HomeMy WebLinkAbout20030514.tiff RESOLUTION
RE: APPROVE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT
(HIPAA) BUSINESS ASSOCIATE ADDENDUM AND AUTHORIZE CHAIR TO SIGN
WHEREAS, the Board of County Commissioners of Weld County, Colorado, pursuant to
Colorado statute and the Weld County Home Rule Charter, is vested with the authority of
administering the affairs of Weld County, Colorado, and
WHEREAS, the Board has been presented with a Health Insurance Portability and
Accountability Act (HIPAA) Business Associate Addendum between the County of Weld, State
of Colorado, by and through the Board of County Commissioners of Weld County, on behalf of
the Department of Human Services, Area Agency on Aging, and the Colorado Department of
Health Care Policy and Financing, with terms and conditions being as stated in said addendum,
and
WHEREAS, after review, the Board deems it advisable to approve said addendum, a
copy of which is attached hereto and incorporated herein by reference.
NOW, THEREFORE, BE IT RESOLVED by the Board of County Commissioners of
Weld County, Colorado, that the Health Insurance Portability and Accountability Act (HIPAA)
Business Associate Addendum between the County of Weld, State of Colorado, by and through
the Board of County Commissioners of Weld County, on behalf of the Department of Human
Services, Area Agency on Aging, and the Colorado Department of Health Care Policy and
Financing be, and hereby is, approved.
BE IT FURTHER RESOLVED by the Board that the Chair be, and hereby is, authorized
to sign said addendum.
The above and foregoing Resolution was, on motion duly made and seconded, adopted
by the following vote on the 24th day of February, A.D., 2003.
BOARD OF COUNTY COMMISSIONERS
WELZCOUN COLORADO
ATTEST:oa1 c
wd Long,
Weld County Clerk to eV
)11
fie Robert D. asden, Pro-Tem
BY: ..i/i •
Deputy Clerk to the Board - itlj>
M. J. Geile
APP�As TO TO •
fl
ree
3/ Glenn Vaad
Date of signature:
2003-0514
HR0074
air a�Uti�s�
Cover AcT &a7-,N6 N"M$F2:
GCHo
5n3- Soo CT
HIPAA BUSINESS ASSOCIATE ADDENDUM
This Business Associate Addendum ("Addendum") is a part of the Contract dated June
30, 2002 between the Department of Health Care Policy and Financing and Weld County
Division of Human Services'Area Agency on Aging by and through the Weld County Board of
Commissioners, contract number 2303-1324. For purposes of this Addendum,the State is
referred to as"Covered Entity"or"CE" and the Contractor is referred to as ("Associate").
Unless the context clearly requires a distinction between the Contract document and this
Addendum, all references herein to "the Contract" or"this Contract"include this Addendum.
RECITALS
A. CE wishes to disclose certain information to Associate pursuant to the terms of the
Contract, some of which may constitute Protected Health Information ("PHI") (defined
below).
•
B. CE and Associate intend to protect the privacy and provide for the security of PHI
disclosed to Associate pursuant to this Contract in compliance with the Health Insurance
Portability and Accountability Act of 1996, Public Law 104-191 ("HIPAA") and
regulations promulgated thereunder by the U.S. Department of Health and Human
Services (the "HIPAA Regulations") and other applicable laws, as amended.
C. As part of the HIPAA Regulations;the Privacy Rule (defined below)requires CE to enter -
into a contract containing specific requirements with Associate prior to the disclosure of
PHI, as set forth in,but not limited to, Title 45, Sections 160.103, 164.502(e) and
164.504(e) of the Code of Federal Regulations ("CFR") and contained in this Addendum.
The parties agree as follows:
1. Definitions.
a. Except as otherwise defined herein, capitalized terms in this Addendum shall have
the definitions set forth in the HIPAA Privacy Rule at 45 CFR Parts 160 and 164, as amended
("Privacy Rule"). In the event of any conflict between the mandatory provisions of the Privacy
Rule and the provisions of this Contract, the Privacy Rule shall control. Where the provisions of
this Contract differ from those mandated by the Privacy Rule, but are nonetheless permitted by
the Privacy Rule,the provisions of this Contract shall control.
b. "Protected Health Information"or"PHI"means any information, whether oral or
recorded in any form or medium: (i) that relates to the past, present or future physical or mental
condition of an individual; the provision of health care to an individual; or the past,present or
future payment for the provision of health care to an individual; and (ii)that identifies the
individual or with respect to which there is a reasonable basis to believe the information can be
used to identify the individual, and shall have the meaning given to such term under the Privacy
Rule,including, but not limited to, 45 CFR Section 164.501.
Pagel of9
Colorado Model BA Provision and
Addendum For New or Amended Contracts
Rev.8/20/02 .?Op 3-4Si 9
c. "Protected Information" shall mean PHI provided by CE to Associate or created
or received by Associate on CE's behalf.
2. Obligations of Associate.
a. Permitted Uses. Associate shall not use Protected Information except for the
purpose of performing Associate's obligations under this Contract and as permitted under this
Addendum. Further, Associate shall not use Protected Information in any manner that would
constitute a violation of the Privacy Rule if so used by CE, except that Associate may use
Protected Information: (i) for the proper management and administration of Associate; (ii) to
carry out the legal responsibilities of Associate; or(iii) for Data Aggregation purposes for the
Health Care Operations of CE. Additional provisions, if any, governing permitted uses of
Protected Information are set forth in Attachment A to this Addendum.
b. Permitted Disclosures. Associate shall not disclose Protected Information in any
manner that would constitute a violation of the Privacy Rule if disclosed by CE, except that
Associate may disclose Protected Information: (i) in a manner permitted pursuant to this
Contract; (ii) for the proper management and administration of Associate; (iii) as required by
law; (iv) for Data Aggregation purposes for the Health Care Operations of CE; or(v) to report
violations of law to appropriate federal or state authorities, consistent with 45 CFR Section
502(j)(1). To the extent that Associate discloses Protected Information to a third party, Associate
must obtain, prior to making any such disclosure: (i)reasonable assurances from such third party
that such Protected Information will be held confidential as provided pursuant to this Addendum
and only disclosed as required by law or for the purposes for which it was disclosed to such third
party; and (ii) an agreement from such third party to immediately notify Associate of any
breaches of confidentiality of the Protected Information, to the extent it has obtained knowledge
of such breach. Additional provisions, if any, governing permitted disclosures of Protected
Information are set forth in Attachment A.
c. Appropriate Safeguards. Associate shall implement appropriate safeguards as are
necessary to prevent the use or disclosure of Protected Information other than as permitted by
this Contract. Associate shall maintain a comprehensive written information privacy and
security program that includes administrative, technical and physical safeguards appropriate to
the size and complexity of the Associate's operations and the nature and scope of its activities.
d. Reporting of Improper Use or Disclosure. Associate shall report to CE in writing
any use or disclosure of Protected Information other than as provided for by this Contract within
five (5) days of becoming aware of such use or disclosure.
e. Associate's Agents. If Associate uses one or more subcontractors or agents to
provide services under the Contract, and such subcontractors or agents receive or have access to
Protected Information, each subcontractor or agent shall sign an agreement with Associate
containing substantially the same provisions as this Addendum and further identifying CE as a
third party beneficiary with rights of enforcement and indemnification from such subcontractors
or agents in the event of any violation of such subcontractor or agent agreement. Associate shall
Page 2 of 9
Colorado Model BA Provision and
Addendum For New or Amended Contracts
Rev. 8/20/02
implement and maintain sanctions against agents and subcontractors that violate such restrictions
and conditions and shall mitigate the effects of any such violation.
f. Access to Protected Information. Associate shall make Protected Information
maintained by Associate or its agents or subcontractors in Designated Record Sets available to
CE for inspection and copying within ten(10) days of a request by CE to enable CE to fulfill its
obligations to permit individual access to PHI under the Privacy Rule, including, but not limited
to, 45 CFR Section 164.524.
g. Amendment of PHI. Within ten (10) days of receipt of a request from CE for an
amendment of Protected Information or a record about an individual contained in a Designated
Record Set, Associate or its agents or subcontractors shall make such Protected Information
available to CE for amendment and incorporate any such amendment to enable CE to fulfill its
obligations with respect to requests by individuals to amend their PHI under the Privacy Rule,
including,but not limited to, 45 CFR Section 164.526. If any individual requests an amendment
of Protected Information directly from Associate or its agents or subcontractors, Associate must
notify CE in writing within five (5) days of receipt of the request. Any denial of amendment of
Protected Information maintained by Associate or its agents or subcontractors shall be the
responsibility of CE.
h. Accounting Rights. Within ten(10) days of notice by CE of a request for an
accounting of disclosures of Protected Information, Associate and its agents or subcontractors
shall make available to CE the information required to provide an accounting of disclosures to
enable CE to fulfill its obligations under the Privacy Rule, including, but not limited to, 45 CFR
Section 164.528. As set forth in, and as limited by, 45 CFR Section 164.528, Associate shall not
provide an accounting to CE of disclosures: (i) to carry out treatment,payment or health care
operations, as set forth in 45 CFR Section 164.506; (ii)to individuals of Protected Information
about them as set forth in 45 CFR Section 164.502; (iii)pursuant to an authorization as provided
in 45 CFR Section 164.508; (iv) to persons involved in the individual's care or other notification
purposes as set forth in 45 CFR Section 164.510; (v) for national security or intelligence
purposes as set forth in 45 CFR Section 164.512(k)(2); or(vi) to correctional institutions or law
enforcement officials as set forth in 45 CFR Section 164.512(k)(5). Associate agrees to
implement a process that allows for an accounting to be collected and maintained by Associate
and its agents or subcontractors for at least six (6) years prior to the request, but not before the
compliance date of the Privacy Rule. At a minimum, such information shall include: (i) the date
of disclosure; (ii)the name of the entity or person who received Protected Information and, if
known, the address of the entity or person; (iii) a brief description of Protected Information
disclosed; and (iv) a brief statement of purpose of the disclosure that reasonably informs the
individual of the basis for the disclosure, or a copy of the individual's authorization, or a copy of
the written request for disclosure. In the event that the request for an accounting is delivered
directly to Associate or its agents or subcontractors, Associate shall within five (5) days of the
receipt of the request forward it to CE in writing. It shall be CE's responsibility to prepare and
deliver any such accounting requested. Associate shall not disclose any Protected Information
except as set forth in Section 2(b) of this Addendum.
Page 3 of 9
Colorado Model BA Provision and
Addendum For New or Amended Contracts
Rev. 8/20/02
i. Governmental Access to Records. Associate shall make its internal practices,
books and records relating to the use and disclosure of Protected Information available to the
Secretary of the U.S. Department of Health and Human Services (the"Secretary"), in a time and
manner designated by the Secretary, for purposes of determining CE's compliance with the
Privacy Rule. Associate shall provide to CE a copy of any Protected Information that Associate
provides to the Secretary concurrently with providing such Protected Information to the
Secretary.
j. Minimum Necessary. Associate(and its agents or subcontractors) shall only
request, use and disclose the minimum amount of Protected Information necessary to accomplish
the purpose of the request, use or disclosure, in accordance with the Minimum Necessary
requirements of the Privacy Rule including,but not limited to 45 CFR Sections 164.502(b) and
164.514(d).
k. Data Ownership. Associate acknowledges that Associate has no ownership rights
with respect to the Protected Information.
1. Retention of Protected Information. Notwithstanding Section 4(d) of this
Addendum, Associate and its subcontractors or agents shall retain all Protected Information
throughout the term of this Contract and shall continue to maintain the information required
under Section 2(h) of this Addendum for a period of six (6) years after termination of the
Contract.
m. Associate's Insurance. In addition to any insurance requirements in the Contract,
Associate shall maintain casualty and liability insurance to cover loss of PHI data and claims
based upon alleged violations of privacy rights through improper use or disclosure of PHI. All
such policies shall meet or exceed the minimum insurance requirements of the Contract (e.g.,
occurrence basis, combined single dollar limits, annual aggregate dollar limits, additional insured
status and notice of cancellation).
n. Notification of Breach. During the term of this Contract, Associate shall notify
CE within twenty-four(24) hours of any suspected or actual breach of security, intrusion or
unauthorized use or disclosure of PHI and/or any actual or suspected use or disclosure of data in
violation of any applicable federal or state laws or regulations. Associate shall take (i)prompt
corrective action to cure any such deficiencies and (ii) any action pertaining to such unauthorized
disclosure required by applicable federal and state laws and regulations.
o. Audits, Inspection and Enforcement. Within ten(10) days of a written request by
CE, Associate and its agents or subcontractors shall allow CE to conduct a reasonable inspection
of the facilities, systems, books, records, agreements,policies and procedures relating to the use
or disclosure of Protected Information pursuant to this Addendum for the purpose of determining
whether Associate has complied with this Addendum; provided, however, that: (i) Associate and
CE shall mutually agree in advance upon the scope, timing and location of such an inspection;
(ii) CE shall protect the confidentiality of all confidential and proprietary information of
Associate to which CE has access during the course of such inspection; and (iii) CE shall execute
Page 4 of 9
Colorado Model BA Provision and
Addendum For New or Amended Contracts
Rev. 8/20/02
a nondisclosure agreement, upon terms mutually agreed upon by the parties, if requested by
Associate. The fact that CE inspects, or fails to inspect, or has the right to inspect,
Associate's facilities, systems,books, records, agreements, policies and procedures does not
relieve Associate of its responsibility to comply with this Addendum, nor does CE's (i) failure to
detect or(ii) detection, but failure to notify Associate or require Associate's remediation of any
unsatisfactory practices, constitute acceptance of such practice or a waiver of CE's enforcement
rights under the Contract.
p. Safeguards During Transmission. Associate shall be responsible for using
appropriate safeguards to maintain and ensure the confidentiality,privacy and security of
Protected Information transmitted to CE pursuant to the Contract, in accordance with the
standards and requirements of the Privacy Rule, until such Protected Information is received by
CE, and in accordance with any specifications set forth in Attachment A.
3. Obligations of CE.
a. Safeguards During Transmission. CE shall be responsible for using appropriate
safeguards to maintain and ensure the confidentiality, privacy and security of PHI transmitted to
Associate pursuant to this Contract, in accordance with the standards and requirements of the
Privacy Rule, until such PHI is received by Associate, and in accordance with any specifications
set forth in Attachment A.
b. Notice of Changes. CE shall provide Associate with a copy of its notice of
privacy practices produced in accordance with 45 CFR Section 164.520, as well as any
subsequent changes or limitation(s)to such notice, to the extent such changes or limitations may
effect Associate's use or disclosure of Protected Information. CE shall provide Associate with
any changes in, or revocation of,permission to use or disclose Protected Information, to the
extent it may affect Associate's permitted or required uses or disclosures. To the extent that it
may affect Associate's permitted use or disclosure of PHI, CE shall notify Associate of any
restriction on the use or disclosure of Protected Information that CE has agreed to in accordance
with 45 CFR Section 164.522. CE may effectuate any and all such notices of non-private
information via posting on CE's web site. Associate shall continually monitor CE's designated
web site for notice of changes to CE's HIPAA privacy policies and practices.
4. Termination.
a. Material Breach. In addition to any other provisions in the Contract regarding
breach, a breach by Associate of any provision of this Addendum, as determined by CE, shall
constitute a material breach of this Contract and shall provide grounds for immediate termination
of this Contract by CE pursuant to the provisions of the Contract covering termination for cause,
if any. If the Contract contains no express provisions regarding termination for cause, the
following terms and conditions shall apply:
(1) Default. If Associate refuses or fails to timely perform any of the
provisions of this Contract, CE may notify Associate in writing of the non-performance, and if
not promptly corrected within the time specified, CE may terminate this Contract. Associate
Page 5 of 9
Colorado Model BA Provision and
Addendum For New or Amended Contracts
Rev. 8/20/02
shall continue performance of this Contract to the extent it is not terminated and shall be liable
for excess costs incurred in procuring similar goods or services elsewhere.
(2) Associate's Duties. Notwithstanding termination of this Contract, and
subject to any directions from CE, Associate shall take timely, reasonable and necessary action
to protect and preserve property in the possession of Associate in which CE has an interest.
(3) Compensation. Payment for completed supplies delivered and accepted
by CE shall be at the Contract price. CE may withhold amounts due Associate as CE deems
necessary to protect CE against loss from third party claims of improper use or disclosure and to
reimburse CE for the excess costs incurred in procuring similar goods and services elsewhere.
(4) Erroneous Termination for Default. If after such termination it is
determined, for any reason, that Associate was not in default, or that Associate's action/inaction
was excusable, such termination shall be treated as a termination for convenience, and the rights
and obligations of the parties shall be the same as if this Contract had been terminated for
convenience, as described in this Contract.
b. Reasonable Steps to Cure Breach. If CE knows of a pattern of activity or practice
of Associate that constitutes a material breach or violation of the Associate's obligations under
the provisions of this Addendum or another arrangement and does not terminate this Contract
pursuant to Section 4(a), then CE shall take reasonable steps to cure such breach or end such
violation, as applicable. If CE's efforts to cure such breach or end such violation are
unsuccessful, CE shall either(i) terminate the Contract, if feasible or(ii) if termination of this
Contract is not feasible, CE shall report Associate's breach or violation to the Secretary of the
Department of Health and Human Services.
c. Judicial or Administrative Proceedings. Either party may terminate the
Contract, effective immediately, if(i) the other party is named as a defendant in a criminal
proceeding for a violation of HIPAA, the HIPAA Regulations or other security or privacy laws
or(ii) a finding or stipulation that the other party has violated any standard or requirement of
HIPAA, the HIPAA Regulations or other security or privacy laws is made in any administrative
or civil proceeding in which the party has been joined.
d. Effect of Termination.
(1) Except as provided in paragraph (2) of this subsection, upon termination
of this Contract, for any reason, Associate shall return or destroy all Protected Information that
Associate or its agents or subcontractors still maintain in any form, and shall retain no copies of
such Protected Information. If Associate elects to destroy the PHI, Associate shall certify in
writing to CE that such PHI has been destroyed.
(2) If Associate believes that returning or destroying the Protected
Information is not feasible, Associate shall promptly provide CE notice of the conditions making
return or destruction infeasible. Upon mutual agreement of CE and Associate that return or
destruction of Protected Information is infeasible, Associate shall continue to extend the
Page 6 of 9
Colorado Model BA Provision and
Addendum For New or Amended Contracts
Rev. 8/20/02
protections of Sections 2(a), 2(b), 2(c), 2(d) and 2(e) of this Addendum to such information, and
shall limit further use of such PHI to those purposes that make the return or destruction of such
PHI infeasible.
5. Injunctive Relief. CE shall have the right to injunctive and other equitable and legal
relief against Associate or any of its subcontractors or agents in the event of any use or
disclosure of Protected Information in violation of this Contract or applicable law. Associate
acknowledges and agrees that in the event of such impermissible use or disclosure of such PHI,
CE: (1) will suffer real, immediate, and irreparable injury which will be prevented by injunctive
relief; (2) that CE has no plain, speedy, and adequate remedy at law; (3)that the granting of a
preliminary injunction will promote the public interest in privacy rather than disserve the public
interest; (4) that the balance of equities always favors the injunction in such cases; (5)that the
injunction will preserve the status quo pending a trial on the merits; and(6) that CE shall not be
required to demonstrate a reasonable probability of success on the merits in order to obtain
injunctive relief.
6. No Waiver of Immunity. No term or condition of this Contract shall be construed or
interpreted as a waiver, express or implied, of any of the immunities, rights, benefits, protection,
or other provisions of the Colorado Governmental Immunity Act, CRS 24-10-101 et seg. or the
Federal Tort Claims Act, 28 U.S.C. 2671 et seq. as applicable, as now in effect or hereafter
amended.
7. Limitation of Liability. Any limitation of Associate's liability in the Contract shall be
inapplicable to the terms and conditions of this Addendum.
8. Disclaimer. CE makes no warranty or representation that compliance by Associate with
this Contract, HIPAA or the HIPAA Regulations will be adequate or satisfactory for Associate's
own purposes. Associate is solely responsible for all decisions made by Associate regarding the
safeguarding of PHI.
9. Certification. To the extent that CE determines an examination is necessary in order to
comply with CE's legal obligations pursuant to HIPAA relating to certification of its security
practices, CE or its authorized agents or contractors, may, at CE's expense, examine Associate's
facilities, systems, procedures and records as may be necessary for such agents or contractors to
certify to CE the extent to which Associate's security safeguards comply with HIPAA, the
HIPAA Regulations or this Addendum.
10. Amendment.
a. Amendment to Comply with Law. The parties acknowledge that state and federal
laws relating to data security and privacy are rapidly evolving and that amendment of this
Addendum may be required to provide for procedures to ensure compliance with such
developments. The parties specifically agree to take such action as is necessary to implement the
standards and requirements of HIPAA, the Privacy Rule and other applicable laws relating to the
security or privacy of PHI. The parties understand and agree that CE must receive satisfactory
written assurance from Associate that Associate will adequately safeguard all Protected
Page 7 of 9
Colorado Model BA Provision and
Addendum For New or Amended Contracts
Rev. 8/20/02
Information. Upon the request of either party,the other party agrees to promptly enter into
negotiations concerning the terms of an amendment to this Addendum embodying written
assurances consistent with the standards and requirements of HIPAA, the Privacy Rule or other
applicable laws. CE may terminate this Contract upon thirty(30) days written notice in the event
(i) Associate does not promptly enter into negotiations to amend this Contract when requested by
CE pursuant to this Section or(ii)Associate does not enter into an amendment to this Contract
providing assurances regarding the safeguarding of PHI that CE, in its sole discretion, deems
sufficient to satisfy the standards and requirements of HIPAA and the Privacy Rule.
b. Amendment of Attachment A. Attachment A may be modified or amended by
mutual agreement of the parties in writing from time to time without formal amendment of this
Addendum.
11. Assistance in Litigation or Administrative Proceedings. Associate shall make itself, and
any subcontractors, employees or agents assisting Associate in the performance of its obligations
under the Contract, available to CE, at no cost to CE, to testify as witnesses, or otherwise, in the
event of litigation or administrative proceedings being commenced against CE, its directors,
officers or employees based upon a claimed violation of HIPAA, the Privacy Rule or other laws
relating to security and privacy or PHI, except where Associate or its subcontractor, employee or
agent is a named adverse party.
12. No Third Party Beneficiaries. Nothing express or implied in this Contract is intended to
confer, nor shall anything herein confer,upon any person other than CE, Associate and their
respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.
13. Interpretation and Order of Precedence. The provisions of this Addendum shall prevail
over any provisions in the Contract that may conflict or appear inconsistent with any provision in
this Addendum. Together, the Contract and this Addendum shall be interpreted as broadly as
necessary to implement and comply with HIPAA and the Privacy Rule. The parties agree that
any ambiguity in this Contract shall be resolved in favor of a meaning that complies and is
consistent with HIPAA and the Privacy Rule. This Contract supercedes and replaces any
previous separately executed HIPAA addendum between the parties.
14. Survival of Certain Contract Terms. Notwithstanding anything herein to the contrary,
Associate's obligations under Section 4(d) ("Effect of Termination") and Section 12 ("No Third
Party Beneficiaries") shall survive termination of this Contract and shall be enforceable by CE as
provided herein in the event of such failure to perform or comply by the Associate.
15. Representatives and Notice.
a. Representatives. For the purpose of the Contract, the individuals identified
elsewhere in this Contract shall be the representatives of the respective parties. If no
representatives are identified in the Contract,the individuals listed below are hereby designated
as the parties' respective representatives for purposes of this Contract. Either party may from
time to time designate in writing new or substitute representatives.
b. Notices. All required notices shall be in writing and shall be hand delivered or
Page 8 of 9
Colorado Model BA Provision and
Addendum For New or Amended Contracts
Rev. 8/20/02
given by certified or registered mail to the representatives at the addresses set forth below.
State/Covered Entity Representative:
Name: Gary Snider
Title: Director
Department and Division: Health Care Policy and Financing
Long Term Benefits Division
Address: 1575 Sherman St.
Denver, CO 80203
Contractor/Business Associate Representative:
Name: Eva Jewell
Title: Director
Department and Division: Weld Area Agency on Aging
Address: P. O. Box 1805
Greeley, CO 80632
Page 9 of 9
Colorado Model BA Provision and
Addendum For New or Amended Contracts
Rev. 8/20/02
ATTACHMENT A
This Attachment sets forth additional terms to the HIPAA Business Associate
Addendum, which is part of the Contract dated June 30, 2002 between the Department of Health
Care Policy and Financing and Weld County Division of Human Services'Area Agency on
Aging by and through the Weld County Board of Commissioners contract number 2303-1324
("Contract") and is effective as of April 14, 2003 (the"Attachment Effective Date"). This
Attachment may be amended from time to time as provided in Section 10(b) of the Addendum.
1. Additional Permitted Uses. In addition to those purposes set forth in Section 2(a) of the
Addendum, Associate may use Protected Information as follows: No Additional Permitted Uses.
2. Additional Permitted Disclosures. In addition to those purposes set forth in Section 2(b)
of the Addendum, Associate may disclose Protected Information as follows:
No Additional Permitted Disclosures.
3. Subcontractor(s). The parties acknowledge that the following subcontractors or agents of
Associate shall receive Protected Information in the course of assisting Associate in the
performance of its obligations under this Contract:
None.
4. Receipt. Associate's receipt of Protected Information pursuant to this Contract shall be
deemed to occur as follows, and Associate's obligations under the Addendum shall commence
with respect to such PHI upon such receipt: No receipts.
5. Additional Restrictions on Use of Data. CE is a Business Associate of certain other
Covered Entities and, pursuant to such obligations of CE, Associate shall comply with the
following restrictions on the use and disclosure of Protected Information: No additional
Restrictions on Use of Data.
Page 1 of 2
Colorado Model BA Provision and
Addendum For New or Amended Contracts
Rev. 8/20/02
6. Additional Terms. [This section may include specifications for disclosure format,
method of transmission, use of an intermediary, use of digital signatures or PKI, authentication,
additional security of privacy specifications, de-identification or re-identification of data and
other additional terms]
None.
Contractor/Associate State/Covered Entity
Weld County Division of Human Services' STATE OF COLORADO
Area Agency on Aging by and through the BILL OWENS, GOVERNO
Weld Co Board of Commissioners
By: c� IQ re✓ ✓� tet-)nP r,4,cc
I r
Print Name: David E. Lon Executive Director
Title: Chair Department of d h. Core_ Po icy a j Rno v\C r i
Date: 02/24/2003 Date: 1/8/0 �
CORPORATIONS:
LEGAL REVIEW
(A corporate seal or attestation is required.)
KEN SALAZAR, ATTORNEY GENERAL
By
ei
/Le p
�� C
/
Attest (Seal) s" iQ � t' arovals:
1i� State Controller
By /S �!`: .� AT am art
('T� n,v :Y.rryQlc,�.�.. .,:►,'INi��r!?�.+./r'�1�1�]�
74VitiMityCisititity:1 ; ,•,/ �,��11 +I
Deputy Clerk to the Board "IP J. e 3/2.6/03
Page 2 of 2
Colorado Model BA Provision and
Addendum For New or Amended Contracts
Rev. 8/20/02
X003 C5y
MEMORANDUM
DATE: February 19,2003
ne TO: David E. Long, Chair, Weld County Board of
W� Commissioners
COLORADO FROM: Walter Speckman, Executive Director, Division of
Human Services
SUBJECT: Addendum to the Options for Long Term Care
Contract between Colorado Department of
Health Care Policy and Financing and the Weld
County Area Agency on Aging, Division of
Human Services
Enclosed for Board approval is an addendum to the 2002-2003 contract between the Area Agency on Aging,
Options for Long Term Care Program and the Colorado Department of Health Care Policy and Financing.
This addendum addresses issues related to the Health Insurance Portability and Accountability Act of 1996
(HIPAA). The Area Agency on Aging will be treated as a "Business Associate". This requires that the
Options for Long Term Care must be in compliance with HIPAA.
If you have additional questions,please contact Eva Jewell, Director of the Weld County Area Agency on
Aging.
2003-0514
Hello