2003 S Social Services - UNC Hospitals for income maintenance staff

Browse Search

BUSINESS ASSOCIATE AGREEMENT This Agreement is made effective the 15~ of July, 2003, by and between UNC Hospitals, hereinafter referred to as "Covered Entity", and the Orange County, North Carolina, on behalf of its Department of Social Services Medicaid Program, hereinafter referred to as "Business Associate", (individually, a "Party" and collectively, the "Parties"). WITNESSETH: WHEREAS, Sections 261 through 264 of the federal Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, known as "the Administrative Simplification provisions," direct the Department of Health and Human Services to develop standards to protect the security, confidentiality and integrity of health information; and WHEREAS, pursuant to the Administrative Simplification provisions, the Secretary of Health and Human Services has issued regulations modifying 45 CFR Parts 160 and 164 (the "HIPAA Privacy Rule"); and WHEREAS, the Parties wish to enter into or have entered into an arrangement whereby Business Associate will provide certain services to Covered Entity, and, pursuant to such arrangement, Business Associate may be considered a "business associate" of Covered Entity as defined in the HIPAA Privacy Rule (the agreement evidencing such arrangement is described on Exhibit A attached hereto and made a part hereof, and is hereby referred to as the "Arrangement Agreement"); and WHEREAS, Business Associate may have access to Protected Health Information (as defined below) in fulfilling its responsibilities under such arrangement; THEREFORE, in consideration of the Parties' continuing obligations under the Arrangement Agreement, compliance with the HIPAA Privacy Rule, and for Ten and 00/100s Dollars ($10.00) and other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the Parties agree to the provisions of this Agreement in order to address the requirements of the HIPAA Privacy Rule and to protect the interests of both Parties. DEFINITIONS Except as otherwise defined herein, any and all capitalized terms in this Section shall have the definitions set forth in the HIPAA Privacy Rule. In the event of an inconsistency between the provisions of this Agreement and mandatory provisions of the HIPAA Privacy Rule, as amended, the HIPAA Privacy Rule shall control. Where provisions of this Agreement are different than those mandated in the HIPAA Privacy Rule, but are nonetheless permitted by the HIPAA Privacy Rule, the provisions of this Agreement shall control. The term "Individually Identifiable Health Information" means health information (including demographic information collected from an individual) that (a) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (b) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (i) That identifies the individual; or