HomeMy WebLinkAbout041816_ca01I 615 Sheridan Street
Port Townsend, WA 98368
eehson www.JeffersonCountyPublicHealth.org
Public He� consent Agenda
March 25, 2016
JEFFERSON COUNTY
BOARD OF COUNTY COMMISSIONERS
AGENDA REQUEST
TO: Board of County Commissioners
Philip Morley, County Administrator
FROM: Veronica Shaw, Deputy Director
DATE: 4 /19 / X01
SUBJECT: Agenda Item — Business Associates Agreement — Marc Bolan Consulting; Upon
Signature — 12/31/2016
STATEMENT OF ISSUE:
Jefferson County Public Health requests approval of Business Associates Agreement — Marc Bolan
Consultants; Upon Signature — 12/31/2016
ANALYSIS/ STRATEGIC GOALS/PRO'S and CON'S:
In connection with the Nurse Family Partnership agreement between Jefferson County Public Health and
the Port Gamble S'Klallam Tribe, JCPH is required by HIPPA to enter into a Business Associates Agreement
with Marc Bolan Consultants, a consulting agency engaged in performing work that falls under the purview
of Protected Health Information. Port Gamble S'Klallam and JCPH enter confidential data into a shared
database, associated with Nurse Family Partnership, which requires each agency to be responsible for its
own data entry. Port Gamble S'Klallam Tribe has hired Marc Bolan Consulting to input its data and,
therefore, JCPH data will be visible to this agency. In keeping with HIPPA, JCPH is entering into a Business
Associates Agreement, while working toward achieving separate databases, to prevent any delay in data
being entered.
FISCAL IMPACT/COST BENEFIT ANALYSIS:
There is no exchange of money associated with this agreement.
RECOMMENDATION:
JCPH Management recommends BOCC signature of the Business Associates Agreement — Marc Bolan
Consultants; Upon Signature — 12/31/2016
Community Health
Developmental Disabilities
360-385-9400
360-385-9401 (f)
Date
Always working for a safer and healthier community
Environmental Health
Water Quality
360-385-9444
(f) 360-379-4487
BUSINESS ASSOCIATE AGREEMENT
This Privacy Agreement ("Agreement") is effective upon signing this Agreement and is entered into
by and between Jefferson County Public Health ("Covered Entity") and Marc Bolan Consulting (the
"Business Associate").
1. Term. This Agreement shall remain in effect for the duration of the Task Order the Business
Associate has with Port Gamble S'Klallam Tribe (December 31, 2016), and shall apply to all of the
Services and/or Supplies delivered by the Business Associate pursuant to this Agreement. This
Agreement shall also apply to any subsequent Task Orders, contracts or Agreements the Business
Associate executes or will execute with the Port Gamble S'Klallam Tribe for work to be performed
by the Business Associate regarding Protected Health Information ("PHI") after December 31, 2016.
2. HIPAA Assurances. In the event Business Associate creates, receives, maintains, or otherwise is
exposed to personally identifiable or aggregate patient or other medical information defined as PHI
in the Health Insurance Portability and Accountability Act of 1996 or its relevant regulations
("HIPAA") and otherwise meets the definition of Business Associate as defined in the HIPAA
Privacy Standards (45 CFR Parts 160 and 164), Business Associate shall:
(a) Recognize that HITECH (the Health Information Technology for Economic and Clinical Health
Act of 2009) and the regulations thereunder (including 45 C.F.R. Sections 164.308, 164.310,
164.312, and 164.316), apply to a business associate of a covered entity in the same manner that such
sections apply to the covered entity;
(b) Not use or further disclose the PHI, except as permitted by law;
(c) Not use or further disclose the PHI in a manner that had Marc Bolan Consulting (Business
Associate) done so, would violate the requirements of HIPAA;
(d) Use appropriate safeguards (including implementing administrative, physical, and technical
safeguards for electronic PHI) to protect the confidentiality, integrity, and availability of and to
prevent the use or disclosure of the PHI other than as provided for by this Agreement;
(e) Comply with each applicable requirements of 45 C.F.R. Part 162 if the Business Associate
conducts Standard Transactions for or on behalf of the Covered Entity;
(f) Report promptly to Jefferson County Public Health any security incident, other use, misuse or
disclosure of PHI not provided for or authorized by this Agreement of which Business Associate
becomes aware;
(g) Ensure that any subcontractors or agents who receive or are exposed to PHI (whether in
electronic or other format) are explained the Business Associate obligations under this paragraph and
agree to the same restrictions and conditions;
(h) Make available PHI in accordance with the individual's rights as required under the HIPAA
regulations;
(i) Account for PHI disclosures for up to the past six (6) years as requested by Covered Entity, which
shall include: (1) Dates of disclosure, (2) names of the entities or persons who received the PHI, (3) a
brief description of the PHI disclosed, and (4) a brief statement of the purpose and basis of such
disclosure;
0) Make its internal practices, books, and records that relate to the use and disclosure of PHI
available to the U.S. Secretary of Health and Human Services for purposes of determining
Customer's compliance with HIPAA; and
(k) Incorporate any amendments or corrections to PHI when notified by Customer or enter into a
Business Associate Agreement or other necessary Agreements to comply with HIPAA.
Business Associate Agreement: Bolan, Marc
3. Termination upon Breach of Provisions. Notwithstanding any other provision of this
Agreement, Covered Entity may immediately terminate this Agreement if it determines that Business
Associate breaches any term in this Agreement. Alternatively, Covered Entity may give written
notice to Business Associate in the event of a breach and give Business Associate five (5) business
days to cure such breach. Covered Entity shall also have the option to immediately stop all further
disclosures of PHI to Business Associate if Covered Entity reasonably determines that Business
Associate has breached its obligations under this Agreement. In the event that termination of this
Agreement is not feasible, Business Associate hereby acknowledges that the Covered Entity shall be
required to report the breach to the Secretary of the U.S. Department of Health and Human Services,
notwithstanding any other provision of this Agreement or Agreement to the contrary.
4. Return or Destruction of Protected Health Information upon Termination. Upon the
termination of this Agreement, unless otherwise directed by Covered Entity, Business Associate shall
either return or destroy all PHI received from the Covered Entity or created or received by Business
Associate on behalf of the Covered Entity in which Business Associate maintains in any form.
Business Associate shall not retain any copies of such PHI. Notwithstanding the foregoing, in the
event that Business Associate determines that returning or destroying the Protected Health
Information is infeasible upon termination of this Agreement, Business Associate shall provide to
Covered Entity notification of the condition that makes return or destruction infeasible. To the extent
that it is not feasible for Business Associate to return or destroy such PHI, the terms and provisions
of this Agreement shall survive such termination or expiration and such PHI shall be used or
disclosed solely as permitted by law for so long as Business Associate maintains such Protected
Health Information.
5. No Third Party Beneficiaries. The parties agree that the terms of this Agreement shall apply only
to themselves and are not for the benefit of any third party beneficiaries.
6. De -Identified Data. Notwithstanding the provisions of this Agreement, Business Associate and its
subcontractors may disclose non -personally identifiable information provided that the disclosed
information does not include a key or other mechanism that would enable the information to be
identified.
Approved this day of 32016.
BOARD OF COUNTY COMMISSIONERS
JEFFERSON COUNTY, WASHINGTON
i
Kathleen Kler, Chairwoman
ATTEST:
Clerk of the Board
Business Associate Agreement: Bolan, Marc
(Marc Bolan Consulting)
DATE
APPROVED AS TO FORM ONLY:
Civil Deputy P osecuting Attorney