Loading...
HomeMy WebLinkAboutFlex-Plan Services Inc - Business Associate AgreementA f ( ?emll~ KNOWLEDGEABLE I VA"T"IV FLEX-PLAN SERVICES INCORPORATED BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement (the "Agreement") is entered into between Flex-Plan Services, Inc. and City of Auburn effective as of January 1, 2009. Recitals WHEREAS, the parties hereto (the "Parties") have entered into an arrangement (the "Administrative Services Agreement") whereby Flex-Plan Services, Inc. provides services to City of Auburn, and Flex-Plan Services, Inc. receives, has access to, or creates, Protected Health Information in order to provide those services; WHEREAS City of Auburn is a"Covered Entity" and subject to the Administrative Simplification requirements of the Health Insurance Portability and Accountability Act of 1996, and regulations promulgated thereunder, including the Privacy Rule; WHEREAS, the Privacy Rule requires City of Auburn to enter into a contract with Flex-Plan Services, Inc.; NOW, THEREFORE, in consideration of the foregoing, and for other good and valuable consideration, the receipt and adequacy of which is hereby acknowledged, the Parties agree as follows: 1. Definitions 1.1 Business Associate. "Business Associate° shall mean Flex-Plan Services, Inc. ("Flex-Plan"). 1.2 Covered Entity. "Covered Entity" shall mean City of Auburn. 1.3 Individual. "Individual" shall have the same meaning as the term "individual" in 45 CFR 164.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g). 1.4 Privacy Rule. "Privacy Rule° shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E. 1.5 Protected Health Information. "Protected Health Information" shall have the same meaning as the term "protected health information" in 45 CFR 160.103, limited to the information created or received by Business Associate from or on behalf of Covered Entity. 1.6 Required By Law. "Required By Law" shall have the same meaning as the term "required by law" in 45 CFR 164.103. 1.7 Secretary. "Secretary" shall mean the U.S. Secretary of the Department of Health and Human Services or his designee. 1.8 Security Incident. "Security IncidenY" shall have the same meaning as the term "security incidenY" in 45 CFR 164.304. 1.9 Security Rule. "Security Rule" shall mean the Security Standards and Implementation Specifications at 45 CFR Part 160 and Part 164, subpart C. 1.10 Standards for Electronic Transactions Rule. "Standards for Electronic Transactions Rule means the final regulations issued by HHS concerning standard transactions and code sets under the Administration Simplification provisions of HIPAA, 45 CFR Part 160 and Part 162. 1.11 Electronic Protected Health Inforrnation. "Electronic Protected Health Information" shall have the same meaning as the term "electronic protected health information" in 45 CFR 160.103. 1.12 Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in the Privacy Rule. Mailing Address: Web Access: Corporate Office: P.O. Box 53250 www.flex-plan.com 11400 SE 6th Street, Suite 125 Bellevue, WA 98015-3250 flexplan@flex-plan.com Bellevue, WA 98004 425.4523500 800.669.FLEX Fax 425.451.7002 II. Obligations and Activities of Flex-Plan 2.1 Flex-Plan agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By Law. 2.2 Flex-Plan agrees to use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement. Flex-Plan will implement administrative, physical, and technical safeguards (including written policies and procedures) that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic PHI that it creates, receives, maintains, or transmits on behalf of Covered Entity as required by the Security Rule. 2.3 Flex-Plan agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement and/or any Security Incident of which it becomes aware. 2.4 Flex-Plan agrees to obtain reasonable assurances that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Flex-Plan on behalf of, Covered Entity agrees to be bound by the same restrictions and conditions that apply through this Agreement to Flex-Plan, with respect to such information. Moreover, Flex-Plan shall ensure that any such agent or subcontractor agrees to implement reasonable and appropriate safeguards to protect Covered Entity's PHI. 2.5 Flex-Plan agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information relating to the use and disclosure of Protected Health Information received from, or created or received by Flex-Plan on behalf of, the Covered Entity available to the Secretary, within ten (10) business days after receipt of written request or otherwise as designated by the Secretary for purposes of the Secretary determining Covered Entity's compliance with the Privacy Rule. 2.6 Flex-Plan agrees to document disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528. 2.7 Flex-Plan agrees to provide to Covered Entity or to an Individual, within ten (10) business days after receipt of written request, information collected in accordance with Section 2.6 of this Agreement, in order to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528. 2.8 Flex-Plan agrees to provide access, at the request of Covered Entity and within ten (10) business days after receipt of written request, to Protected Health Information in a Designated Record Set, to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR 164.524. 2.9 Flex-Plan agrees to make any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526 at the request of Covered Entity or an Individual within ten (10) business days after receipt of written request. 2.10 In the event that Flex-Plan transmits or receives any Covered Electronic Transaction on behalf of the Covered Entity, it shall comply with all applicable provisions of the Standards for Electronic Transactions Rule to the extent required by law, and shall ensure that any agents that assist Flex-Plan in conducting Covered Electronic Transactions on behalf of the Covered Entity agree in writing to comply with the Standards for Electronic Transactions Rule to the extent required by law. 2 III. Permitted Uses and Disciosures by Business Associate 3.1 Except as otherwise limited in this Agreement, Flex-Plan may use or disclose Protected Health Information to pertorm functions, activities, or services for, or on behalf of, Covered Entity as specified in The Administrative Services Agreement between Flex-Plan and Covered Entity. 3.2 Except as otherwise limited in this agreement, Flex-Plan may disclose Protected Health Information for the proper management and administration of Flex-Plan, provided that such disclosures are required by law, or Flex-Plan obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and be used or further disclosed only as Required by Law or for the purpose for which it was disclosed to the person, and the person notifies Flex-Plan of any instance of which it is aware in which the confidentially of the information has been breached. 3.3 Except as otherwise limited in this agreement, Flex-Plan may use Protected Health Information to provide Data Aggregation services to Covered Entity as permitted by 45 CFR 164.504(e)(2)(i)(B). 3.4 Except as otherwise limited in this Agreement, Flex-Plan may use Protected Health Information for the proper management and administration of Flex-Plan or to carry out the legal responsibilities of Flex-Plan. 3.5 Flex-Plan may use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent with 164.5020)(1). IV. Obligations of Covered Entity 4.1 Covered Entity shall notify Flex-Plan of any limitation(s) in its notice of privacy practices of Covered Entity in accordance with 45 CFR 164.520, to the extent that such limitation may affect Flex-Plan's use or disclosure of Protected Health Information. 4.2 Covered Entity shall notify Flex-Plan of any changes in, or revocation of, permission by Individual to use or disclose Protected Health Information, to the extent that such changes may affect Flex-Plan's use or disclosure of Protected Health Information. 4.3 Covered Entity shall notify Flex-Plan of any restriction to the use or disclosure of Protected Health Information that Covered Entity has agreed to in accordance with 45 CFR 164.522, to the extent that such restriction may affect Flex-Plan's use or disclosure of Protected Health Information. V. Permissible Requests by Covered Entity 5.1 Covered Entity shall not request Flex-Plan to use or disclose Protected Health Information in any manner that would not be permissible under the Privacy Rule if done by Covered Entity, except for uses or disclosures for the purposes of data aggregation, management, and administrative activities of Flex-Plan. VI. Term and Termination 6.1 Term. This Agreement shall be effective as of the date that it is entered into, and shall terminate when all of the Protected Health Information provided by Covered Entity to Flex- Plan, or created or received by Flex-Plan on behalf of Covered Entity, is destroyed or returned to Covered Entity, or if it is infeasible to return or destroy Protected Health Information, protections are extended to such information, in accordance with the termination provisions in this Section. 6.2 Termination for Cause. Upon Covered Entity's knowledge of a material breach of the terms hereof by Flex-Plan, Covered Entity shall provide written notice to Flex-Plan of the breach, and Flex-Plan shall have the opportunity to cure that breach within the time period reasonably required to cure that breach. In the event that Flex-Plan does not cure the breach or end the violation within that time period, then Covered Entity shall be entitled to provide notice of termination of the terms hereof. 6.3 Effect of Termination. 6.3.1 It is agreed that due to the manner in which Protected Health Information is retained and the retention requirements of the Internal Revenue Service, returning or destroying all of the Protected Health Information received from Covered Entity or created or received by Flex-Plan on behalf of Covered Entity, is infeasible. Therefore, Flex-Plan shall extend the protections of this Agreement to such Protected Health Information, and shall limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as Flex-Plan maintains such Protected Health Information. VII. Miscellaneous 7.1 Regulatory References. A reference in this Agreement to a section in the Privacy Rule means the section as in effect or as amended. 7.2 Amendment. The Parties agree to take such action as is necessary to amend this Agreement from time to time as may be necessary for Covered Entity to comply with the requirements of the Privacy Rule and the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191. 7.3 Survival. The respective rights and obligations of Flex-Plan under Section 6.3.1 of this Agreement shall survive the termination of the term of this Agreement. 7.4 Nothing expressed or implied in this Agreement is intended to confer, nor shall anything herein confer, upon any person other than the Parties and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever. 7.5 Goveming Law. This Agreement shall be governed by and construed in accordance with the laws of the State of Washington to the extent not preempted by the Privacy and Security Rules or other applicable federal law. IN WITNESS WHEREOF, the Parties hereto have executed this Agreement effective as of the date first stated above. Flex-Plan Services, Inc. ►~~....~,~~~~,,It,. By: a Tina Shozen Title: Privacy Officer Date: 12/28/2008 4 Covered Entity: