its conflict of laws provisions, and the Commonwealth of Massachusetts shall be the sole forum for resolution of disputes regarding this Agreement or the subject matter thereof. 3.5 Specific Performance. The parties hereby agree and affirm that the subject matter of this Agreement is unique, and that it may be impossible to measure the damages, which would result to HPHC from violations by Contractor of the agreements set forth herein. Accordingly, in addition to any other remedies which HPHC may have at law or in equity, the parties hereby agree that HPHC shall have the right to have all obligations and other provisions of this Agreement specifically performed by the Contractor, as applicable, and that HPHC shall have the right to seek preliminary and permanent injunctive relief to secure specific performance, and to prevent a breach or contemplated breach, of this Agreement, without, in any case, proof of actual damages. 3.6 Audit. HPHC shall have the right, at its own expense, to conduct an audit of Contractor at any time during normal working hours upon reasonable notice to Contractor to determine if Contractor is in compliance with the terms of this Agreement. 3.7 Limitation of Liability. To the full extent allowed by applicable law, HPHC and its directors, officers and employees, affiliates, subsidiaries, successors and assigns, and third-party agents will not be liable, directly or indirectly, for any incidental, punitive, exemplary, special, indirect or consequential damages, for any reason arising from or relating to Contractor s use of or access to any HPHC Protected Information, or any provision of this agreement, even if advised of the possibility of such damages, whether arising under theory of contract, tort (including negligence), strict liability or otherwise. To the full extent allowed by applicable law, in no event will HPHC and its directors, officers and employees, affiliates, subsidiaries, successors and assigns, and third-party agents have any liability for any damages arising from or relating to this agreement or Contractor s use of the any Protected Information except for damages arising solely from HPHC s gross negligence or willful misconduct Contractor Agreements. If Contractor is representing another entity for claims submission and payment activities, then Contractor shall have an agreement with such entity. Contractor also agrees to inform HPHC of the addition or deletion of entities which it is representing Contractor Privacy Officer. The Contractor s Privacy Officer s name and contact information is as follows:

9 Name: Mailing Address: Phone Number: Address: Contractor agrees to inform HPHC of any change in its Privacy Officer information. IN WITNESS WHEREOF, the parties or their authorized representatives have caused this Agreement to be executed under seal as of the Effective Date. HARVARD PILGRIM HEALTH CARE, INC. and HARVARD PILGRIM HEALTH CARE OF NEW ENGLAND, INC. By: Deborah A. Norton Chief Information Officer [CONTRACTOR] By: Printed Name: Title: Name of Provider Group (if Contractor is a Business Associate): Date: