HomeMy WebLinkAboutFlex-Plan Services Inc - Business Associate AgreementA f (
?emll~ KNOWLEDGEABLE I VA"T"IV FLEX-PLAN
SERVICES INCORPORATED
BUSINESS ASSOCIATE AGREEMENT
This Business Associate Agreement (the "Agreement") is entered into between Flex-Plan Services,
Inc. and City of Auburn effective as of January 1, 2009.
Recitals
WHEREAS, the parties hereto (the "Parties") have entered into an arrangement (the "Administrative
Services Agreement") whereby Flex-Plan Services, Inc. provides services to City of Auburn, and Flex-Plan
Services, Inc. receives, has access to, or creates, Protected Health Information in order to provide those
services;
WHEREAS City of Auburn is a"Covered Entity" and subject to the Administrative Simplification
requirements of the Health Insurance Portability and Accountability Act of 1996, and regulations promulgated
thereunder, including the Privacy Rule;
WHEREAS, the Privacy Rule requires City of Auburn to enter into a contract with Flex-Plan Services,
Inc.;
NOW, THEREFORE, in consideration of the foregoing, and for other good and valuable consideration,
the receipt and adequacy of which is hereby acknowledged, the Parties agree as follows:
1. Definitions
1.1 Business Associate. "Business Associate° shall mean Flex-Plan Services, Inc. ("Flex-Plan").
1.2 Covered Entity. "Covered Entity" shall mean City of Auburn.
1.3 Individual. "Individual" shall have the same meaning as the term "individual" in 45 CFR
164.103 and shall include a person who qualifies as a personal representative in accordance
with 45 CFR 164.502(g).
1.4 Privacy Rule. "Privacy Rule° shall mean the Standards for Privacy of Individually Identifiable
Health Information at 45 CFR part 160 and part 164, subparts A and E.
1.5 Protected Health Information. "Protected Health Information" shall have the same meaning as
the term "protected health information" in 45 CFR 160.103, limited to the information created
or received by Business Associate from or on behalf of Covered Entity.
1.6 Required By Law. "Required By Law" shall have the same meaning as the term "required by
law" in 45 CFR 164.103.
1.7 Secretary. "Secretary" shall mean the U.S. Secretary of the Department of Health and Human
Services or his designee.
1.8 Security Incident. "Security IncidenY" shall have the same meaning as the term "security
incidenY" in 45 CFR 164.304.
1.9 Security Rule. "Security Rule" shall mean the Security Standards and Implementation
Specifications at 45 CFR Part 160 and Part 164, subpart C.
1.10 Standards for Electronic Transactions Rule. "Standards for Electronic Transactions Rule
means the final regulations issued by HHS concerning standard transactions and code sets
under the Administration Simplification provisions of HIPAA, 45 CFR Part 160 and Part 162.
1.11 Electronic Protected Health Inforrnation. "Electronic Protected Health Information" shall have
the same meaning as the term "electronic protected health information" in 45 CFR 160.103.
1.12 Terms used, but not otherwise defined, in this Agreement shall have the same meaning as
those terms in the Privacy Rule.
Mailing Address: Web Access: Corporate Office:
P.O. Box 53250 www.flex-plan.com 11400 SE 6th Street, Suite 125
Bellevue, WA 98015-3250 flexplan@flex-plan.com Bellevue, WA 98004
425.4523500 800.669.FLEX Fax 425.451.7002
II. Obligations and Activities of Flex-Plan
2.1 Flex-Plan agrees to not use or disclose Protected Health Information other than as permitted
or required by this Agreement or as Required By Law.
2.2 Flex-Plan agrees to use appropriate safeguards to prevent use or disclosure of the Protected
Health Information other than as provided for by this Agreement. Flex-Plan will implement
administrative, physical, and technical safeguards (including written policies and procedures)
that reasonably and appropriately protect the confidentiality, integrity, and availability of
electronic PHI that it creates, receives, maintains, or transmits on behalf of Covered Entity as
required by the Security Rule.
2.3 Flex-Plan agrees to report to Covered Entity any use or disclosure of the Protected Health
Information not provided for by this Agreement and/or any Security Incident of which it
becomes aware.
2.4 Flex-Plan agrees to obtain reasonable assurances that any agent, including a subcontractor,
to whom it provides Protected Health Information received from, or created or received by
Flex-Plan on behalf of, Covered Entity agrees to be bound by the same restrictions and
conditions that apply through this Agreement to Flex-Plan, with respect to such information.
Moreover, Flex-Plan shall ensure that any such agent or subcontractor agrees to implement
reasonable and appropriate safeguards to protect Covered Entity's PHI.
2.5 Flex-Plan agrees to make internal practices, books, and records, including policies and
procedures and Protected Health Information relating to the use and disclosure of Protected
Health Information received from, or created or received by Flex-Plan on behalf of, the
Covered Entity available to the Secretary, within ten (10) business days after receipt of written
request or otherwise as designated by the Secretary for purposes of the Secretary
determining Covered Entity's compliance with the Privacy Rule.
2.6 Flex-Plan agrees to document disclosures of Protected Health Information and information
related to such disclosures as would be required for Covered Entity to respond to a request by
an Individual for an accounting of disclosures of Protected Health Information in accordance
with 45 CFR 164.528.
2.7 Flex-Plan agrees to provide to Covered Entity or to an Individual, within ten (10) business
days after receipt of written request, information collected in accordance with Section 2.6 of
this Agreement, in order to permit Covered Entity to respond to a request by an Individual for
an accounting of disclosures of Protected Health Information in accordance with 45 CFR
164.528.
2.8 Flex-Plan agrees to provide access, at the request of Covered Entity and within ten (10)
business days after receipt of written request, to Protected Health Information in a Designated
Record Set, to Covered Entity or, as directed by Covered Entity, to an Individual in order to
meet the requirements under 45 CFR 164.524.
2.9 Flex-Plan agrees to make any amendment(s) to Protected Health Information in a Designated
Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526 at the
request of Covered Entity or an Individual within ten (10) business days after receipt of written
request.
2.10 In the event that Flex-Plan transmits or receives any Covered Electronic Transaction on
behalf of the Covered Entity, it shall comply with all applicable provisions of the Standards for
Electronic Transactions Rule to the extent required by law, and shall ensure that any agents
that assist Flex-Plan in conducting Covered Electronic Transactions on behalf of the Covered
Entity agree in writing to comply with the Standards for Electronic Transactions Rule to the
extent required by law.
2
III. Permitted Uses and Disciosures by Business Associate
3.1 Except as otherwise limited in this Agreement, Flex-Plan may use or disclose Protected
Health Information to pertorm functions, activities, or services for, or on behalf of, Covered
Entity as specified in The Administrative Services Agreement between Flex-Plan and Covered
Entity.
3.2 Except as otherwise limited in this agreement, Flex-Plan may disclose Protected Health
Information for the proper management and administration of Flex-Plan, provided that such
disclosures are required by law, or Flex-Plan obtains reasonable assurances from the person
to whom the information is disclosed that it will remain confidential and be used or further
disclosed only as Required by Law or for the purpose for which it was disclosed to the person,
and the person notifies Flex-Plan of any instance of which it is aware in which the
confidentially of the information has been breached.
3.3 Except as otherwise limited in this agreement, Flex-Plan may use Protected Health
Information to provide Data Aggregation services to Covered Entity as permitted by 45 CFR
164.504(e)(2)(i)(B).
3.4 Except as otherwise limited in this Agreement, Flex-Plan may use Protected Health
Information for the proper management and administration of Flex-Plan or to carry out the
legal responsibilities of Flex-Plan.
3.5 Flex-Plan may use Protected Health Information to report violations of law to appropriate
Federal and State authorities, consistent with 164.5020)(1).
IV. Obligations of Covered Entity
4.1 Covered Entity shall notify Flex-Plan of any limitation(s) in its notice of privacy practices of
Covered Entity in accordance with 45 CFR 164.520, to the extent that such limitation may
affect Flex-Plan's use or disclosure of Protected Health Information.
4.2 Covered Entity shall notify Flex-Plan of any changes in, or revocation of, permission by
Individual to use or disclose Protected Health Information, to the extent that such changes
may affect Flex-Plan's use or disclosure of Protected Health Information.
4.3 Covered Entity shall notify Flex-Plan of any restriction to the use or disclosure of Protected
Health Information that Covered Entity has agreed to in accordance with 45 CFR 164.522, to
the extent that such restriction may affect Flex-Plan's use or disclosure of Protected Health
Information.
V. Permissible Requests by Covered Entity
5.1 Covered Entity shall not request Flex-Plan to use or disclose Protected Health Information in
any manner that would not be permissible under the Privacy Rule if done by Covered Entity,
except for uses or disclosures for the purposes of data aggregation, management, and
administrative activities of Flex-Plan.
VI. Term and Termination
6.1 Term. This Agreement shall be effective as of the date that it is entered into, and shall
terminate when all of the Protected Health Information provided by Covered Entity to Flex-
Plan, or created or received by Flex-Plan on behalf of Covered Entity, is destroyed or returned
to Covered Entity, or if it is infeasible to return or destroy Protected Health Information,
protections are extended to such information, in accordance with the termination provisions in
this Section.
6.2 Termination for Cause. Upon Covered Entity's knowledge of a material breach of the terms
hereof by Flex-Plan, Covered Entity shall provide written notice to Flex-Plan of the breach,
and Flex-Plan shall have the opportunity to cure that breach within the time period reasonably
required to cure that breach. In the event that Flex-Plan does not cure the breach or end the
violation within that time period, then Covered Entity shall be entitled to provide notice of
termination of the terms hereof.
6.3 Effect of Termination.
6.3.1 It is agreed that due to the manner in which Protected Health Information is retained
and the retention requirements of the Internal Revenue Service, returning or
destroying all of the Protected Health Information received from Covered Entity or
created or received by Flex-Plan on behalf of Covered Entity, is infeasible.
Therefore, Flex-Plan shall extend the protections of this Agreement to such Protected
Health Information, and shall limit further uses and disclosures of such Protected
Health Information to those purposes that make the return or destruction infeasible,
for so long as Flex-Plan maintains such Protected Health Information.
VII. Miscellaneous
7.1 Regulatory References. A reference in this Agreement to a section in the Privacy Rule means
the section as in effect or as amended.
7.2 Amendment. The Parties agree to take such action as is necessary to amend this Agreement
from time to time as may be necessary for Covered Entity to comply with the requirements of
the Privacy Rule and the Health Insurance Portability and Accountability Act of 1996, Pub. L.
No. 104-191.
7.3 Survival. The respective rights and obligations of Flex-Plan under Section 6.3.1 of this
Agreement shall survive the termination of the term of this Agreement.
7.4 Nothing expressed or implied in this Agreement is intended to confer, nor shall anything
herein confer, upon any person other than the Parties and their respective successors or
assigns, any rights, remedies, obligations or liabilities whatsoever.
7.5 Goveming Law. This Agreement shall be governed by and construed in accordance with the
laws of the State of Washington to the extent not preempted by the Privacy and Security
Rules or other applicable federal law.
IN WITNESS WHEREOF, the Parties hereto have executed this Agreement effective as of the date
first stated above.
Flex-Plan Services, Inc.
►~~....~,~~~~,,It,.
By: a Tina Shozen
Title: Privacy Officer
Date: 12/28/2008
4
Covered Entity: