Loading...
HomeMy WebLinkAboutC-9288-1 - HIPAA Business Associate Agreementiamllt lOa� HIPAA BUSINESS ASSOCIATE AGREEMENT This Agreement ("Agreement") is entered into by and between Saddleback Community College ("Business Associate") and Newport Beach Fire Department ("Covered Entity"). RECITALS WHEREAS, Business Associate performs functions, activities, or services for, or on behalf of Covered Entity, and Business Associate receives, has access to or creates Health Information in order to perform such functions, activities or services; WHEREAS, Covered Entity is subject to the Administrative Simplification requirements of the Health Insurance Portability and Accountability Act of 1996 and regulations promulgated thereunder ("HIPAA"), including but not limited to, the Standards for Privacy of Individually Identifiable Health Information, 45 Code of Federal Regulations Parts 160 and 164; and WHEREAS, HIPAA requires Covered Entity to enter into a contract with Business Associate to provide for the protection of the privacy and security of Health Information, and HIPAA prohibits the disclosure to or use of Health Information by Business Associate if such a contract is not in place. AGREEMENT NOW, THEREFORE, in consideration of the foregoing, and for other good and valuable consideration, the receipt and adequacy of which is hereby acknowledged, the parties agree as follows: ARTICLE DEFINITIONS 1.1 "Disclose" and "Disclosure" mean, with respect to Health Information, the release, transfer, provision of access to, or divulging in any other manner of Health Information outside Business Associate's internal operations or to other than its employees. 1.2 "Health Information" means information that (a) relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual, or the past, present or future payment for the provision of health care to an individual; (b) identifies the individual (or for which there is a reasonable basis for believing that the information can be used to identify the individual); and (c) is received by Business Associate from or on behalf of Covered Entity, or is created by Business Associate, or is made accessible to Business Associate by Covered Entity. 1.3 "Privacy Regulations" means the Standards for Privacy of Covered Individually Identifiable Health Information, 45 Code of Federal Regulations Parts 160 and 164, promulgated under HIPAA. 1.4 "Services" means the services provided by Business Associate pursuant to the Underlying Agreement(s), or if no such agreement(s) are in effect, the services Business Associate performs with respect to the Covered Entity. 1.5 "Underlying Agreement" means the services agreement executed by the Covered Entity and Business Associate, if any. 1.6 "Use" or "Uses" mean, with respect to Health Information, the sharing, employment, application, utilization, examination or analysis of such Health Information within Business Associate's internal operations. ARTICLE 11 OBLIGATIONS OF BUSINESS ASSOCIATE 2.1 Initial Effective Date of Performance. The obligations created under this Agreement shall become effective on April 14, 2003. 2.2 Permitted Uses and Disclosures of Health Information. Business Associate is authorized to and shall: a. Use and Disclose Health Information as necessary to perform Services for, or on behalf of Covered Entity; b. Use Health Information to create aggregated or de -identified information (in accordance with the requirements of the Privacy Regulations); C. Use or Disclose Health Information (including aggregated or de -identified information) as otherwise directed by Covered Entity provided that Covered Entity shall not request Business Associate to Use or Disclose Health Information in a manner that would not be permissible if done by Covered Entity. Business Associate shall not Use Health Information for any other purpose, except that if necessary, Business Associate may Use Health Information for the proper management and administration of Business Associate or to carry out its legal responsibilities; provided that any Use or Disclosure described herein will not violate the Privacy Regulations or California law if done by Covered Entity. Except as otherwise limited in this Agreement, Business Associate may Disclose Health Information for the proper management and administration of the Business Associate, provided that with respect to any such Disclosure either (a) the Disclosure is required by law (within the meaning of the Privacy Regulations) or (b) the Disclosure would not otherwise violate California law and Business Associate obtains reasonable written assurances from the person to whom the information is to be Disclosed that such person will hold the information in confidence and will not Use or further Disclose such information except as required by law or for the purpose(s) for which it was Disclosed by Business Associate to such person, and that such person will notify Business ,am,, Associate of any instances of which it is aware in which the confidentiality of the information has been breached. 2.3 Adequate Safeguards for Health Information. Business Associate warrants that it shall implement and maintain appropriate safeguards to prevent the Use or Disclosure of Health Information in any manner other than as permitted by this Agreement. 2.4 Mitigation. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of Health Information by Business Associate in violation of the requirements of this Agreement. 2.5 Reporting Non -Permitted Use or Disclosure. Business Associate shall report to Covered Entity each Use or Disclosure that is made by Business Associate, its employees, representatives, agents or subcontractors that is not specifically permitted by this Agreement of which Business Associate becomes aware. The initial report shall be made by telephone call to the Covered Entity within forty-eight (48) hours from the time the Business Associate becomes aware of the non -permitted Use or Disclosure, followed by a written report to covered Entity no later than five (5) days from the date the Business Associate becomes aware of the non -permitted Use or Disclosure. 2.6 Availability of Internal Practices Books and Records. Business Associate agrees to make its internal practices, books and records relating to the Use and Disclosure of Health Information available to the Secretary of the U.S. Department of Health and Human Services ("Secretary"), for purposes of determining Covered Entity's compliance with the Privacy Regulations. 2.7 Access to and Amendment of Health Information. Business Associate shall, to the extent Covered Entity determines that any Health Information constitutes a "designated record set" under the Privacy Regulations, (a) make the Health Information specified by Covered Entity available to Covered Entity or to the individual(s) identified by Covered Entity as being entitled to access and copy that Health Information, and (b) make any amendments to Health Information that are requested by Covered Entity. Business Associate shall provide such access and make such amendments within the time and in the manner specified by Covered Entity. 2.8 Accounting of Disclosures. Upon Covered Entity's request, Business Associate shall provide to Covered Entity an accounting of each Disclosure of Health Information made by Business Associate or its employees, agents, representatives or subcontractors as required by the Privacy Regulations. For each Disclosure that requires an accounting under this Section 2.8, Business Associate shall track the information required by the Privacy Regulations, and shall securely maintain the information for six (6) years from the date of the Disclosure. 2.9 Use of Subcontractors and Agents. Business Associate shall require each of its agents and subcontractors that receive Health Information from Business Associate to execute a written agreement obligating the agent or subcontractor to comply with all the terms of this Agreement with respect to such Health Information. ARTICLE III OBLIGATIONS OF COVERED ENTITY 3.1 Privacy Notice. Covered Entity shall notify Business Associate of any limitation(s) in Covered Entity's notice of privacy practices to the extent such limitation(s) may affect Business Associate's Use or Disclosure of Health Information. ARTICLE IV TERM AND TERMINATION 4.1 Term. Subject to the provisions of Sections 4.2 and 4.3, the term of this Agreement shall be the term of the Underlying Agreement(s). fsr� 4.2 Termination for Cause. Upon Covered Entity's knowledge of a material breach of this Agreement by the Business Associate, Covered Entity shall either: a. notify Business Associate of the breach in writing, and provide an opportunity to cure the breach or end the violation within ten (10) business days of such notification; provided that if Business Associate fails to cure the breach or end the violation within such time period to the satisfaction of Covered Entity, Covered Entity shall have the right to immediately terminate this Agreement and the Underlying Agreement(s) upon written notice to Business Associate; b, upon written notice to Business Associate, immediately terminate this Agreement and the Underlying Agreement(s) if Covered Entity determines that such breach cannot be cured; or C. if Covered Entity determines that neither termination nor cure is feasible, the Covered Entity shall report the violation to the Secretary. 4.3 Termination for Breach of Section 5.2. Covered Entity may terminate the Underlying Agreement(s) and this Agreement upon thirty (30) days written notice in the event (a) Business Associate does not promptly enter into negotiations to amend this Agreement when requested by Covered Entity pursuant to Section 5.2 or (b) Business Associate does not enter into an amendment to this Agreement providing assurances regarding the safeguarding of Health Information that the Covered Entity, in its sole discretion, deems sufficient to satisfy the standards and requirements of HIPAA. 4.4 Disposition of Health Information —Upon Termination or Expiration. Upon termination or expiration of this Agreement, Business Associate shall either return or destroy, in Covered Entity's sole discretion and in accordance with any instructions by Covered Entity, all Health Information in the possession or control of Business Associate and its agents and subcontractors. In such event, Business Associate shall eow� retain no copies of such Health Information. However, if the Business Associate determines that neither return nor destruction of Health Information is feasible, Business Associate shall notify Covered Entity of the conditions that make return or destruction infeasible, and may retain Health Information provided that Business Associate (a) continues to comply with the provisions of this Agreement for as long as it retains #O%N Health Information, and (b) further limits Uses and Disclosures of Health Information to those purposes that make the return or destruction of Health Information infeasible. ARTICLE V MISCELLANEOUS 5.1 Indemnification. Notwithstanding anything to the contrary in the Underlying Agreement(s), at Business Associate's expense, Business Associate agrees to indemnify, defend and hold harmless Covered Entity and Covered Entity's employees, directors, officers, subcontractors or agents (the "Indemnities") against all damages, losses, lost profits, fines, penalties, costs or expenses (including reasonable attorneys' fees) and all liability to third parties arising from any breach of this Agreement by Business Associate or its employees, directors, officers, subcontractors, agents or other members of Business Associate's workforce. Business Associate's obligation to indemnify the Indemnitees shall survive the expiration or termination of this Agreement for any reason. 5.2 Amendment to Comply with Law. The parties acknowledge that state and federal laws relating to electronic data security and privacy are rapidly evolving and that amendment of this Agreement may be required to provide for procedures to ensure compliance with such developments. The parties specifically agree to take such action as is necessary to implement the standards and requirements of HIPAA and other applicable laws relating to the security or confidentiality of Health Information. The parties understand and agree that Covered Entity must receive satisfactory written assurance from Business Associate that Business Associate will adequately safeguard all Health Information that it receives or creates on behalf of Covered Entity. Upon Covered Entity's request, Business Associate agrees to promptly enter into negotiations with Covered Entity, concerning the terms of any amendment to this Agreement embodying written assurances consistent with the standards and requirements of HIPAA or other applicable laws. 00011\ 5.3 Relationship to Underlying Agreements) Provisions. In the event that a provision of this Agreement is contrary to a provision of an Underlying Agreement(s), the provision of this Agreement shall control. Otherwise, this Agreement shall be construed under, and in accordance with, the terms of such Underlying Agreement(s), and shall be considered an amendment of and supplement to such Underlying Agreement(s). 5.4 Modification of Anreement. No alteration, amendment, or modification of the terms of this Agreement shall be valid or effective unless in writing and signed by Business Associate and Covered Entity. 5.5 Non -Waiver. A failure of any party to enforce at any time any term, provision or condition of this Agreement, or to exercise any right or option herein, shall in no way operate as a waiver thereof, nor shall any single or partial exercise preclude any other right or option herein. In no way whatsoever shall a waiver of any term, provision or condition of this Agreement be valid unless in writing, signed by the waiving party, and only to the extent set forth in such writing. 5.6 Agreement Drafted By All Parties. This Agreement is the result of arm's length negotiations between the parties and shall be construed to have been drafted by all parties such that any ambiguities in this Agreement shall not be construed against either party. 5.7 Severability. If any provision of this Agreement is found to be invalid or unenforceable by any court, such provision shall be ineffective only to the extent that it is in contravention of applicable laws without invalidating the remaining provisions hereof. 5.8 Section Headings. The section headings contained herein are for convenience in reference and are not intended to define or limit the scope of any provision of this Agreement. 5.9 No Third Party Beneficiaries. There are no third party beneficiaries to this Agreement. 5.10 Counterparts. This Agreement may be executed in one or more counterparts, each of which shall be deemed an original, and will become effective and binding upon the parties as of the effective date at such time as all the signatories hereto have signed a counterpart of this Agreement. �— 5.11 Notices. Any notices required or permitted to be given hereunder by either party to the other shall be given in writing: (1) by personal delivery; (2) by electronic facsimile with confirmation sent by United States first class registered or certified mail, postage prepaid, return receipt requested; (3) by bonded courier or by a nationally recognized overnight delivery service; or (4) by United States first class registered or certified mail, postage prepaid, return receipt requested, in each case, addressed to: If to Business Associate: Saddleback Community College 28000 Marguerite Pkwy. Mission Viejo, CA 92692 If to Covered Entity; Newport Beach Fire Department P.O. Box 1768 Newport Beach, CA 92658-8915 Attention: Vickie Cleary or to such other addresses as the parties may request in writing by notice given pursuant to this Section 5.12. Notices shall be deemed received on the earliest of personal delivery; upon delivery by electronic facsimile with confirmation from the transmitting machine that the transmission was completed; twenty-four (24) hours following deposit with a bonded courier or overnight delivery service; or seventy-two (72) hours following deposit in the U.S. Mail as required herein. 5.12 Applicable Law and Venue. This Agreement shall be governed by and construed in accordance with the internal laws of the State of California (without regard to principles of conflicts of laws). The parties agree that all actions or proceedings arising in connection with this Agreement shall be tried and litigated exclusively in the state or federal (if permitted by law and a party elects to file an action in federal court) courts located in Orange County. This choice of venue is intended by the parties to be mandatory and not permissive in nature, and to preclude the possibility of litigation between the parties with respect to, or arising out of, this Agreement in any jurisdiction other than that specified in this Section 5.12. Each party waives any right it may have to assert the doctrine of forum non conveniens or similar doctrine or to object to venue with respect to any proceeding brought in accordance with this Section 5.12. 5.13 Interpretation. Any ambiguity in this Agreement shall be resolved to permit Covered Entity to comply with the Privacy Regulations, IN WITNESS WHEREOF, the parties hereto have executed this Agreement effective as of the date stated above. COVERED ENTITY By: V lG�- Print Name: Victoria Cleary Title: EMS Manager, NBFD Dated: 711103 BUSINESS ASSOCIATE Print Name: Gary Poertuer Title:_ Deputy Chancellor ^_ Dated: —Z 'oZ Reviewed by: Diane Dumas, SSN, MS, Psy.D Interim Dean Health Sciences, Human Services and Emeritus Institute Timothy Riley Fire Chief 3300 Newport Blvd. P.O. Box 1768 Newport Beach, CA 92658-8915 NEWPORT BEACH FIRE DEPARTMENT July 1, 2003 Saddleback Community College 28000 Marguerite Pkwy. Mission Viejo, CA 92692 Attn: Lisa Austin Enclosed is a copy of our Business Associate Agreement requiring signature by the authorized person representing Saddleback Community College. Per HIPAA regulations, we are required to have a signed agreement with companies/institutions that have access to our confidential medical records. Please sign the enclosed agreement and return the original copy with wet signatures back to me for our records. You may retain a copy for your files. Please mail it to the following address: Linda Foeldi Newport Beach Fire Department 3300 Newport Blvd. Newport Beach, CA 92663 Thank you for your cooperation in this matter. Please call me at (949) 644-3384 if you have questions regarding this agreement. Sincerely, Linda Foeldi EMS Administration TO: Andrea Gallagher, Business Office FROM: Nadine M. Mendelson, Program Specialist Health Sciences and Human Services DATE' January 23, 1998 Enclosed please find your signed copy of the following Agreements for Health Care Student Program for: Newport Beach Fire Department nm attachments k1,1:GF July 17, 2003 TO: Gary Poertner Deputy Chancellor FROM: Lisa Austin HS Program Specialist, EMS Education Enclosed please find three copies of the following Agreement for Health Care Student Program: Newport Beach Fire Department Please sign all THREE signature pages for the facility and return the documents to us for forwarding to the facility. Thank you for your assistance. /la enclosures MEMORANDUM f TO: J.A. Carcamo Vice Chancellor of Fiscal Services FROM: Dixie Bullock Dean, Health Sciences and Human Services DATE: December 2,1997 Enclosed please find three copies of the following Agreements for Health Care Student Program: ...� Anaheim Fire Department Brea Fire Department Costa Mesa Fire Department Fountain Valley Fire Department Fullerton Fire Department Garden Grove Fire Department Huntington Beach Fire Department Laguna Beach Fire Department La Habra Fire Department Newport Beach Fire Department Orange City Fire Department Oa ange County Fire Authority Santa Ana Fire Department Please sign all THREE signature pages for the facility and return the documents to us for forwarding to the facilities. Thank you for your assistance. Encs. AGREEMENT (HEALTH CARE STUDENT PROGRAM) THIS AGREEMENT is made and entered into this 1st of December 1997, by and between the: Newport Beach Fire Department P.O. Box 1768 Newport Beach, California 92638-8915 (714)644-3106 hereinafter called the Agency, and South Orange County Community College District 28000 Marguerite Parkway Mission Viejo, California 92692 (714) 5$2-4500 hereinafter called the College. PART I. BASIS AND PURPOSE OF AGREEMENT WITNESSETH: WHEREAS, the College and Agency acknowledge a public obligation to contribute to health care education for the benefit for students and to meet community needs. WHEREAS, the College provides approved programs in health care education, including, but not limited to nursing at the RN level, Psychiatric Technician, Emergency Medical Technician - IA and Emergency Medical Technician - Paramedic, and Human Services, which require clinical experiences for students enrolled in these programs. WHEREAS, the Agency has facilities suitable for the clinical needs of the College programs in health care. WHEREAS, it is to the benefit of both College and the Agency that health care students have opportunities for clinical experience to enhance their capabilities as practitioners. Now, THEREFORE, the College and Agency do covenant and agree as follows: PART 11. GENERAL RESPON$IBILTTIES AND PRIVILEGES OF THE COLLEGE A. For the Program in General 1. The College representative shall be the Dean of Health Sciences and Human Services, who will serve as coordinator and liaison of this agreement between the Agency and the College. 2. The College will assume full responsibility for offering health care education programs eligible for accreditation or approval by the appropriate State Board or Agency. 1 3. College faculty members may be invited to serve as voluntary resource persons to the Agency staff by serving on health care committees, by sharing knowledge as clinical experts, and by participating in other matters dealing with the quality of patient care. 4. For Workers' Compensation The College shall carry Workers' Compensation Insurance on students of the College during clinical assignment, and shall keep records of clinical attendance for audit by the State Workers' Compensation Insurance Fund. 5. Hold Harmless Agreement College agrees to and does hereby indemnify and hold harmless to the extent authorized by law the Agency and its officers, agents and employees from every liability, loss, damage, or expense which may be incurred by reason of: liability for (1) death or bodily injury to persons, (2) injury to, loss or theft of property, or (3) any other loss, damage or expense arising under either (1) or (2) above, sustained by the College, the College students participating in laboratory learning experiences, or by any person employed by the College in connection with the laboratory learning experience called for in this Agreement, except for liability resulting from the negligence or willful misconduct of the Agency or its officers, employees, or agents, or independent contractors who are directly employed by the Agency; and any injury to or death of persons or damage to property caused by any act, neglect, default or omission of the College, its employees or students. Agency agrees to and does hereby indemnify and hold harmless to the extent authorized by law, the College, its officers, agents and employees from every liability, loss, damage, or expense which may be incurred by reason of: liability for (1) death or bodily injury to persons, (2) injury to, loss or theft of property, or (3) any other loss, damage or expense arising under either (1) or (2) above, sustained by the Agency, its officers, agents and employees in connection with the laboratory learning experience called for in this Agreement, except for liability resulting from the negligence or willful misconduct of the College, its officers, employees, agents of independent contractors who are directly employed by the College; and any injury to or death of persons or damage to property caused by any act, neglect, default or omission of the Agency, its officers, agents and employees. 6. Public Liability and Property Damage Insurance The College and Agency agree to take out and maintain during the life of this agreement such public liability and property damage coverage as shall protect the College and the Agency harmless. Such insurance shall be in the following amounts: Bodily Injury $1,000,000.00 Property Damage $1,000,000.00 2 Pool.\` B. For Program Planning The College will initiate the development of mutually acceptable clinical instruction plans for using the Agency's clinical areas to meet the educational goals of health care curricula. These plans will be made available to the Agency at a mutually agreed upon time prior to the beginning of the school term and subject to revision in instances of conflict with patient care responsibilities and/or College interests. C. For Instruction 1. The College shall supervise all instruction and clinical experience for all students assigned to the Agency; and participate in the supervision of the instruction and clinical experience for the Nursing Program - Clinical Preceptorship. The College shall assume full responsibility for the content of the educational programs. 2. The College will provide faculty members who are both qualified teachers and competent health care practitioners, as required by the health care program in which they teach. 3. The College will provide orientation for its health care faculty members to familiarize them with Agency policies, practices, and facilities before assigning them to instructional duties at the Agency. 4. The College faculty will be responsible for learning and observing the regulations of both College and Agency as they apply to the circumstances of clinical teaching. 5. The College has the privilege of regularly scheduled meetings with Agency staff, including both selected floor personnel and administrative level representatives for the purpose of interpreting, discussing, and evaluating the educational program in health care. D. For Health Care Students The College will be responsible for assuring the health care students assigned to the Agency for clinical instruction meet both College and Agency standards of health and physical fitness, and shall provide certification that the students have been immunized against the common communicable diseases. /,M\ PART III. GENERAL RESPONSIBILITIES AND PRIVILEGES OF THE AGENCY A. For the Program in General L The Agency will maintain the standards which make it eligible for approval as a clinical area for instruction in an accredited health care program. 2. The Agency staff may participate in the educational program on request of the College instructor. This may be resource persons, clinical experts, or assisting in the planning and implementation of aspects of clinical education. Such participation will be voluntary and shall not interfere with assigned Agency duties. 3 3. The Agency will designate a staff member who will function as Educational Coordinator for health care education uses of the Agency facilities, including joint planning with representatives of all involved health care programs. 4. The Agency will permit the faculty and students of the College to use its patient care and patient service facilities for clinical education according to the approved curricula. B. For Services and Facilities 1. The Agency will permit the educational use of such supplies and equipment as are commonly available for patient care. 2. The Agency will permit use of the following facilities and services by College health care students and faculty at such times and to the degrees considered feasible by the Agency: a. Parking areas. b. Locker, storage and dressing facilities. C. Same food services as are available to Agency staff. d. First aid treatment with written consent required for minors. e. Classroom and conference room space. f. Office and / or desk space for health care faculty. g. Equipment demonstration areas. h. Access to sources of information for educational purposes, such as: (1) Charts, nursing station references, Kardex files. (2) Procedure guides, policy manuals. ` (3) Medical dictionaries, pharmacology references. (4) Books and periodicals in the Medical Library. C. For Control of College Personnel The Agency may refuse access to its clinical areas to health care students or College faculty who do not meet its employee standards for safety, health, cooperation, or ethical behavior, pending investigation and resolution of the matter by the Agency and the College. PART IV. JOINT RESPONSIBILMES AND PRIVILEGE Publication by College faculty or Agency staff members of any material relative to their clinical experience, that has not been approved for release by the College and Agency signers of this agreement, is prohibited. PART V. STATUS OF HEALTH CARE STUDENTS A. Health care students shall have the status of learners and shall not be considered to be Agency employees, nor shall they replace Agency staff. Clinical experience will be conducted as a laboratory learning experience. B. Health care students are subject to the authority, policies and regulations of the College. They are also subject, during clinical assignments, to applicable Agency regulations and must conform to the same standards as are set for Agency employees in matters relating to the welfare of patients and general '� Agency operation. 4 0 /00", C. No student under the influence of drugs, alcoholic beverages, or other chemicals will be allowed presence or practice in any clinical setting. Any student who, in the opinion of the nursing instructor, is judged unsafe according to the above regulation shall be excluded from the clinical setting. Such exclusion from instruction shall be made in the presence of a suitable witness (any licensed personnel). The student will be directed by the nursing instructor to report to the Dean of the Division of Health Sciences and Human Services, who will refer the matter to the South Orange County Community College Vice President of Students, for investigation pursuant to College regulations. At the completion of the investigation, a student found to have violated the above regulations may be disqualified from the program. PART VI. PERIOD OF AGREEMENT This agreement shall be effective as of the date signed, and shall continue in effect until terminated by written notice of either party. The said termination shall become effective only at the close of an academic year, but not before six months after receipt of said notice, except that this agreement may be terminated at anytime upon written mutual consent by the College and the Agency. IN WITNESS WHEREOF, the said parties have hereunto set their hands: SOUTH ORANGE COUNTY COMMUNITY COLLEGE DISTRICT DISTRICT .I By: J. A. Carcamo Title: Vice Chancellor Fiscal Services /g — 3 — Date NEWPORT BEACH FIRE DEPARTMENT AGENCY A U Title: V / --i'U i g _ Date 5