ELECTRONIC MEDICAL RECORD ACCESS AGREEMENT This Agreement is made this day of, 2018 ( Effective Date ), by and between Saint Elizabeth Medical Center, Inc. dba St. Elizabeth Healthcare, a Kentucky non-profit corporation located at 1 Medical Village Drive, Edgewood, Kentucky 41017 ( St. Elizabeth Healthcare ), and, with a principal address of (referred to as Covered Entity ). WITNESSETH: WHEREAS, St. Elizabeth Healthcare is a healthcare system that maintains its own electronic medical record; WHEREAS, Covered Entity provides medical care and treatment to patients of St. Elizabeth Healthcare; WHEREAS, Covered Entity relies on St. Elizabeth Healthcare records for information about patient diagnosis, treatment and status; WHEREAS, patient information provided to Covered Entity in a timely and efficient manner can assist Covered Entity in making treatment decisions that will enhance the care of St. Elizabeth Healthcare s patients and reduce costs to St. Elizabeth Healthcare by reducing the length of inpatient stays and reduce resources consumed in the timely delivery of patient clinical information; and WHEREAS, St. Elizabeth Healthcare desires to make available to Covered Entity electronic health information maintained by St. Elizabeth Healthcare ( the System ). NOW, THEREFORE, in consideration of the mutual promises, covenants, terms and conditions herein contained, the parties agree as follows: I. Patient Information St. Elizabeth Healthcare will make the System available to Covered Entity with respect to patients who have been admitted to St. Elizabeth Healthcare by Covered Entity or who are being treated by Covered Entity or who have been treated in St. Elizabeth Healthcare s outpatient facilities by Covered Entity. The patient information components of the System for which Covered Entity is being provided access are as follows: A. Patient Personal Information: 1. Bed location; 2. Physician census; 3. Demographic and insurance data; 4. Medical Record coding summary; 5. Patient face sheets; and
6. Other patient information that may from time-to-time be added to the System as determined by St. Elizabeth Healthcare. B. Patient Clinical Information: 1. Order status; 2. Radiology results and digital images; 3. Laboratory results; 4. Digital images of the medical record and medical record deficiencies; 5. Medication profiles; 6. St. Elizabeth Healthcare drug formulary; 7. Patient allergy information; and 8. Other patient information that may from time-to-time be added to the System as determined by St. Elizabeth Healthcare. II. General Duties and Responsibilities of Covered Entity A. Protected Health Information or PHI shall mean information, whether oral or recorded in any form or medium, including demographic information, that (i) relates to the past, present or future, physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; (ii) identifies the individual or for which there is a reasonable basis to believe the information can be used to identify the individual; and (iii) is provided and/or made available to Covered Entity through the System. B. Authorized Users. Covered Entity will identify its Authorized Users who may access PHI through the System on behalf of Covered Entity as noted in Exhibit A. Covered Entity shall educate each Authorized User on their obligations under this Agreement and will require each Authorized User to sign an attestation statement confirming each Authorized User s agreement to comply with said obligations. Authorized Users will include only those individuals who require access to the PHI to facilitate Covered Entity s use of the PHI for a Permitted Use in accordance with the regulations promulgated under the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 ( HIPAA ). Covered Entity is responsible for Authorized Users complying with the terms and conditions of this Agreement and applicable laws and regulations. Authorized Users shall be prohibited from sharing their user names and/or passwords with others and from using the user names and/or passwords of others. The use of another Authorized User s credentials to access/utilize the System is prohibited. Covered Entity shall provide immediate notification to St. Elizabeth Healthcare of any changes to the Authorized Users. C. Patient Permission for Treatment; Notice. The parties acknowledge that certain uses of Data, including without limitation Treatment, Payment and certain Health 2
Care Operations (as defined by the HIPAA Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. Part 164, Subpart E) do not require specific consent by a Patient under HIPAA. However, Covered Entity is responsible for securing any Patient consent or authorization to access Patient s PHI as otherwise required by law. Covered Entity further acknowledges that PHI specific to treatment for chemical dependency and behavioral health is further protected under Federal and State law. D. Covered Entity agrees that it will establish and maintain administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of System PHI in compliance with HIPAA. Covered Entity agrees that its use of the System and the use of the System by Covered Entity s Authorized Users will comply with the terms of this Agreement and applicable laws and regulations. Without limiting the foregoing, Covered Entity will ensure his/her Authorized Users receiving or accessing PHI under this Agreement: 1. properly safeguard PHI received or accessed under this Agreement from loss, theft or inadvertent disclosure; 2. that they are responsible for safeguarding this information at all times, regardless of whether or not the Covered Entity employee, contractor, or agent is at his or her regular duty station; 3. ensure that laptops and other electronic devices/media containing PHI are encrypted and/or password protected; 4. send emails containing PHI only if encrypted or if to and from addresses that are secure; and 5. limit access and disclosure of the information and details relating to PHI only to those instances permitted under the HIPAA regulations. E. Covered Entity will immediately prohibit and bar any Authorized User who leaves or ceases employment or services with the Covered Entity, has a relevant change in employment status, or if applicable, ceases to be a member of the professional staff of St. Elizabeth Healthcare from accessing the System. Covered Entity shall promptly notify St. Elizabeth Healthcare of any Authorized User who leaves or ceases employment or services with the Covered Entity, has a relevant change in employment status, or ceases to be a member of the professional staff of Covered Entity for the purpose of suspending or revoking access authority of Authorized Users. F. If the actions of Covered Entity or Covered Entity s Authorized Users lead to an obligation under Federal law to make any patient aware of a breach of their PHI through a breach notification letter, Covered Entity shall make all appropriate breach notifications to meet the mandates of the HIPAA regulations. 3
G. Covered Entity acknowledges and agrees that it meets the definition of a covered entity as defined in the Health Insurance Portability and Accountability Act of 1996 ( HIPAA ) and regulations promulgated thereunder, and therefore, must comply with the rules and requirements to protect the privacy and security of health information and must provide individuals with certain rights with respect to their health information. H. Covered Entity acknowledges and agrees that the indemnification provisions set forth in Article VI below will apply to any breach of confidentiality or unauthorized access, disclosure or release of patient information committed by Covered Entity or Covered Entity s Authorized Users. III. Electronic Access Covered Entity may access the patient information listed above in Article I through: 1. Direct wiring configurations, if available; 2. Wireless WIFI network access within St. Elizabeth Healthcare facilities where available as determined by St. Elizabeth Healthcare; or 3. The HealthBridge system. IV. Software Solution Covered Entity acknowledges that access to the System is Internet browser-based and agrees to provide Internet browser software at his or her sole cost and expense. V. Hardware Components Covered Entity will be responsible for providing the computer hardware components necessary for accessing the System at his or her sole cost and expense. Upon Covered Entity s request, St. Elizabeth Healthcare will supply Covered Entity with the specifications for such hardware. VI. Indemnification Covered Entity hereby agrees to indemnify St. Elizabeth Healthcare and its officers, directors, employees, agents and contractors against and hold them harmless from any and all actions, causes of action, liability, injury, loss, damage, claims and expenses of whatever nature (including attorneys fees, judgments, fines and settlements reasonably incurred) arising out of or in connection with this Agreement or the System, unless caused by the negligence of St. Elizabeth Healthcare or those for whom St. Elizabeth Healthcare is legally responsible. The indemnification provided herein shall survive the termination of this Agreement. By way of example only, if any claim is made against St. Elizabeth Healthcare by any patient or former patient of Covered Entity for any injury related in any way to or 4
resulting from the use of the System in the diagnosis, treatment (including failure to treat) or other care of such patient, then Covered Entity shall indemnify St. Elizabeth Healthcare against and hold it harmless from any and all claims and expenses of whatever nature, except for claims arising out of the negligent provision by St. Elizabeth Healthcare to Covered Entity of incorrect information. VII. Termination and Breach A. Covered Entity shall have as its sole and exclusive remedy for breach of this Agreement by St. Elizabeth Healthcare the right to terminate and cancel this Agreement. Covered Entity agrees that St. Elizabeth Healthcare will not be liable for any consequential or exemplary damages, including lost profits or savings, for any cause relating to this Agreement, including but not limited to the use of or the inability to use the System. B. In the event that Covered Entity or those entrusted by Covered Entity with patient information breach the provisions contained in this Agreement, St. Elizabeth Healthcare may terminate this Agreement immediately. C. The obligation of either party to perform under this Agreement shall be excused during any period of delay caused by matters such as strikes, shortages, government orders or acts of God, which are beyond the control of the party obligated to perform. D. This Agreement may be terminated immediately by either party upon the occurrence of any one of the following events: a) Conviction of either party of any health care related crime defined in 42 U.S.C. 1320a-7(1); b) Any other conduct or activity by either party that jeopardizes the proper operation of the other party; and c) Either party s debarment from, suspension from, exclusion from, or ineligibility to take part in, Federal or state-funded health care programs. VIII. Covered Entity s Right of Use Covered Entity acknowledges that, by virtue of this Agreement, Covered Entity acquires only the right to use the System in accordance with the terms of this Agreement and does not acquire any rights of ownership in the System, any modifications thereto, or any information maintained therein. IX. Term of Agreement The term of this Agreement shall begin the Effective Date of this Agreement and shall continue indefinitely until terminated in writing by either party upon not less than thirty (30) days prior written notice to the other party or pursuant to Article VII above. 5
X. Assignment Covered Entity may not assign this Agreement or any rights hereunder without the express written permission of St. Elizabeth Healthcare, in its sole discretion. St. Elizabeth Healthcare may assign this Agreement to a successor or related corporation or other controlled affiliate, now or hereafter existing. XI. Disclaimer of Warranties St. Elizabeth Healthcare makes no express or implied warranties with respect to its System, including but not limited to any WARRANTY OF MERCHANTABILITY OR WARRANTY OF FITNESS FOR A PARTICULAR PURPOSE. XII. Entire Agreement This Agreement contains the entire understanding of the parties. There are no oral understandings, terms or conditions between the parties, and no party has relied upon any representation, express or implied, not contained in this Agreement. All prior Patient Access Information Agreements entered into between the parties are hereby terminated. To the extent such agreements required termination to be in writing and provided in advance of termination, the parties hereto waive all such requirements as to prior access agreements and desire that this Agreement serve as written waiver as to such requirements. XIII. Modification This Agreement may not be amended, modified, altered or changed in any respect whatsoever except by further agreement in writing, fully executed by each of the parties hereto. XIV. No Third Party Beneficiaries This Agreement is only for the benefit of the parties hereto and is not intended to create any rights or interests on behalf of any other person or entity. XV. Choice of Law and Venue This Agreement shall be governed by and construed according to the laws of the Commonwealth of Kentucky. All duties and obligations hereunder shall be deemed to be performable in Kenton County, Kentucky, and Kenton County shall be the sole and exclusive venue for any proceeding which may arise out of this Agreement. XVI. No Duty to Refer Neither Covered Entity nor St. Elizabeth Healthcare shall have any obligation to refer any 6
patients of either of them or any other person to Covered Entity or St. Elizabeth Healthcare for the provision of any service or item of any kind. XVII. Survival The indemnification provisions contained in Article VI above shall survive termination of this Agreement. XVIII. Federal Exclusion Each party represents that neither that party nor any entity owning or controlling that party is excluded from any federal health care program including the Medicare/Medicaid program or from any state health care program. Each party further represents that it is eligible for Medicare/Medicaid participation. Each party agrees to disclose immediately any material federal, state, or local sanctions of any kind, imposed subsequent to the date of this Agreement, or any investigation which commences subsequent to the date of this Agreement, that would materially adversely impact the parties abilities to perform their obligations hereunder. XIX. Authorized Signatory Each person signing this Agreement represents and warrants that he or she is duly authorized and has legal capacity to execute and deliver this Agreement. Each party represents and warrants to the other that the execution and delivery of the Agreement and the performance of such party s obligations hereunder have been duly authorized and that the Agreement is a valid and legal agreement binding on such party and enforceable in accordance with its terms. IN WITNESS WHEREOF, the parties have executed this Agreement on the date first written above. SAINT ELIZABETH MEDICAL CENTER, INC. By: Name: Gary Blank Title: EVP/Chief Operating Officer COVERED ENTITY: By: Name: Title: 7
EXHIBIT A Covered Entity s Authorized Users (by reference only) Covered Entity acknowledges that it has provided St. Elizabeth Healthcare with Covered Entity s initial request for Authorized Users. St. Elizabeth Healthcare shall enter this initial listing of Authorized Users into the System. Thereafter, Covered Entity shall utilize St. Elizabeth Healthcare s System Access Request (SAR) system to request or remove Authorized Users. Cover Entity s location(s) covered under this Agreement will include the following: Name of Location: Address: 8