Loading...
HomeMy WebLinkAboutBackup DocumentHIPAA DATA SHARING AGREEMENT This Business Associate Agreement ("Agreement") is entered into by and between Miami - Dade County, a political subdivision of the State of Florida, (hereinafter "Covered Entity"), and its agents or assignees, and the City of Miami, by and through its Department of Community and Economic Development and its Housing Opportunities for Persons with AIDS (HOP WA) program and its agents or assignees (hereinafter "Business Associate"), for purposes of complying with the requirements of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). RECITALS A. Covered Entity wishes to disclose certain information ("Information") to Business Associate some of which may constitute Protected Health Information ("PHI"), for the purpose of coordinating care along the HIV Housing and Care and Treatment Continuums of Care. B. Covered Entity and Business Associate intend to protect the privacy and provide for the security of PHI disclosed to Business Associate in compliance with HIPAA and regulations promulgated thereunder by the U.S. Department of Health and Human Services (the "HIPAA Regulations") and other applicable laws. In consideration of the mutual promises below and the exchange of information pursuant to this Agreement, the parties agree as follows: 1. Definitions. a) "Business Associate" shalI have the meaning given to such term under the HIPAA Regulations, including, but not limited to, 45 CFR Section 160.103. b) "Covered Entity" shall have the meaning given to such term under the HIPAA Regulations, including, but not limited to, 45 CFR Section 160.103. C) "Effective Date" shall mean the date that this Agreement is fully executed by the parties. d) "Individual" shall have the same meaning as the term "individual" in 45 CFR 164.501 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g). e) "Protected Health Information" or "PHI" means any information, whether oral or recorded in any form or medium: (i) that relates to the past, present or future physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual, and (ii) that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual, and shall have the meaning given to such term under HIPAA and the HIPAA Regulations, including, but not limited to 45 CFR Section 164.501. 2. Obligations and Activities of Business Associate. Page 1 of 7 a) Business Associate agrees to not use or further disclosure Protected Health Information other than as permitted or required by the Agreement or as required by law. b) Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement. C) Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement. d) Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity, agrees to these same restrictions and conditions. e) Business Associate agrees to make internal practices, books, and records relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity available to the Covered Entity, or at the request of the Covered Entity, in a time and manner designated by the Covered Entity for purpose of the Covered Entity's compliance with the Privacy Rule. f) Business Associate agrees to document disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information. g) Business Associate agrees to provide to Covered Entity as disclosure of Protected Health Information occurs information collected in accordance with Section (f) of this Agreement, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information. 3. Obligations and Activities of Covered Entity. a) Covered Entity shall provide Business Associate with notice of privacy practices that Covered Entity produces in accordance with 45 CFR 164.520, as well as any changes to such notice. b) Covered Entity agrees to not use or further disclose Protected Health Information received from Business Associate other than as permitted or required by the Agreement or as required by law. C) Covered Entity agrees to use appropriate safeguards to prevent use or disclosure of the Protected Health Information received from Business Entity other than as provided for by this Agreement. d) Covered Entity agrees to report to Business Associate any use or disclosure of the Protected Health Information not provided for by this Agreement. e) Covered Entity agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Covered Entity on behalf of Business Associate, agrees to the same restrictions and conditions. Page 2of7 f) Covered Entity agrees to make internal practices, books, and records relating to the use and disclosure of Protected Health Information received from, or created or received by Covered Entity on behalf of Business Associate available to the Business Associate in a timely manner designated by the Business Associate for purposes of the Covered Entity determining Business Associate's compliance with the Privacy Rule. g) Covered Entity agrees to document disclosures of Protected Health Information and information related to such disclosures as would be required for Business Associate to respond to a request by an individual for an accounting of disclosures of Protected Health Information. h) Covered Entity agrees to provide to Business Associate as disclosures of Protected Health Information occurs information collected in accordance with Section (f) of this Agreement, to permit Business Associate to respond to a request by an Individual for an accounting of disclosures of Protected Health Information. 4. Permissible Requests by Covered Entity or Business Associate. a) Covered Entity shall not request Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under the Privacy Rule if done by Covered Entity. b) Business Associate shall not request Covered Entity Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under the Privacy Rule if done by Business Associate. 5. Term This agreement shall become effective on the Effective Date and shall continue in effect until all obligations of the parties have been met, unless terminated as provided herein or by mutual agreement of the parties. 6. Termination. a) Material Breach. A breach by Business Associate of any material provision of the Agreement, as determined by Covered Entity, shall constitute a material breach of the Agreement and shall provide grounds for immediate termination of the Agreement by Covered entity. b) Reasonable Steps to Cure Breach. If Covered Entity knows of a pattern of activity or practice of Business Associate that constitutes a material breach or violation of the Business Associate's obligations under the provisions of this Agreement and does not terminate this Agreement pursuant to Section 6(a), then Covered Entity shall take reasonable steps to cure such breach or end such violation, as applicable. If Covered Entity's efforts to cure such breach or end such violation are unsuccessful, Covered Entity shall either (i) terminate this Agreement, if feasible or (ii) if termination of this Agreement is not feasible, Covered Entity shall report Business Associate's breach or violation to the Secretary of the Department of Health and Human Services. C) Judicial or Administrative Proceedings. The Covered Entity may terminate this Agreement, effective immediately, if (i) the Business Associate is named as a defendant in a criminal proceeding for a violation of HIPAA or (ii) a finding or stipulation that the Business Associate has violated any standard or requirement of HIPAA or other security or privacy laws Page 3 of 7 and is made in any administrative or civil proceeding in which the Business Associate has been joined. d) Effect of Tern-unation. Upon termination of this Agreement for any reason, Business Associate shall return or destroy all Protected Health Information received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity, that Business Associate still maintains in any form, and shall retain no copies of such PHI or, if return or destruction is not feasible, it shall continue to extend the protections of the Agreement to such information, and limit further use of such PHI to those purposes that make the return or destruction of such PHI indefeasible. This provision shall apply to Protected Health Information that is in the possession of subcontractors or agents of Business Associate. 7. Indemnification. a) The Covered Entity shall indemnify and hold harmless the Business Associate, and its officers, employees, agents, servants, agencies and instrumentalities from any and all liability, losses or damages, including attorneys' fees and costs of defense, which the Business Associate and its officers, employees, agents, servants, agencies or instrumentalities may incur as a result of any and all claims, demands, suits, causes of action or proceedings of any kind or nature arising out of, relating to or resulting from the performance of this Agreement by the Covered Entity or the Covered Entity's officers, employees, agents, servants, partners, principals or subcontractors. The Covered Entity shall pay all claims and losses of any kind in connection therewith and shall investigate and defend all claims, suits or actions of any kind or nature in the name of the Business Associate, where applicable, including appellate proceedings, and shall pay all costs, judgments, and attorney's fees which may issue thereon. Provided, however, this indemnification shall only be to the extent and within the limitations of Section 768.28 Florida Statutes, subject to the provisions of that statute whereby the Covered Entity shall not be held liable to pay a personal injury or property damage claim or judgment by any one person which exceeds the sum of $200,000, or any claim or judgment or portions thereof, which, when totaled with all other claims or judgments paid by the Covered Entity arising out of the same incident or occurrence, exceed the sum of $300,000 from any and all personal injury or property damage claims, liabilities, losses or causes of action which may arise as a result of the negligence of the Covered Entity or the Covered Entity's officers, employees, servants, agents, partners, principals or subcontractors. b) The Business Associate shall indemnify and hold harmless the Covered Entity, and its officers, employees, agents, servants, agencies and instrumentalities from any and all liability, losses or damages, including attorneys' fees and costs of defense, which the Covered Entity and its officers, employees, agents, servants, agencies or instrumentalities may incur as a result of any and all claims, demands, suits, causes of action or proceedings of any kind or nature arising out of, relating to or resulting from the performance of this Agreement by the Business Associate or the Business Associate's officers, employees, agents, servants, partners, principals or subcontractors. The Business Associate shall pay all claims and losses of any kind in connection therewith and shall investigate and defend all claims, suits or actions of any kind or nature in the name of the Covered Entity, where applicable, including appellate proceedings, and shall pay all costs, judgments, and attorney's fees which may issue thereon. Provided, however, this indemnification shall only be to the extent and within the limitations of Section 768.28 Florida Statutes, subject to the provisions of that statute whereby the Business Associate shall not be held liable to pay a personal injury or property damage claim or Judgment by any one person which exceeds the sum Page 4 of 7 of $200,000, or any claim or judgment or portions thereof, which, when totaled with all other claims or judgments paid by the Business Associate arising out of the same incident or occurrence, exceed the sum of $300,000 from any and all personal injury or property damage claims, liabilities, losses or causes of action which may arise as a result of the negligence of the Business Associate or the Business Associate's officers, employees, servants, agents, partners, principals or subcontractors. C) Term of Indemnification. The provisions of section (7) shall survive the expiration or termination of this Agreement. 8. Survival. The respective rights and obligations of the Business Associate and the Covered Entity shall survive the termination of this Agreement indefinitely. 9. Amendment. This Agreement may not be modified or amended, except in writing as agreed to by both parties hereto. 10. No Third Party Beneficiaries. Nothing expressed or implied in this Agreement is intended to confer, nor shall anything herein confer, upon any person other than the parties hereto, any rights, remedies, obligations, or liabilities whatsoever. 11. Effect on Agreement. Except as specifically required to implement the purposes of this Agreement, or to the extent inconsistent with this Agreement, all other terms of the Agreement shall remain in force and effect. 12. Interpretation. This Agreement shall be interpreted as broadly as necessary to implement and comply with HIPAA, HIPAA Regulations and applicable state laws. 13. Law. This Agreement shall be governed under the laws of the State of Florida as to all matters, including but not limited to matters of validity, construction, effect and performance. Venue for any Iitigation between parties regarding this Agreement shall lie only in state and federal court in Miami -Dade County, Florida. IN WITNESS WHEREOF, the parties have caused this Contract to be executed by their respective and duly authorized officers as of the day and year first above written. [SIGNATURES APPEAR ON THE FOLLOWING PAGES] Page 5 of 7 For the City: ATTEST: Daniel J. Alfonso City Manager Date: Victoria M6ndez City Attorney Todd B. Hannon City Clerk Ann -Marie Sharpe, Director Department of Risk Management Page 6of7 FOR MIAMI-DADE COUNTY, FLORIDA ATTEST: HARVEY RUVIN, CLERK MIAMI-DADE COUNTY, FLORIDA Deputy Clerk Approved as to form and legal sufficiency: Terrence A. Smith Assistant County Attorney M. Page 7 of 7 Mayor or Deputy Mayor