The URL can be used to link to this page

Browse Search

Home My WebLink About20120588.tiff RESOLUTION RE: APPROVE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA) AGREEMENT AND AUTHORIZE CHAIR TO SIGN - DEPARTMENT OF PUBLIC HEALTH AND ENVIRONMENT / NORTH RANGE BEHAVIORAL HEALTH WHEREAS, the Board of County Commissioners of Weld County, Colorado, pursuant to Colorado statute and the Weld County Home Rule Charter, is vested with the authority of administering the affairs of Weld County, Colorado, and WHEREAS, the Board has been presented with a Health Insurance Portability and Accountability Act (HIPAA) Agreement between the County of Weld, State of Colorado, by and through the Board of County Commissioners of Weld County, on behalf of the Department of Public Health and Environment, and North Range Behavioral Health, with further terms and conditions being as stated in said agreement, and WHEREAS, after review, the Board deems it advisable to approve said agreement, a copy of which is attached hereto and incorporated herein by reference. NOW, THEREFORE, BE IT RESOLVED by the Board of County Commissioners of Weld County, Colorado, that the Health Insurance Portability and Accountability Act (HIPAA) Agreement between the County of Weld, State of Colorado, by and through the Board of County Commissioners of Weld County, on behalf of the Department of Public Health and Environment, and North Range Behavioral Health, be, and hereby is, approved. BE IT FURTHER RESOLVED by the Board that the Chair be, and hereby is, authorized to sign said agreement. The above and foregoing Resolution was, on motion duly made and seconded, adopted by the following vote on the 29th day of February, A.D., 2012. BOARD OF COUNTY COMMISSIONERS WELD COUNTY, COLORADO ATTEST: �G.w. - - �‘a- Sean Sean P. Co C( hair Weld County Clerk to the Board lA I . L_ /�� illiam F. Garcia, Pro-Tem BY: DeputyCle ; to the Boa . t ' q"% . .�� / ✓� �s (� rbara Kirkmeyer / ..u.. APP A •� 0 : XCUSED Aavid E. Long ounty Attorney ri 9 4 , (arQr�Yho G Dougl Rademac er Date of signature: O✓i -}v eo ^ • C L ' 2012-0588 3-I - ! a 3 2 Lr r/2- PE0029 HIPAA Business Associate Agreement Weld County Department of Public Health and Environment This HIPAA Business Associate Agreement (`'HIPAA Agreement") is by and between the Weld County Department of Public Health and Environment, by and through the Board of County Commissioners of Weld County, sitting as the Weld County Board of Health, whose address is 1555 N. 17th Avenue, Greeley, CO 80631. hereinafter referred to as "County Health," and t4Dfkil1- R.4%&GE 8 it/tV I D R+hL H'&flT}{ whose address is IS nl . 1 t" f1Yevua tettete-t.a I tv Sob3t hereinafter referred to as "Business Associate." 'l WITNESSETII: WHEREAS, County Health is a"covered entity" under the terms and requirements of the Health Insurance Portability and Accountability Act of 1996, and the applicable breach notification rules under Title XIII (D) of the American Recovery and Reinvestment Act of 2009, and the regulations promulgated thereunder, as each may be amended from time to time (collectively, "HIPAA"), and WHEREAS, Business Associate provides health services under separate agreement with County Health ("Separate Agreement"), and meets the definition of a Business Associate set forth at 45 C.F.R. §160.103, or it's applicable successor provisions, and WHEREAS, this HIPAA Agreement defines the rights and responsibilities of the parties with respect to PHI, as stated in HIPAA. NOW THEREFORE, in consideration of their mutual agreements, the parties agree as follows: 1. Defined Terms. For the purposes of this HIPAA Agreement, the following terms shall be defined as follows: a. "Individual" shall have the same meaning as the term"individual"in 45 C.F.R. § 164.501, and shall include a person who qualifies as a personal representative in accordance with 45 C.F.R. § 164.502(g). b. "Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 C.P.R. part 160 and part 164, subparts A and E. c. "Protected Health Information," or "PHI," shall have the same meaning as the term "Protected Health Information" in 45 C.F.R. § 164.501, limited to the information received by Business Associate from or on behalf of Customer. d. "Required By Law" shall have the same meaning as the term "required by law" in 45 C.F.R. § 164.501. 2012-0588 1 e. "Secretary" shall mean the Secretary of the United States Department of Health and Human Services or his or her designee. f. "Security Rule" shall mean the Standards for Security of Individually Identifiable Health Information at 45 C.F.R., Sections 160, 162 and 164. 2. Obligations and Activities of Business Associate. a. Business Associate shall not use or disclose PHI other than as permitted or required by this HIPAA Agreement or as permitted or Required by Law. b. Business Associate agrees to provide those physical, technical, and administrative safeguards described in the Privacy Rule and/or the Security Rule. c. Business Associate agrees to mitigate, to the extent reasonably practicable. any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate or its agents or subcontractors in violation of the requirements of this HIPAA Agreement or the terms and requirements of the Privacy Rule and/or the Security Rule. d. Business Associate agrees to report to County Health any impermissible acquisition, access, use or disclosure of PHI of which it becomes aware without unreasonable delay, and in no case later than five (5) calendar days after discovery of the acquisition, access, use or disclosure, including therein any breach notification required under HIPAA. e. Business Associate agrees to obtain from any agent, including a subcontractor to whom it provides PHT, reasonable assurances that it will adhere to the same restrictions and conditions that apply to Business Associate under this HIPAA Agreement with respect to such information. f. All PHI maintained by Business Associate for County Health will be available to County Health in a time and manner that reasonably allows County Health to comply with the requirements under 45 C.F.R. § 164.524. Business Associate shall not be obligated to provide any such information directly to any Individual or person other than County Health. g. All PHI and other information maintained by Business Associate for County Health will be available to County Health in a time and manner that reasonably allows County Health to comply with the requirements under 45 C.F.R. § 164.526. h. Business Associate agrees to make internal practices, books, and records available to the Secretary, in a time and manner designated by the Secretary, for purposes 2 of the Secretary's determining County Health's compliance with the Privacy Rule and/or the Security Rule. i. County Health acknowledges that Business Associate is not required by this HIPAA Agreement to make disclosures of-PHI to Individuals or any person other than to County Health, and that Business Associate does not, therefore, expect to maintain documentation of such disclosure as described in 45 C.F.R. § 164.528. In the event that Business Associate does make such disclosure, it shall document the disclosure as would be required for County Health to respond to a request by an Individual for an accounting of disclosures in accordance with 45 C.F.R. $164.528, and shall provide such documentation to County Health promptly upon County Health's request. 3. Permitted Uses and Disclosures by Business Associate. Except as otherwise limited in this HIPAA Agreement, Business Associate may use or disclose PHI to perform functions, activities, or services for, or on behalf of, County Health as specified in the Separate Agreement, provided that such use or disclosure would not violate the Privacy Rule and/or Security Rule if done by County Health. 4. Specific Use and Disclosure Provisions. Except as otherwise limited in this HIPAA Agreement or other portion of the Agreement, Business Associate may: a. Use PHI for the proper management and administration of Business Associate or to carry out its legal responsibilities; b. Disclose PHI for the proper management and administration of Business Associate, provided that disclosures are (i) required by law, or (ii) Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person will notify Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached; and c. Use PHI to report violations of law to appropriate Federal and State authorities, consistent with §164.502(j)(1). 5. Obligations of County Health. County Health shall notify Business Associate of: a. Any limitations(s) in County Health's notice of privacy practices in accordance with 45 C.F.R. § 164.520, to the extent that such changes may affect Business Associate's use or disclosure of PHI; b. Any changes in, or revocation of, permission by Individual to use or disclose PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI; and 3 c. Any restriction to the use or disclosure of PHI that County Health has agreed to in accordance with 45 C.F.R. § 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of PHI. County Health agrees that it will not request Business Associate to use or disclose PI II in any manner that would not be permissible under the Privacy Rule and/or Security Rule, if done by County Health. 6. Term and Termination. a. The term of this HIPAA Agreement shall continue for the term of the Separate Agreement, and following termination of the Agreement until all PHI is destroyed or returned to County Health or County Health designee, as described below in Subsection 6.c. b. Breach of this HIPAA Agreement shall be a material breach of this HIPAA Agreement giving rise to a right of termination of the Separate Agreement. c. Upon termination of the Separate Agreement for any reason Business Associate shall destroy all PHI. This provision shall apply to PHI that is in the possession of subcontractors or agents of Business Associate as well as Business Associate itself. Business Associate shall retain no copies of the PIII. In the event that Business Associate determines that destroying the PHI is infeasible, Business Associate shall promptly provide County Health notification of the conditions that make return or destruction infeasible. Business Associate shall extend the protections of this Agreement to such PHI and limit further uses and disclosures of such PHI to those purposes that make the destruction infeasible, for so long as Business Associate maintains such PHI. County Health shall bear the cost of storage of such PHI for as long as storage by Business Associate is required. This Section does not require Business Associate to segregate any PIII from other information maintained by County Health on Business Associate's servers and Business Associate may comply with this requirement by returning or destroying all of the information maintained on its servers by County Health. 7. Miscellaneous. a. Amendment. Each party agrees to take such action as is reasonably necessary to amend this HIPAA Agreement from time to time as is necessary for County Health to comply with the requirements of HIPAA. b. Survival. The respective rights and obligations of the parties under this HIPAA Agreement shall survive the termination of this HIPAA Agreement. c. Interpretation. Any ambiguity in the Agreement shall be resolved to permit County Health to comply with HIPAA, the Privacy Rule and/or Security Rule. 4 d. Nothing contained in this HIPAA Agreement shall confer upon any person or entity other than the parties hereto and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever. e. This HIPAA Agreement may not be assigned without the prior written consent of the non-assigning party, which consent shall not be unreasonably withheld. f. Whenever this I IIPAA Agreement requires one party to give notice to the other party, such notice shall be deemed given if notice is provided to the address(es) listed above. g. Any provision of the Separate Agreement that is directly contradictory to one or more terms of this HIPAA Agreement shall be superseded by the terms of this HIPAA Agreement. h. If any term or condition of this HIPAA Agreement shall be held to be invalid, illegal, or unenforceable, this HIPAA Agreement shall be construed and enforced without such provision, to the extent that this HIPAA Agreement is then capable of execution within the original intent of the parties. i. No portion of this HIPAA Agreement shall be deemed to constitute a waiver of any immunities the parties or their officers or employees may possess. j. It is expressly understood and agreed that the enforcement of the terms and conditions of this HIPAA Agreement, and all rights of action relating to such enforcement, shall be strictly reserved to the undersigned parties and nothing in this HIPAA Agreement shall give or allow any claim or right of action whatsoever by any other person not included in this HIPAA Agreement. It is the express intention of the undersigned parties that any entity other than the undersigned parties receiving services or benefits under this HIPAA Agreement shall be an incidental beneficiary only. 5 IN WITNESS WHEREOF, the parties have executed this HIPAA Agreement as of the date and year written below. BUSINESS ASSOCIATE: By: Title: ATTEST: y BOARD OF COUNTY CLERK TO THE BOARD ,� E La` COMMISSIONERSOF WELD COUNTY By / it ! �� i� 7tit�3�' By: .....cm P Deputy Clerk to the Bo +� ,, � Sean P. Conway, Chairman C r, FEB 2 9 2012 6 a2©/o7-b,SBg Hello