The URL can be used to link to this page

Browse Search

Home My WebLink About20130872.tiffRESOLUTION RE: APPROVE CHRONIC DISEASE SELF -MANAGEMENT EDUCATION (CDSME) LICENSE HOLDER AGREEMENT AND HIPAA BUSINESS ASSOCIATE ADDENDUM AND AUTHORIZE CHAIR TO SIGN — CENTRAL COLORADO AREA HEALTH EDUCATION CENTER (CC AHEC) WHEREAS, the Board of County Commissioners of Weld County, Colorado, pursuant to Colorado statute and the Weld County Home Rule Charter, is vested with the authority of administering the affairs of Weld County, Colorado, and WHEREAS, the Board has been presented with a Chronic Disease Self -Management Education (CDSME) License Holder Agreement and HIPAA Business Associate Addendum between the County of Weld, State of Colorado, by and through the Board of County Commissioners of Weld County, on behalf of the Department of Human Services' Area Agency on Aging, and Central Colorado Area Health Education Center (CC AHEC), for three years, commencing upon full execution and ending on August 31, 2013, with further terms and conditions being as stated in said agreement and addendum, and WHEREAS, after review, the Board deems it advisable to approve said agreement and addendum, copies of which are attached hereto and incorporated herein by reference. NOW, THEREFORE, BE IT RESOLVED by the Board of County Commissioners of Weld County, Colorado, that the License Holder Agreement and HIPAA Business Associate Addendum between the County of Weld, State of Colorado, by and through the Board of County Commissioners of Weld County, on behalf of the Department of Human Services, and Central Colorado Area Health Education Center (CC AHEC) be, and hereby are, approved. BE IT FURTHER RESOLVED by the Board that the Chair be, and hereby is, authorized to sign said agreement and addendum. I niq H©4k ils.b4h1 2013-0872 HR0084 CDSME LICENSE HOLDER AGREEMENT AND HIPAA BUSINESS ASSOCIATE ADDENDUM — CC AHEC PAGE 2 The above and foregoing Resolution was, on motion duly made and seconded, adopted by the following vote on the 8th day of April, A.D., 2013. BOARD OF COUNTY COMMISSIONERS WELD CiJ►j Y, COLORADO ATTEST: Weld County Clerk to the Board BY: APP Deputy CI o the Board my Attorney Date of signaturAPR e: 1 8 2013 William F. Ga''""air — Co .,ire tip ougla ademac -r, Pro-Tem Sean P. Conway Mike Freeman XCUSED Barbara Kirkmeyer 2013-0872 HR0084 MEMORANDUM DATE: April 4, 2013 TO: William F. Garcia, Chair, Board of County Commisners yltt FROM: Judy A. Griego, Director, Department ofma RE: CDSME (Chronic Disease Self -Management Education) License Holder Agreement and HIPAA Business Associate Addendum between the Weld County Department of Human Services' Area Agency on Aging and Central Colorado Area Health Education Center (CC AHEC) Enclosed for Board approval is a CDSME (Chronic Disease Self -Management Education) License Holder Agreement and HIPAA Business Associate Addendum between the Department's Area Agency on Aging and Central Colorado Area Health Education Center (CC AHEC). This Memorandum of Agreement was reviewed under the Board's Pass -Around Memorandum dated March 12, 2013, and approved for placement on the Board's Agenda. From September 2010 to March 2012, the Area Agency on Aging (AAA) partnered with Aging and Adult Services and its partner, the Central Colorado Area Health Education Center (CCAHEC) to provide Chronic Disease Management workshops under an ARRA grant. The attached Memorandum of Agreement will renew this partnership and enable the AAA to be reimbursed for workshops up to $3,200.00 during the first grant year. Reimbursement in the following grant years will be determined and agreed upon in future agreements. This Agreement is effective until August 31, 2013, for year one (1) and renewal by end of July 2013 and 2014 for year two (2) and year three (3) based on funding availability. As in the past, the AAA is not required to provide any type of match in order to participate. The grant dollars will be used to offset the cost of providing the workshops for free to eligible community members. If you have additional questions, please contact me at extension 6510. 2013-0872 Developing Community -Academic Partnerships to Promote Healthier Colorado Residents O@ Victbi- 0 CDSME License Holder Agreement This memorandum of agreement is entered into this 25th day of February, 2013 by Central Colorado Area Health Education Center (CC AHEC), a non-profit corporation incorporated in the state of Colorado with a principal business address of 10200 East Girard Avenue, Suite C252, Denver, Colorado 80231, and Weld County Area Agency on Aging (WCAAA) (970) 346-6950 Name of Agency telephone PO Box 1805/ 315 North 11th Avenue #C Greeley, CO 80632 Address City Zip Code Whereas, the CC AHEC is the Implementation agency for the Department of Human Services, Division of Aging and Adult Services, to implement Chronic Disease Self -Management Education (CDSME) series. Whereas, WCAAA desires to participate as a License Holder for this initiative; Thus, through our mutual premises and the mutual undertakings herein contained, the parties agree: To implement Stanford's CDSME series under a grant from the Department of Human Services, Division of Aging and Adult Services, to expand access to Stanford's CDSME series to older adults age 60 years and older, and adults with disabilities, age 18 years and older throughout Colorado. WCAAA has been selected to become a License Holder for this grant initiative. License Holder responsibilities include: a) Maintain ongoing communication with CC AHEC. b) When offering the series through your agency, operate under a license issued by Stanford to your agency. c) Be held accountable to follow the rules and regulations regarding instruction and administration of the CDSME series in accordance with the Stanford licensing requirements. d) Conduct series in accordance with the CDSME series Leaders Manual, without changes. e) Provision of suitable space for series (complying with Americans with Disabilities Act standards), healthy snacks and water for attendees. f) Actively recruit participants to attend the series. g) Be responsible to recruit and train lay leaders and master trainers to conduct the series for your agency. h) Submit a calendar of scheduled CDSME series to CC AHEC no later than 30 days prior to the start of the series. Information needed: license holder agency name, location of Central Colorado Area Health Education Center (AHEC) 10200 E. Girard Ave, C252 Denver, CO 80231 303-481-8686 303-481-8554 Fax Kriswenzel@CentralCOAHEC.org ' / )(1>22 Developing Community -Academic Partnerships to Promote Healthier Colorado Residents series, time series is being held, dates of series, and lay leaders who will be teaching series. i) Place calendar of scheduled CDSME series on the Self -Management Colorado website no later than 30 days prior to the start of the series. j) Ensure related current data forms (attached) are collected and submitted to CDPHE within 30 days following the completion of each CDSME series. k) Submit completed attendance log to CC AHEC following completion of each CDSME series. 1) Follow fidelity check guidelines as outlined in the Statewide CDSMP Fidelity Visit Policy (attached). As necessary, submit fidelity check documentation to CC AHEC. m) Request payment of $160.00 for each participant "completer" (attendance at 4 of 6 sessions) of the six week fidelity authenticated CDSME series. Invoice should be submitted directly to CC AHEC. CC AHEC will not pay invoice until all appropriate data is received by CDPHE and a completed attendance log and appropriate fidelity check documentation are received by CC AHEC. n) Submit documentation of how reimbursement funds were applied within your agency, within 30 days of receipt of funds. o) Participation in the Colorado CDSMP Collaborative. p) Have a total of 20 participant completers by August 31, 2013. q) Maintain privacy and confidentiality of all protected health information (PHI) according to attached contract addendum: "HIPAA Business Associate Addendum." Provide CC AHEC agency written plan to assure PHI is safeguarded per section 2 c and meeting of all obligations. This executed Addendum identifies the Department of Human Services (CE) as a third party beneficiary with rights of enforcement and indemnification in the event of any violation by parties of this agreement. The License Holder Agency, WCAAA, in performing the services as specified in this service agreement, shall act as an independent contractor. Any and all employees of WCAAA shall be considered to be, at all times, employees of WCAAA, under its sole authority. Further, WCAAA shall indemnify and hold CC AHEC harmless from any and all claims, liabilities, losses and causes of action which may arise from acts, errors or omissions of WCAAA or any of its employees or agents in conjunction with its obligations under this service agreement. Responsibilities of CCAHEC: a) Maintain communications with License Holders and offer technical assistance as needed. b) Provide $160.00 reimbursement for each participant "completer" (attendance at 4 of 6 sessions) of the six week fidelity authenticated Chronic Disease Self -Management Education programs series once all appropriate data is received by CDPHE and a completed attendance log and appropriate fidelity check documentation are received by CC AHEC. c) Track utilization of reimbursement funds and report this information to the Department of Human Services, Division of Aging and Adult Services. Central Colorado Area Health Education Center (AHEC) 10200 E. Girard Ave, C252 Denver, CO 80231 303-481-8686 303-481-8554 Fax Kriswenzel@CentralCOAHEC.org Developing Community -Academic Partnerships to Promote Healthier Colorado Residents The terms of this agreement will be effective as of the date of signing and shall be effective until August 31, 2013 for year 1 and renewal by end of July 2013 and 2014 for year 2 and year 3, based on funding availability. This agreement for services is contingent upon the receipt of adequate revenue by Grantee identified in Section 1. Acknowledgement of Service Agreement with License Holder Agency: WCAAA Signatures affixed below indicate agreement to the terms and conditions stated herein: IN WITNESS WHEREOF, the parties hereto have executed this Agreement on the day first written above. BOARD OF COUNTY COMMISSIONERS CENTRAL COLORADO AHEC William Garcifiair APR 0 8 2013 ATTEST:�q Weld Countya- .to t e Board"��" BY; Deputy Clerk to Central Colorado Area Health Education Center (AHEC) 10200 E. Girard Ave, C252 Denver, CO 80231 BY: Kristina It Wenzel, Executive Diribto WELD COUNTY DEPARTMENT OF HUMAN SERVICES WELD COUNTY AREA AGENCY ON AGING Eva M. Jewell, DHead 303-481-8686 303-481-8554 Fax Kriswenzel@CentralCOAHEC.org rx2Ci/5-l%S"Jo7 HIPAA BUSINESS ASSOCIATE ADDENDUM du Th's Business Associate Addendum ("Addendum") is a part of the Contract dated pZ s// 3 between the Department of Human Services and Central Colorado Area alth cation Center, contract number 13 IHA 52304. For purposes of this Addendum, the State is referred to as "Covered Entity" or "CE" and the Contractor is referred to as "Associate". Unless the context clearly requires a distinction between the Contract document and this Addendum, all references herein to "the Contract" or "this Contract" include this Addendum. RECITALS A. CE wishes to disclose certain information to Associate pursuant to the terms of the Contract, some of which may constitute Protected Health Information ("PHI") (defined below). B. CE and Associate intend to protect the privacy and provide for the security of PHI disclosed to Associate pursuant to this Contract in compliance with the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. § 1320d —1320d-8 ("HIPAA") as amended by the American Recovery and Reinvestment Act of 2009 ("ARRA")/HITECH Act (P.L. 111-005), and its implementing regulations promulgated by the U.S. Department of Health and Human Services, 45 C.F.R. Parts 160, 162 and 164 (the "Privacy Rule") and other applicable laws, as amended. C. As part of the HIPAA regulations, the Privacy Rule requires CE to enter into a contract containing specific requirements with Associate prior to the disclosure of PHI, as set forth in, but not limited to, Title 45, Sections 160.103, 164.502(e) and 164.504(e) of the Code of Federal Regulations ("C.F.R.") and contained in this Addendum. The parties agree as follows: 1. Definitions. a. Except as otherwise defined herein, capitalized terms in this Addendum shall have the definitions set forth in the HIPAA Privacy Rule at 45 C.F.R. Parts 160, 162 and 164, as amended. In the event of any conflict between the mandatory provisions of the Privacy Rule and the provisions of this Contract, the Privacy Rule shall control. Where the provisions of this Contract differ from those mandated by the Privacy Rule, but are nonetheless permitted by the Privacy Rule, the provisions of this Contract shall control. b. "Protected Health Information" or "PHI" means any information, whether oral or recorded in any form or medium: (i) that relates to the past, present or future physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and (ii) that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual, and shall have the meaning given to such term under the Privacy Rule, including, but not limited to, 45 C.F.R. Section 164.501. Page 1 of 10 Colorado Model BA Provision and Addendum For New or Amended Contracts Rev. 07/10 c. "Protected Information" shall mean PHI provided by CE to Associate or created or received by Associate on CE's behalf. To the extent Associate is a covered entity under HIPAA and creates or obtains its own PHI for treatment, payment and health care operations, Protected Information under this Contract does not include any PHI created or obtained by Associate as a covered entity and Associate shall follow its own policies and procedures for accounting, access and amendment of Associate's PHI. 2. Obligations of Associate. a. Permitted Uses. Associate shall not use Protected Information except for the purpose of performing Associate's obligations under this Contract and as permitted under this Addendum. Further, Associate shall not use Protected Information in any manner that would constitute a violation of the Privacy Rule if so used by CE, except that Associate may use Protected Information: (i) for the proper management and administration of Associate; (ii) to carry out the legal responsibilities of Associate; or (iii) for Data Aggregation purposes for the Health Care Operations of CE. Additional provisions, if any, governing permitted uses of Protected Information are set forth in Attachment A to this Addendum. Associate accepts frill responsibility for any penalties incurred as a result of Associate's breach of the Privacy Rule. b. Permitted Disclosures. Associate shall not disclose Protected Information in any manner that would constitute a violation of the Privacy Rule if disclosed by CE, except that Associate may disclose Protected Information: (i) in a manner permitted pursuant to this Contract; (ii) for the proper management and administration of Associate; (iii) as required by law; (iv) for Data Aggregation purposes for the Health Care Operations of CE; or (v) to report violations of law to appropriate federal or state authorities, consistent with 45 C.F.R. Section 164.502(j)(1). To the extent that Associate discloses Protected Information to a third party, Associate must obtain, prior to making any such disclosure: (i) reasonable assurances from such third party that such Protected Information will be held confidential as provided pursuant to this Addendum and only disclosed as required by law or for the purposes for which it was disclosed to such third party; and (ii) an agreement from such third party to notify Associate within two business days of any breaches of confidentiality of the Protected Information, to the extent it has obtained knowledge of such breach. Additional provisions, if any, governing permitted disclosures of Protected Information are set forth in Attachment A. c. Appropriate Safeguards. Associate shall implement appropriate safeguards as are necessary to prevent the use or disclosure of Protected Information other than as permitted by this Contract. Associate shall comply with the requirements of the Security Rules, 164.308, 164.310, 164.312, and 164.316. Associate shall maintain a comprehensive written information privacy and security program that includes administrative, technical and physical safeguards appropriate to the size and complexity of the Associate's operations and the nature and scope of its activities. d. Reporting of Improper Use or Disclosure. Associate shall report to CE in writing any use or disclosure of Protected Information other than as provided for by this Contract within five (5) business days of becoming aware of such use or disclosure. Page 2 of 10 Colorado Model BA Provision and Addendum For New or Amended Contracts Rev. 07/10 e. Associate's Agents. If Associate uses one or more subcontractors or agents to provide services under the Contract, and such subcontractors or agents receive or have access to Protected Information, each subcontractor or agent shall sign an agreement with Associate containing substantially the same provisions as this Addendum and further identifying CE as a third party beneficiary with rights of enforcement and indemnification from such subcontractors or agents in the event of any violation of such subcontractor or agent agreement. Associate shall implement and maintain sanctions against agents and subcontractors that violate such restrictions and conditions and shall mitigate the effects of any such violation. f. Access to Protected Information. Associate shall make Protected Information maintained by Associate or its agents or subcontractors in Designated Record Sets available to CE for inspection and copying within ten (10) business days of a request by CE to enable CE to fulfill its obligations to permit individual access to PHI under the Privacy Rule, including, but not limited to, 45 C.F.R. Section 164.524. g. Amendment of PHI. Within ten business (10) days of receipt of a request from CE for an amendment of Protected Information or a record about an individual contained in a Designated Record Set, Associate or its agents or subcontractors shall make such Protected Information available to CE for amendment and incorporate any such amendment to enable CE to fulfill its obligations with respect to requests by individuals to amend their PHI under the Privacy Rule, including, but not limited to, 45 C.F.R. Section 164.526. If any individual requests an amendment of Protected Information directly from Associate or its agents or subcontractors, Associate must notify CE in writing within five (5) business days of receipt of the request. Any denial of amendment of Protected Information maintained by Associate or its agents or subcontractors shall be the responsibility of CE. h. Accounting Rights. Within ten (10) business days of notice by CE of a request for an accounting of disclosures of Protected Information, Associate and its agents or subcontractors shall make available to CE the information required to provide an accounting of disclosures to enable CE to fulfill its obligations under the Privacy Rule, including, but not limited to, 45 C.F.R. Section 164.528. As set forth in, and as limited by, 45 C.F.R. Section 164.528, Associate shall not provide an accounting to CE of disclosures: (i) to carry out treatment, payment or health care operations, as set forth in 45 C.F.R. Section 164.506; (ii) to individuals of Protected Information about them as set forth in 45 C.F.R. Section 164.502; (iii) pursuant to an authorization as provided in 45 C.F.R. Section 164.508; (iv) to persons involved in the individual's care or other notification purposes as set forth in 45 C.F.R. Section 164.510; (v) for national security or intelligence purposes as set forth in 45 C.F.R. Section 164.512(k)(2); (vi) to correctional institutions or law enforcement officials as set forth in 45 C.F.R. Section 164.512(k)(5); (vii) incident to a use or disclosure otherwise permitted by the Privacy Rule; (viii) as part of a limited data set under 45 C.P.R. Section 164.514(e); or (ix) disclosures prior to April 14, 2003. Associate agrees to implement a process that allows for an accounting to be collected and maintained by Associate and its agents or subcontractors for at least six (6) years prior to the request, but not before the compliance date of the Privacy Rule. At a minimum, such information shall include: (i) the date of disclosure; (ii) the name of the entity or person who received Protected Information and, if known, the address of the entity or person; (iii) a brief description of Protected Information disclosed; and (iv) a brief statement of purpose of the disclosure that reasonably informs the individual of the basis for the disclosure, or a copy of the individual's authorization, or a copy of the written request for disclosure. In the event that the Page 3 of 10 Colorado Model BA Provision and Addendum For New or Amended Contracts Rev_ 07/10 request for an accounting is delivered directly to Associate or its agents or subcontractors, Associate shall within five (5) business days of the receipt of the request forward it to CE in writing. It shall be CE's responsibility to prepare and deliver any such accounting requested. Associate shall not disclose any Protected Information except as set forth in Section 2(b) of this Addendum. i, Governmental Access to Records. Associate shall make its internal practices, books and records relating to the use and disclosure of Protected Information available to the Secretary of the U.S. Department of Health and Human Services (the "Secretary"), in a time and manner designated by the Secretary, for purposes of determining CE's compliance with the Privacy Rule. Associate shall provide to CE a copy of any Protected Information that Associate provides to the Secretary concurrently with providing such Protected Information to the Secretary. j. Minimum Necessary. Associate (and its agents or subcontractors) shall only request, use and disclose the minimum amount of Protected Information necessary to accomplish the purpose of the request, use or disclosure, in accordance with the Minimum Necessary requirements of the Privacy Rule including, but not limited to 45 C.F.R. Sections 164.502(b) and 164.514(d). k. Data Ownership. Associate acknowledges that Associate has no ownership rights with respect to the Protected Information. 1. Retention of Protected Information. Except upon termination of the Contract as provided in Section 4(d) of this Addendum, Associate and its subcontractors or agents shall retain all Protected Information throughout the term of this Contract and shall continue to maintain the information required under Section 2(h) of this Addendum for a period of six (6) years. m. Associate's Insurance. Associate shall maintain casualty and liability insurance to cover loss of PHI data and claims based upon alleged violations of privacy rights through improper use or disclosure of PHI. All such policies shall meet or exceed the minimum insurance requirements of the Contract (e.g., occurrence basis, combined single dollar limits, annual aggregate dollar limits, additional insured status and notice of cancellation). n. Notification of Breach. During the term of this Contract, Associate shall notify CE within two business days of any suspected or actual breach of security, intrusion or unauthorized use or disclosure of PHI and/or any actual or suspected use or disclosure of data in violation of any applicable federal or state laws or regulations Such notice shall include the identification of each individual whose unsecured PHI has been, or is reasonably believed to have been accessed, acquired or disclosed during the breach.. Associate shall take (i) prompt corrective action to cure any such deficiencies and (ii) any action pertaining to such unauthorized disclosure required by applicable federal and state laws and regulations. Page 4 of 10 Colorado Model BA Provision and Addendum For New or Amended Contracts Rev. 07/10 o. Audits, Inspection and Enforcement. Within ten (10) business days of a written request by CE, Associate and its agents or subcontractors shall allow CE to conduct a reasonable inspection of the facilities, systems, books, records, agreements, policies and procedures relating to the use or disclosure of Protected Information pursuant to this Addendum for the purpose of determining whether Associate has complied with this Addendum; provided, however, that: (i) Associate and CE shall mutually agree in advance upon the scope, timing and location of such an inspection; (ii) CE shall protect the confidentiality of all confidential and proprietary information of Associate to which CE has access during the course of such inspection; and (iii) CE shall execute a nondisclosure agreement, upon terms mutually agreed upon by the parties, if requested by Associate. The fact that CE inspects, or fails to inspect, or has the right to inspect, Associate's facilities, systems, books, records, agreements, policies and procedures does not relieve Associate of its responsibility to comply with this Addendum, nor does CE's (i) failure to detect or (ii) detection, but failure to notify Associate or require Associate's remediation of any unsatisfactory practices, constitute acceptance of such practice or a waiver of CE's enforcement rights under the Contract. p. Safeguards During Transmission. Associate shall be responsible for using appropriate safeguards to maintain and ensure the confidentiality, privacy and security of Protected Information transmitted to CE pursuant to the Contract, in accordance with the standards and requirements of the Privacy Rule, until such Protected Information is received by CE, and in accordance with any specifications set forth in Attachment A. q. Restrictions and Confidential Communications. Within ten (10) business days of notice by CE of a restriction upon uses or disclosures or request for confidential communications pursuant to 45 C.F.R. 164.522, Associate will restrict the use or disclosure of an individual's Protected Information, provided Associate has agreed to such a restriction. Associate will not respond directly to an individual's requests to restrict the use or disclosure of Protected Information or to send all communication of Protect Information to an alternate address. Associate will refer such requests to the CE so that the CE can coordinate and prepare a timely response to the requesting individual and provide direction to Associate. 3. Obligations of CE. a. Safeguards During Transmission. CE shall be responsible for using appropriate safeguards to maintain and ensure the confidentiality, privacy and security of PHI transmitted to Associate pursuant to this Contract, in accordance with the standards and requirements of the Privacy Rule, until such PHI is received by Associate, and in accordance with any specifications set forth in Attachment A. b. Notice of Changes. CE shall provide Associate with a copy of its notice of privacy practices produced in accordance with 45 C.F.R. Section 164.520, as well as any subsequent changes or limitation(s) to such notice, to the extent such changes or limitations may effect Associate's use or disclosure of Protected Information. CE shall provide Associate with any changes in, or revocation of, permission to use or disclose Protected Information, to the extent it may affect Associate's permitted or required uses or disclosures. To the extent that it may affect Associate's permitted use or disclosure of PHI, CE shall notify Associate of any restriction on the use or disclosure of Protected Information that CE has agreed to in accordance with 45 C.F.R. Section 164.522. CE may effectuate any and all such notices of non -private information via posting on CE's web site. Associate shall review CE's designated web site for notice of changes to CE's HIPAA privacy policies and practices on the last day of each calendar quarter. Page 5 of 10 Colorado Model BA Provision and Addendum For New or Amended Contracts Termination. a. Material Breach. In addition to any other provisions in the Contract regarding breach, a breach by Associate of any provision of this Addendum, as determined by CE, shall constitute a material breach of this Contract and shall provide grounds for immediate termination of this Contract by CE pursuant to the provisions of the Contract covering termination for cause, if any. If the Contract contains no express provisions regarding termination for cause, the following terms and conditions shall apply: (1) Default. If Associate refuses or fails to timely perform any of the provisions of this Contract, CE may notify Associate in writing of the non-performance, and if not promptly corrected within the time specified, CE may terminate this Contract. Associate shall continue performance of this Contract to the extent it is not terminated and shall be liable for excess costs incurred in procuring similar goods or services elsewhere. (2) Associate's Duties. Notwithstanding termination of this Contract, and subject to any directions from CE, Associate shall take timely, reasonable and necessary action to protect and preserve property in the possession of Associate in which CE has an interest. (3) Compensation. Payment for completed supplies delivered and accepted by CE shall be at the Contract price. In the event of a material breach under paragraph 4a, CE may withhold amounts due Associate as CE deems necessary to protect CE against loss from third party claims of improper use or disclosure and to reimburse CE for the excess costs incurred in procuring similar goods and services elsewhere. (4) Erroneous Termination for Default. If after such termination it is determined, for any reason, that Associate was not in default, or that Associate's action/inaction was excusable, such termination shall be treated as a termination for convenience, and the rights and obligations of the parties shall be the same as if this Contract had been terminated for convenience, as described in this Contract. b. Reasonable Steps to Cure Breach. If CE knows of a pattern of activity or practice of Associate that constitutes a material breach or violation of the Associate's obligations under the provisions of this Addendum or another arrangement and does not terminate this Contract pursuant to Section 4(a), then CE shall take reasonable steps to cure such breach or end such violation, as applicable. If CE's efforts to cure such breach or end such violation are unsuccessful, CE shall either (i) terminate the Contract, if feasible or (ii) if termination of this Contract is not feasible, CE shall report Associate's breach or violation to the Secretary of the Department of Health and Human Services. c. Judicial or Administrative Proceedings. Either party may terminate the Contract, effective immediately, if (i) the other party is named as a defendant in a criminal proceeding for a violation of HIPAA, the HIPAA Regulations or other security or privacy laws or (ii) a finding or stipulation that the other party has violated any standard or requirement of HIPAA, the HIPAA Regulations or other security or privacy laws is made in any administrative or civil proceeding in which the party has been joined. Page 6 of l0 Colorado Model BA Provision and Addendum For New or Amended Contracts Rev. 07/10 d. Effect of Termination. (1) Except as provided in paragraph (2) of this subsection, upon termination of this Contract, for any reason, Associate shall return or destroy all Protected Information that Associate or its agents or subcontractors still maintain in any form, and shall retain no copies of such Protected Information, If Associate elects to destroy the PHI, Associate shall certify in writing to CE that such PHI has been destroyed. (2) If Associate believes that returning or destroying the Protected Information is not feasible, Associate shall promptly provide CE notice of the conditions making return or destruction infeasible. Upon mutual agreement of CE and Associate that return or destruction of Protected Information is infeasible, Associate shall continue to extend the protections of Sections 2(a), 2(b), 2(c), 2(d) and 2(e) of this Addendum to such information, and shall limit further use of such PHI to those purposes that make the return or destruction of such PHI infeasible. 5. Injunctive Relief CE shall have the right to injunctive and other equitable and legal relief against Associate or any of its subcontractors or agents in the event of any use or disclosure of Protected Information in violation of this Contract or applicable law. 6. No Waiver of Immunity. No term or condition of this Contract shall be construed or interpreted as a waiver, express or implied, of any of the immunities, rights, benefits, protection, or other provisions of the Colorado Governmental Immunity Act, CRS 24-10-101 et seq. or the Federal Tort Claims Act, 28 U.S.C. 2671 et seq. as applicable, as now in effect or hereafter amended. 7. Limitation of Liability. Any limitation of Associate's liability in the Contract shall be inapplicable to the terms and conditions of this Addendum. 8. Disclaimer. CE makes no warranty or representation that compliance by Associate with this Contract, IIIPAA or the HIPAA Regulations will be adequate or satisfactory for Associate's own purposes. Associate is solely responsible for all decisions made by Associate regarding the safeguarding of PIII. 9. Certification. To the extent that CE determines an examination is necessary in order to comply with CE's legal obligations pursuant to IIIPAA relating to certification of its security practices, CE or its authorized agents or contractors, may, at CE's expense, examine Associate's facilities, systems, procedures and records as may be necessary for such agents or contractors to certify to CE the extent to which Associate's security safeguards comply with HIPAA, the HIPAA Regulations or this Addendum. Page 7 of 10 Colorado Model BA Provision and Addendum For New or Amended Contracts Rev. 07/10 10. Amendment. a. Amendment to Comply with Law. The parties acknowledge that state and federal laws relating to data security and privacy are rapidly evolving and that amendment of this Addendum may be required to provide for procedures to ensure compliance with such developments. The parties specifically agree to take such action as is necessary to implement the standards and requirements of HIPAA, the Privacy Rule, and the Final HIPAA Security regulations at 68 Fed. Reg. 8334 (Feb20, 2003), 45 C.F.R. § 164.314 and other applicable laws relating to the security or privacy of PHI. The parties understand and agree that CE must receive satisfactory written assurance from Associate that Associate will adequately safeguard all Protected Information. Upon the request of either party, the other party agrees to promptly enter into negotiations concerning the terms of an amendment to this Addendum embodying written assurances consistent with the standards and requirements of HIPAA, the Privacy Rule or other applicable laws. CE may terminate this Contract upon thirty (30) days written notice in the event (i) Associate does not promptly enter into negotiations to amend this Contract when requested by CE pursuant to this Section or (ii) Associate does not enter into an amendment to this Contract providing assurances regarding the safeguarding of PI41 that CE, in its sole discretion, deems sufficient to satisfy the standards and requirements of HIPAA and the Privacy Rule. b. Amendment of Attachment A. Attachment A may be modified or amended by mutual agreement of the parties in writing from time to time without formal amendment of this Addendum. 11. Assistance in Litigation or Administrative Proceedings. Associate shall make itself, and any subcontractors, employees or agents assisting Associate in the performance of its obligations under the Contract, available to CE, at no cost to CE up to a maximum of 30 hours, to testify as witnesses, or otherwise, in the event of litigation or administrative proceedings being commenced against CE, its directors, officers or employees based upon a claimed violation of HIPAA, the Privacy Rule or other laws relating to security and privacy or PHI, except where Associate or its subcontractor, employee or agent is a named adverse party. 12. No Third Party Beneficiaries. Nothing express or implied in this Contract is intended to confer, nor shall anything herein confer, upon any person other than CE, Associate and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever. 13. Interpretation and Order of Precedence. The provisions of this Addendum shall prevail over any provisions in the Contract that may conflict or appear inconsistent with any provision in this Addendum. Together, the Contract and this Addendum shalt be interpreted as broadly as necessary to implement and comply with IIIPAA and the Privacy Rule. The patties agree that any ambiguity in this Contract shall be resolved in favor of a meaning that complies and is consistent with HIPAA and the Privacy Rule. This Contract superccdes and replaces any previous separately executed HIPAA addendum between the parties. Page 8 of 10 Colorado Model BA Provision and Addendum For New or Amended Contracts Rev. 07/10 14. Survival of Certain Contract Terms. Notwithstanding anything herein to the contrary, Associate's obligations under Section 4(d) ("Effect of Termination") and Section 12 ("No Third Party Beneficiaries") shall survive termination of this Contract and shall be enforceable by CE as provided herein in the event of such failure to perform or comply by the Associate. This Addendum shall remain in effect during the term of the Contract including any extensions. 15. Representatives and Notice. a. Representatives. For the purpose of the Contract, the individuals identified elsewhere in this Contract shall be the representatives of the respective parties. If no representatives are identified in the Contract, the individuals listed below are hereby designated as the parties' respective representatives for purposes of this Contract. Either party may from time to time designate in writing new or substitute representatives. b. Notices. All required notices shall be in writing and shall be hand delivered or given by certified or registered mail to the representatives at the addresses set forth below. State/Covered Entity Representative: Name: Todd Coffey Title: Acting Director, Division of Aging and Adult Services Department and Division: Department of Human Services Address: 1575 Sherman Street, 10t1 Floor Denver, CO 80203 Contractor/Business Associate Representative: Name: Kristina R. Wenzel, RN, MBA Title: Executive Director Department and Division: Central Colorado Area Health Education Center Address: 10200 E. Girard, Building C-252 Denver, CO 80231 Page 9 of 10 Colorado Model BA Provision and Addendum For New or Amended Contracts Rev. 07/10 ATTACHMENT A This Attachment sets forth additional terms to the HIPAA Business Associate Addendum, which is part of the Contract dated , between the Department of Human Services and Central Colorado Area Health Education Center contract number 13 IHA 52304 ("Contract") and is effective as of (the "Attachment Effective Date"). This Attachment may be amended from time to time as provided in Section 10(b) of the Addendum. 1. Additional Permitted Uses. In addition to those purposes set forth in Section 2(a) of the Addendum, Associate may use Protected Information as follows: None except as otherwise directed in writing by the State 2. Additional Permitted Disclosures. In addition to those purposes set forth in Section 2(b) of the Addendum, Associate may disclose Protected Information as follows: None except as otherwise directed in writing by the State 3. Subcontractor(s). The parties acknowledge that the following subcontractors or agents of Associate shall receive Protected Information in the course of assisting Associate in the performance of its obligations under this Contract: Central Colorado Area Health Education Center partners with signed MOU. 4. Receipt. Associate's receipt of Protected Information pursuant to this Contract shall be deemed to occur as follows, and Associate's obligations under the Addendum shall commence with respect to such PHI upon such receipt: Upon the effective date of the contract. 5. Additional Restrictions on Use of Data. CE is a Business Associate of certain other Covered Entities and, pursuant to such obligations of CE, Associate shall comply with the following restrictions on the use and disclosure of Protected Information: As may be directed in writing by the State 6. Additional Terms. [This section may include specifications for disclosure format, method of transmission, use of an intermediary use of digital signatures or PKI, authentication, additional security of privacy specifications, de -identification or re -identification of data and other additional terms.] None Page 10 of 10 Colorado Model BA Provision and Addendum For New or Amended Contracts Rev. 07/10 IN WITNESS WHEREOF, the parties hereto have executed this Agreement on the day first written above. BOARD OF COUNTY COMMISSIONERS William GaYcia,LeImir APR 0 8 2013 ATTEST: Weld County Clerk to the Board BY: /191hletr Deputy Clerk to the CENTRA B Kristina R Wenzel, Executive p hector OLORADO AHEC WELD COUNTY DEPARTMENT OF HUMAN SERVICES WELD COUNTY AREA AGENCY ON AGING Eva M. Jewel C ivition Head Hello