HomeMy WebLinkAbout20030987.tiff RESOLUTION
RE: APPROVE BUSINESS ASSOCIATE AGREEMENT FOR EMERGENCY RADIO
DISPATCH SERVICES AND AUTHORIZE CHAIR TO SIGN-BANNER HEALTH SYSTEM
WHEREAS, the Board of County Commissioners of Weld County, Colorado, pursuant to
Colorado statute and the Weld County Home Rule Charter, is vested with the authority of
administering the affairs of Weld County, Colorado, and
WHEREAS, the Board has been presented with a Business Associate Agreement for
emergency radio dispatch services between the County of Weld,State of Colorado, by and through
the Board of County Commissioners of Weld County, and Banner Health System, with terms and
conditions being as stated in said agreement, and
WHEREAS, after review, the Board deems it advisable to approve said agreement, a copy
of which is attached hereto and incorporated herein by reference.
NOW, THEREFORE, BE IT RESOLVED by the Board of County Commissioners of Weld
County, Colorado, that the Business Associate Agreement for emergency radio dispatch services
between the County of Weld, State of Colorado, by and through the Board of County
Commissioners of Weld County, and Banner Health System be, and hereby is, approved.
BE IT FURTHER RESOLVED by the Board that the Chair be, and hereby is, authorized to
sign said agreement.
The above and foregoing Resolution was, on motion duly made and seconded, adopted by
the following vote on the 21st day of April, A.D., 2003.
BOARD OF COUNTY COMMISSIONERS
W COUNTY, COLORADO
ATTEST: L��7� IE t
� �,� David E. Long, Chair
Weld County Clerk to t ,g3
. + ,
:
04 EXCUSED
• , Robert D asden, Pro-T m
BY: 'JCL & `.. . o-
Deputy Clerk to the B .n ? {`l\.(
=`1"'� M. J. Geile
AS . 'IiL '7l�✓v�
William . Jerrkkee
oun Atf ey /�,(�s�
e7/712 Glenn Vaade
Date of signature:
2003-0987
C HS0009
00 ' l
f r
BUSINESS ASSOCIATE AGREEMENT
This Business Associate Agreement(" Agreement")effective April 21 , 2003
("Effective Date"), is entered into by and between Banner Health System, an Arizona nonprofit
corporation (the "Covered Entity") and Board of County Commissioners of Weld County
(the"Associate") (each a"Party" and collectively the"Parties").
The Covered Entity is a healthcare provider and the Associate provides emergency radio
dispatch services. The Parties have a Dispatch Agreement dated as of even date herewith (the "
Dispatch Agreement") under which the Covered Entity regularly discloses Protected Health
Information to the Associates for its use in performance of the Services described below.
Associate and Covered Entity agree to the terms and conditions of this Agreement in order to
comply with the use and handling of Protected Health Information ("PHI") under the Standards
for Privacy of Individually Identifiable Health Information, 45 C.F.R. §§ 160.103, 164.501 et. seq.,
as amended from time to time ("Privacy Standards") under the Health Insurance Portability and
Accountability Act of 1996 ("HIPAA"). Unless otherwise provided, all capitalized terms in this
Agreement will have the same meaning as provided under the Privacy Standards. Associate
and Covered Entity will comply with the terms of this Agreement for the duration of this
Agreement.
1. Uses and Disclosures of Protected Health Information. Associate will use and disclose PHI
only for those purposes necessary to perform its duties, obligations and functions under the
Agreement, or as otherwise expressly permitted in this Attachment or required by other law.
Associate will not use or further disclose any PHI in violation of this Section.
2. Safeguards. Associate will implement appropriate safeguards to prevent any use or
disclosure of PHI not otherwise permitted in this Agreement.
3. Reports of Impermissible Use of Disclosure. Associate will report to Covered Entity any use
or disclosure of PHI not permitted by this Agreement within five days of Associate's learning of
such use or disclosure.
4. Agents and Subcontractors. If Associate provides PHI to an agent or subcontractor for a
purpose authorized under the Dispatch Agreement and this Agreement,Associate will first enter
into a written contract with the agent or subcontractor that requires the agent or subcontractor to
agree to the same restrictions and conditions applicable to Associate's use and disclosure of PHI.
Associate will maintain an accounting of any such disclosures to agents or subcontractors as
provided in Section 8 of this Agreement.
5. Obligations Regarding Associate Personnel. Associate will inform all of its employees,
agents, representatives and members of its workforce ("Associate Personnel"), whose services
may be used to satisfy Associate's obligations under the Agreement and this Agreement of the
terms of this Agreement. Associate represents and warrants that the Associate Personnel are
under legal obligation to Associate, by contract or otherwise, sufficient to enable Associate to
fully comply with the provisions of this Agreement.
6. Access to PHI.
a. Covered Entity Access. Within five (5) business days of a request by Covered Entity
for access to PHI held by Associate, Associate will make requested PHI available to
Covered Entity.
b. Patient Access. If a Patient requests access to PHI directly from Associate, Associate
will within five (5) business days forward such request in writing to Covered Entity.
t
I:1Contracts Pegg Business Associate template 02.doc
2003-0987
1
Covered Entity will be responsible for making all determinations regarding the grant or
denial of a Patient's request for PHI and Associate will make no such determinations.
Only Covered Entity will release PHI to the Patient pursuant to such a request. "Patient"
shall mean the individual to whom the PHI relates.
7. Amendment of PHI. Within five(5)business days of receiving a request from Covered Entity
to amend a Patient's PHI, Associate will provide such information to Covered Entity for
amendment. If the Covered Entity's request includes specific information to be included in the
PHI as an amendment, Associate will incorporate such amendment within five (5) business days
of receipt of the Covered Entity request. Within five (5) business days of receipt of a request by
Patient to Associate to amend PHI, Associate will forward the request to Covered Entity.
Covered Entity will be responsible for making all determinations regarding amendments to
PHI;Associate will make no such determinations.
8. Accounting of Disclosures; Requests for Disclosure. Associate will maintain all disclosure
records under this Section 8 for the term of the Agreement plus six years after the effective date of
termination or expiration of the Agreement.
a. Disclosure Records. Associate will keep a written record of any disclosure made to its
agents,subcontractors or to third parties for any purpose other than:
(1) Disclosures to other health care providers to assist in the treatment of
patients;
(2) Disclosures to others to assist the Covered Entity in obtaining payment;
(3) Disclosures to others to assist the Covered Entity in conducting its health
care operations,as defined in 45 C.F.R. §164.501.
b. Data Regarding Disclosures. Except for disclosures made for purposes set forth in 8
(a)1-3,Associate will record and maintain the following information for each disclosure:
(1) The date of disclosure;
(2) The name of the entity or person who received the PHI and the address of
such entity or person,if known.
(3) A description of the PHI disclosed;and
(4) A brief statement of the purpose of the disclosure, including an explanation
of the basis for the disclosure.
c. Patient Request for Disclosure Records. Within five (5) business days of receipt of a
notice from Covered Entity to Associate of a Patient's request for PHI disclosures,
Associate will provide Covered Entity with the records of disclosures requested in the
notice. Associate will provide the disclosure records for any period that begins on or
after April 14, 2003. In no event shall the disclosure period exceed six years before the
date on which the accounting was requested by the Patient, as set forth in the notice In
no event shall Associate be required to tender an accounting for any dates prior to April
14,2003.
d. Patient Request to Associate. If a Patient requests an accounting of disclosures
directly from Associate, Associate will forward the request to Covered Entity within five
(5) business days of Associate's receipt of the request, and will make its records of
disclosures available to Covered Entity as otherwise provided in this Section. Covered
Entity will be responsible to prepare and deliver the records of disclosure to the Patient.
Associate will not provide an accounting of disclosures directly to the Patient.
2
I:IContmcts'Peggy\Business Associate template 02.doc
9. Associate Use of PHI for Management and Administration. Associate may use PHI for the
necessary management and administration of Associate, or to carry out the legal responsibilities
of the Associate and may disclose PHI if:
a. The disclosure is required by law;or
b. Associate secures and retains written assurance as set forth in Exhibit 1 to this
Agreement from the receiving party that the receiving party will: (i) hold the PHI
confidential; (ii) use or disclose the PHI only as required by law or for the purposes for
which it was disclosed to the recipient; and (iii) notify the Associate of any breaches in
the confidentiality of the PHI.
10. Change or Restriction of Use or Disclosure of PHI. If Covered Entity advises Associate of
any changes in, or restrictions to the permitted use or disclosure of PHI provided to Associate,
Associate will restrict use or disclosure of PHI consistent with the Covered Entity's instructions.
11. Responsibilities upon Termination.
a. Return of PHI; Destruction. Within thirty days of termination or expiration of the
Agreement,the Associate will return to Covered Entity all PHI received from Covered
Entity or created or received by Associate on behalf of Covered Entity which Associate
maintains in any form or format, and Associate will not maintain or keep in any form or
format any portion of the PHI. Alternatively, Associate may, upon request and receipt of
Covered Entity's prior written consent, destroy all such PHI and provide written
documentation of such destruction to Covered Entity. The requirement to return or
destroy such PHI will apply to all agents or subcontractors of Associate. Associate will
be responsible for recovering any PHI from such agents or subcontractors.
b. Alternative Measures. If Associate believes that returning or destroying PHI at the
termination or expiration of the Dispatch Agreement is not feasible, it will provide
written notice to Covered Entity within five (5) business days of the effective date of
termination of the Agreement. Such notice will set forth the circumstances that Associate
believes makes the return or destruction of PHI not feasible and the alternative measures
that Associate recommends for assuring the continued confidentiality and security of the
PHI. Covered Entity will promptly notify Associate of whether it agrees that the return
or destruction of PHI is not feasible. If the Covered Entity agrees that return or
destruction of PHI is not feasible, Associate agrees to extend all protections, limitations
and restrictions of this Agreement to Associate's use or disclosure of PHI retained and to
limit further uses or disclosures to those purposes that make the return or destruction of
the PHI not feasible. Any such extended protections, limitations and restrictions will
apply to any agents or subcontractors of Associate for whom return or destruction of PHI
is determined by Covered Entity to be not feasible. If Covered Entity does not agree that
the return or destruction of PHI from Associate or its agents or subcontractors is
infeasible, Covered Entity will provide Associate with written notice of its decision, and
Associate,its agents and subcontractors will proceed with the return or destruction of the
PHI pursuant to the terms of this Section within fifteen days of the date of Covered
Entity's notice.
12. Termination. Covered Entity may immediately terminate the Dispatch Agreement upon
written notice to Associate if Covered Entity determines in its discretion that the Associate has
breached a material term of this Agreement. Alternatively, Covered Entity may elect to provide
3
I:1Contracts\PeggylBusiness Associate template 02.doc
Associate with at least ten(10)business days' advance written notice of Associate's breach of any
term or condition of this Agreement, and afford Associate the opportunity to cure the breach to
the satisfaction of Covered Entity within the ten(10)day period(the"Cure Period"). If Associate
fails to timely cure the breach,as determined by Covered Entity,the Agreement will terminate on
expiration of the Cure Period unless Covered Entity extends the Cure Period in writing.
13. Associate Books and Records.
a. Covered Entity Access. Associate will, within five (5) business days' of Covered
Entity's written request, make available during normal business hours at Associate's
offices, all records, books, agreements, policies and procedures relating to the use or
disclosure of PHI for the purpose of allowing Covered Entity to determine Associate's
compliance with the Agreement and this Agreement.
b. Government Access. Associate will make its internal practices,books and records on
the use and disclosure of PHI available to the Secretary of the Department of Health and
Human Services to the extent required for determining compliance with the Privacy
Standards and any other provisions of HIPAA and HIPAA regulations. Notwithstanding
this provision, no attorney-client, accountant-client or other legal privilege will be
deemed waived by Associate or Covered Entity as a result of this Section.
14. Notices. Any notices required under this Agreement will be sent to the parties at the
following address by first class mail,fax or hand delivery:
Covered Entity: Associate:
Banner Health System Board of Commissioners of
Weld County
1441 North 12th Street 915 10th Street
Phoenix,Arizona 85006 Greeley,CO 80631
Fax:602-495-4897 Fax: 970-3564546
Attn:VP Legal Affairs Attn: Dm (v a#v1
COVERED ENTITY: ASSOCIATE:
Banner Health System, Board of County
an Arizona nonprofit corporation Commissioners of Weld County
By✓.— By •� �� ..
Its Its David E. Lon: Ct!:ir
(04/21/2003) JJ
Attest:
I '/ '
By
Deputy Clerk to ;1 'oa}.
O 17
4
I:\Contracts\Peggy$Business Associate template 02.doc
acx03-O927
1
BUSINESS ASSOCIATE ASSURANCE FOR RELEASE OF INFORMATION TO THIRD
PARTIES
1. ("Associate") is a business associate of Banner Health System, an Arizona
nonprofit corporation ("Covered Entity") pursuant to the agreement between Associate and
Covered Entity dated ("Agreement"). Pursuant to that Agreement, Associate is
required to comply with the requirements for the use and handling of Protected Health
Information("PHI")from Covered Entity as set forth in the Standards for Privacy of Individually
Identifiable Health Information,45 C.F.R. 164.501 et. seq. as amended from time to time ("Privacy
Standards").
2. Associate is permitted to disclose PHI to ("Recipient") for the necessary
management and administration of Associate and to carry out the legal responsibilities of the
Associate, provided that Recipient shall and does hereby provide Associate with the assurances
for Recipient's use and disclosure of PHI set forth below. Disclosure of PHI is conditioned on
Recipient's assurances set forth below.
3. Associate seeks to disclose PHI to Recipient for the following management, administration or
legal responsibilities of Associate:
4. Recipient expressly represents and agrees that it will:
a. Hold the PHI confidential and make no redisclosure to any third party without
Associate's express advance written consent;
b. Use or disclose the PHI only as required by law or for the purposes set forth above;and
c. Notify Associate in writing of any breaches in the confidentiality of the PHI within three
days of discovery of any such breach.
5. The disclosure of PHI to Recipient is made in reliance of the Recipient's foregoing agreement.
ASSOCIATE RECIPIENT
By By
Its Its
Date Date
Hello