HomeMy WebLinkAbout020314_ca04JEFFERSON COUNTY PuBi-,ic HEALTH Consent Agenda
ypoN 615 Sheridan Street o Port Townsend 0 Washington, o 98368
www.jeff r5oncou rat ypLubllicheaptVi,org
F074
oil
0210AMSIM]
TO: Board of County Commissioners
Philip Morley, County Administrator
DATE: r--e-- ,, r Lt r, 3 , 0-9 "'+
SUBJECT: Agenda Item — HIPAA (Business Associate Agreement with Kitsap Public
Health District in connection with Nightingale Notes Software
Sublicense contract #1210; February 1, 2014 — until terminated; $-0-
STATEMENT OF,ISSUE:
Jefferson County Public Health, Community Health, requests Board approval of the HIPAA Business
Associate Agreement with Kitsap Public Health District in connection with Nightingale Notes Software
Sublicense contract #1210; February 1, 2014 — until terminated; $-0-
AN ALYSIS / STRATEGIC GOALS/ PR a rid, CO N "S:
This agreement complies with the provisions of the Federal Health Insurance Portability and Accountability
Act (HIPAA) of 1996 and the Health Information Technology for Economic and Clinical Health Act (HITECH).
This agreement is submitted in connection with the Kitsap Public Health District contract for the purchase of
Nightingale Notes Software licenses. Nightingale Notes, software is an electronic medical records system
and will be used by 3CPH Maternal Child Health team.
FISCAL IMPACILCOS T BENEFIT, ANALYSIS,;
There is no fiscal impact to the department.
RECOMMENDATIO
JCPH management request approval of the HIPAA Business Associate Agreement with Kitsap Public Health
District in connection with Nightingale Notes Software Sublicense contract #1210; February 1, 2014 — until
terminated; $-0-
FlIPAA BUSINESS ASSOCIATE AGREEIME11T
Between Jefferson County Public Health
And the Kitsap Public Health District
This Agreement ("Agreement") is entered into between the Kitsap Public Health District
("Covered Entity") and Jefferson County Public Health ("Business Associate").
Section I: Purpose
'The purpose of this Agreement is to comply with the provisions of the Federal Health Insurance
Portability and Accountability Act of 1996, set forth in 45 C.F,R. Parts 160 and 164 (commonly
known as "HIPAA"), as amended, and the Health Information Technology for Economic and
Clinical Health Act, (commonly known as the HITECH Act), as set forth in 42.U.S.C. §17921 et.
seq.
Covered Entity and Business Associate have entered into Agreement 1210 to provide certain
services, effective February 1, 2014, and a Business Associate Agreement dated January 1., 201.4.
As a result of amendments to HIPAA, this Agreement supersedes any previously signed
Business Associate Agreements.
Section 11; Terms and Conditions
This Agreement sets forth the Terms and Conditions under which Protected Health Information
(PHI) is created, used, disclosed, maintained, provided or received on behalf of Covered Entity
by the Business Associate.
Section 111. Definitions
General. Terms used, but not otherwise defined, in this Agreement shall, have the same
meaning given to those terms by the HIPAA Final Omnibus Rule and the HITECH Act.
I. Business Associate: "Business Associate" shall mean a person or entity, other than a
member of the Covered Entity's workforce, who performs functions or activities on
behalf of, or provides certain services to, a covered entity that involve access by the
business associate to protected health information. A "Business Associate" is also a
subcontractor that creates, receives, maintains, or transmits protected health information
on behalf of another Business Associate.
2, EPHL " EPHI" shall mean "Electronic Protected Health Information" and shall have the
same meaning as the term "electronic protected health information" in 45 CFR § 160.103,
limited to the information that Business Associate creates, receives, maintains, or
transmits from or on behalf of Covered Entity.
Individual. "Individual" shall have the same meaning as the term "individual." in 45
CFR § 160.103 and shall include a person who qualifies as a personal representative in
accordance with 45 CFR § 164.502(g).
3, I=LTL "PHI" shall mean "Protected Health Information," and shall have the ,same
meaning as the term "protected health information" in 45 C.FR. §160.103, limited to the
information created or received by Business Associate from or on behalf of Covered
Entity.
4. Unsecured Protected Health Information, "Unsecured Protected Health Information'
,shall have the same meaning as the term "unsecured protected health information" in
the HITECH Act, Section 13402(h)(1),
Section IV. Responsibilities of Business Associate
Ilse„ end D sclosure. Business Associate may use or disclose PI-11 to perform its
obligations for, or on behalf of, Covered Entity provided that such disclosures shall
comply with the provisions of this Agreement relating to privacy and security of PHI
and all present and future provisions of HIPAA and the FIITECH Act and applicable
Washington state laws as they relate, to the privacy and security of PHI and that are
applicable to Covered Entity and/or Business Associate.
2, APP19PI'la—te IjLar.s. Business Associate agrees to use appropriate ad. ainistrative,
physical, and technical safeguards to prevent the use or disclosure of PHI and EPHI
other than as provided for by this BA Agreement
3.4elats ai tc Subcctttractcars. Business Associate will, ensure that any agent, including a
subcontractor, to whom Business Associate provides PHI or EPHI has executed a
Business Associate Agreement containing substantially the same terms as this Business
Associate Agreement, including the same restrictions and conditions that apply to
Business Associate with respect to such P1 IL
g or �,l nZ, Business Associate will promptly report to Covered Entity any use or
disclosure of PHI or EPHI not provided for in this agreement of which Business
Associate becomes aware within fourteen (14) business days of such prohibited use or
disclosure. In addition, Business Associate agrees to promptly notify Covered Entity
following the discovery of a breach of Unsecured PHI. Any notice of a security incident
or breach of Unsecured Protected Health Information shall include the identification of
each Individual whose Protected Health Information has been, or is reasonably believed
by Business Associate to have been, accessed, acquired, or disclosed during such
Security Incident or Breach as well as any other relevant information regarding the
Security Incident or Breach,
2.3, Ike aortitl Business Associate agrees to report to Covered, Fntity any u.se or
disclosure of Protected Ilealth Information not permitted by this BA Agreement of which
Business Associate becomes aware.
10
2.4. Milligq aitigate
ji(gi2. Business Associate agrees to n , to the extent practicable, any
harmful effect that is known to Business Associate of a use or disclosure of Protected Health
Information by Business Associate or its employees, officers or agents in violation of the
requirements of this BA Agreement (including, without limitation, any Security Incident or
Breach of Unsecured Protected Health Information), Business Associate agrees to reasonably
cooperate and coordinate with Covered Entity in the investigation of any violation of the
requirements of this BA Agreement and/or any Security Incident or Breach, Business Associate
shall also reasonably cooperate and coordinate with Covered Entity in the preparation of any
reports or notices to the Individual, a regulatory body or any third party required to be made
under FIIPAA, HIPAA Regulations, the HITECH Act, or any other Federal or State laws, rules
or regulations, provided that any such reports or notices shall be subject to the prior written
approval of Covered Entity.
2.5. A-Zents. Business Associate shall ensure that any agent, including a subcontractor, to
whom it provides Protected I-lealth Information received from, or created or received by,
Business Associate on behalf of Covered Entity agrees to the same restrictions and conditions
that apply through this BA Agreement to Business Associate with respect to such information.
,d Recqy4..5et,-;. To the extent that Business Associate possesses or
2.6. Acc!�-s-,'.;. tQjDe-sig-�'S—c
maintains Protected Health Information in a Designated Record Set, Business Associate agrees
to provide access, at the request of Covered Entity, and in the time and manner designated by
the Covered Entity, to Protected Health Information in a Designated Record Set, to Covered
Entity or, as directed by Covered Entity, to an Individual in, order to meet the requirements
under HIPAA Regulations, If an Individual makes a request for access to Protected Health
information directly to Business Associate, Business Associate shall notify Covered Entity of the
request within three (3) business days of such request and will cooperate with Covered Entity
and allow Covered Entity to send the response to the Individual.
2.7. Ln To the extent that Business Associate
if n4m!�-n—ts t�j Q L��
possesses or maintains Protected Health Information in a Designated Record Set, Business
Associate agrees to make any amendnient(s) to Protected Health Information in a Designated
Record Set that the Covered Entity directs or agrees to pursuant tea HIPAA Regulations at the
request of Covered Entity or an Individual, and in the time and manner designated by the
Covered Entity. If an individual makes a request for an amendment to Protected Health
Information directly to Business Associate, Business Associate shall notify Covered Entity of the
request within three business (3) days of such request and will cooperate with Covered Entity
and allow Covered Entity to send the response to the Individual.
2.8, &gcLe._,-;', to Iica aks a t.Records. Business Associate agrees to make its internal
practices, books, and records, including policies and procedures and Protected I ieal th
Information, relating to the use and disclosure of Protected Health Information received from,
or created or received by Business Associate on behalf of, Covered Entity available to the
Covered Entity, or to the Secretary, in a time and manner designated by the Covered Entity or
designated by the Secretary, for purposes of the Secretary determining Covered Entity's
compliance with the Privacy Rule.
2,9- AccL)q
_ntijjg' s. Business Associate agrees to document such disclosures of Protected
Health Information and information related to such disc.losures, as would be required for
Covered Entity to respond to a request by an Individual for an accounting of disclosures of
Protected Health Information in accordance with HIPAA, FIIPAA Regulations and the HITECH
Act.
2, 10, Requests for �" LC L)u—ntinFs, Business Associate agrees to provide to Covered Entity
or an Individual, in the time and manner designated by the Covered Entity, information
collected in accordance with Section 2(i) of this BA Agreement, to permit Covered Entity to
respond to a request by an Individual for an accounting of disclosures of Protected Flealth
information in accordance with HIPAA, HIPAA Regulations and the HITECH Act. If an
Individual makes a request for an accounting directly to Business Associate, Business Associate,
shall notify Covered Entity of the request within three business (3) days of such request and will
cooperate with Covered Entity and allow Covered Entity to send the response to the Individual.
ARTICLE III
Permitted Uses and Disclosures by Business Associate
3.1. 5ery als ASL ee�Lrjk, Except as otherwise limited in this BA Agreement, Business
_ m _
Associate may use or disclose Protected Health Information to perform functions, activities, or
services for, or on behalf of, Covered Entity as specified in the Services Agreement, provided
that such use or disclosure would not violate HIPAA, FIIPAA Regulations or the HITECH Act if
done by Covered Entity or the minimum necessary policies and procedures of the Covered
Entity.
3.2. jLse (or -_A�lMjjiistrafionof Business Associate. Except as otherwise limited in this BA
Agreement, Business Associate may use Protected Health Information for the proper
management and administration of the Business Associate or to carry out the legal
responsibilities of the Business Associate.
3 �lc�s 3,..P.L,_ ure for Administration of Business Associate. Except as otherwise limited in
this BA Agreement, Business Associate may disclose Protected Health information for the
proper ma , nagement and administration of the Business Associate, provided that (i) disclosures
are Required by Law, or (ii) Business Associate obtains reasonable assurances from the person
to w1,10M the information is disclosed that it will rernain confidential and used or further
disclosed only as Required by Law or for the purpose for which it was disclosed to the person,
and the person notifies the Business Associate of any instances of which it is aware in which the
confidentiality of the information has been breached.
ARTICLE IV
Permissible Requests by Covered Entity
Except as set forth in Section 3 of this BA Agreement, Covered Entity shall not request Business
Associate to use or disclose Protected Health Information in any manner that would not be
permissible under the Privacy Rule if done by Covered Entity.
ARTICLE V
Term and Termination
5.1. Term, This BA Agreement shall be effective as of the date of this BA Agreement and
shall terminate when all of the Protected Health Information provided by Covered Entity to
Business Associate, or created or received by Business Associate on behalf of Covered Entity, is
destroyed or returned to Covered Entity, or, if it is infeasible to return or destroy Protected
1--lealth Information, protections are extended to such information, in accordance with the
termination provisions in this Section.
5.2. —r!n—iDA!kLn—f9-1LCause. Upon Covered Entity's knowledge of a material breach by
Business Associate of the terms of this BA Agreement, Covered Entity shall either:
(a) Provide an opportunity for Business Associate to cure the breach or end the violation.
If Business Associate does not cure the breach or end the violation within the erne specified by
Covered Entity, Covered Entity shall terminate-. (i) this BA Agreement; (ii) all of the provisions
of the Services Agreement that involve the use or disclosure of Protected Health Irif orination;
and (iii) such other provisions, if any, of the Services Agreement as Covered Entity designates
in its sole discretion;
(b) If Business Associate has breached a material term of this 13A Agreement and cure is
not possible, irru-nediately terminate. (i) this BA Agreement; (ii) all of the provisions of the
SS o Health Information; and (iii)
Services Agreement that involve the use or disclosure f Protected I
such other provisions, if any, of the Services Agreement as Covered Entity designates in its sole
discretion; or
(c) If neither termination nor cure is feasible, Covered Entity shall report the violation to
the Secretary.
53, Fff(: qof.ji�rrrjina tY an.
(a) Except as provided in this Section 5, upon termination of this BA Agreement, for any
reason, Business Associate shall, return or destroy all Protected Health Information received
from Covered Entity, or created or received by Business Associate on behalf of Covered Entity,
This provision shall apply to Protected Health Information that is in the possession of
subcontractors or agents of Business Associate. Business Associate shall retain no copies of the
Protected liealth Information.
(I-)) it, the event that Business Associate determines that returning or destroying the
Protected Health information is infeasible, Business Associate shall provide to Covered Entity
notification Of the conditions that make return or destruction infeasible. 'Upon mutual
agreement of the Parties that return or destruction of Protected I lealth Information is infeasible,
Business Associate shall extend the protections of this BA Agreement to such Protected Health
tr1formation and lirnit further uses and disclosures of such Protected Health Information to
those purposes that make the return or destruction infeasible, for so long as Business Associate
rnaintains Such Protected ilealth Information.
ARTICLE VI
Indemnity
Business Associate agrees to indemnify, defend and bold harmless Covered Entity and its
employees, directors/ trustees, members, professional staff, representatives and, agents
(collectively, the "Inden-mitees") from and against any and all claims (whether in law or in
equity), obligations, actions, causes of action, suits, debts, judgments, losses, fines, penalties,
damages, expenses (including attorney's fees), liabilities, lawsuits or costs incurred by the
Indemnities which arise or result from a breach of the terms and conditions of this BA
Agreement or a violation of HIPAA, the HrFECH Act or HIPAA Regulations by Business
Associate or its employees or agents, Business Associate's indemnification obligations
hereunder shall not be subject to any limitations of liability or remedies in the Service
Agreement,
ARTICLE VII
Compliance with HIPAA Transaction Standards
When providing, its services and/or products, Business Associate shall comply with all
applicable HIPAA standards and requirements (including, without limitation, those specified in
45 CFR Part 162) with respect to the transmission of health information in electronic form in
connection with any transaction for which the Secretary has adopted a standard under HIPAA
("Covered Transactions "). Business Associate will make its services and/or products compliant
with HIPAA's standards and requirements no less than thirty (30) days prior to the applicable
compliance dates under HIPAA. Business Associate represents and warrants that it is aware of
all current HIPAA standards and requirements regarding Covered Transactions, and Business
Associate shall comply with any modifications tol-11PAA standards and requirements which
become effective from time to time. Business Associate agrees that such compliance shall, be at
its sole cost and expense, which expense shall not be passed on to Covered Entity in any form,
including, but not limited to, increased fees, Business Associate shall require all of its agents
and subcontractors (if any) who assist Business Associate in providing its services and/or
products to comply with the terms of this Article V11.
ARTICLE VIII
Miscellaneous
8.1. Regulatory References, A reference in this BA Agreement to a section in HIPAA,
HIPAA Regulation,,;, or the FlITECF1 Act means the section as in effect or as amended or
modified from time to tirne, including any corresponding provisions of subsequent superseding
laws or regulations.
82 Amendment,'Fhe Parties agree to take such action as is necessary to amend the
S 0 ity to comply with the
,ervices Agreement from time to time as is necessary for Covered Ent
requirements of HIPAA, the HIPAA Regulations and the HITECH Act.
8.3. Survival,'Fhe respective rights and obligations of Business Associate under Sections-
53 and Article VI of this BA Agreement shall survive the termination of the Services Agreement
or this BA Agreement.
6
8A, Interpretation, Any ambiguity in this Agreement shall be resolved to permit
Covered Entity to comply with HIPAA, HIPAA Regulations and the HITECH Act.
8.5. Miscellaneous.The terms of this BA Ag
,reement are hereby incorporated into the
Services Agreement, Except as otherwise set forth in Section 8.4 of this BA Agreement, in the
event of a conflict between the terms of this BA Agreement and the terms of the Services
Agreement, the terms of this BA Agreement shall prevail, The terms of the Services Agreement
which are not modified by this BA Agreement shall remain in full force and effect in accordance
with the terms thereof. This BA Agreement shall be governed by, and construed in accordance
with, the laws of the State of Washington, exclusive of conflict of law rules. Each party to this
BA A, reement hereby agrees and consents that any legal action or proceeding with respect to
this BA Agreement shall only be brought in the courts of the state where the Covered Entity is
located in the county where the Covered Entity is located. The Services Agreement together
with this BA Agreement constitutes the entire agreement between the parties with respect to the
subject matter contained herein, and this BA Agreement supersedes and replaces any former
business associate agreement or Agreement entered into by the parties. This BA Agreement
may be executed in counterparts, each of which when taken together shall constitute one
original. No amendments or modifications to the BA Agreement shall be effected unless
executed by both parties in writing,
IN MYNES") WHEREOF, the parties have executed this BA Agreement as of the date set
forth above.
KITSAP PUBLIC HEALTH DISTRICT
By: - — .m— ._
Name : Scott Daniels
Title: Administrator
BUSINESS ASSOCIATE
... . . ........
Name: John Austin
Title: Chair, Jefferson Board of County
Commissioners