2014-318 HR - UnitedHealthCare for United HealthCare Application for Excess Loss Insurance Policy $1,625,322

Browse Search

EXHIBIT D-BUSINESS ASSOCIATE AGREEMENT ADDENDUM This Business Associate Agreement (`BAN") is incorporated into and made part of the Administrative Services Agreement ("Agreement") between United Healthcare Services, Inc. on behalf of itself and its Affiliates (`Business Associate") and Orange County("Covered Entity") (each a"Party" and collectively the"Parties") and is effective on January 1,2014(Effective Date). The Parties hereby agree as follows: 1. DEFINITIONS 1.1 Unless otherwise specified in this BAA,all capitalized terms used in this BAA not otherwise defined have the meanings established for purposes of the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations as amended and supplemented by HITECH, as each is amended from time to time(collectively,"HIPAX). 1.2 "Affiliate",for purposes of this BAA,means any entity that is a subsidiary of UnitedHealth Group. 1.3 "Breach" means the acquisition, access, use or disclosure of PHI in a manner not permitted by the Privacy Rule that compromises the security or privacy of the PHI as defined, and subject to the exclusions set forth,in 45 C.F.R. 164.402. 1.4 `Breach Rule" means the federal breach regulations, as amended from time to time, issued pursuant to HIPAA and codified at 45 C.F.R.Part 164(Subpart D). 1.5 "Compliance Date"means the later of the September 23,2013 or the effective date of the Agreement. 1.6 "Electronic Protected Health Information" (or"ePHI") means PHI that is transmitted or maintained in Electronic Media. 1.7 "HITECH"means Subtitle D of the Health Information Technology for Economic and Clinical Health Act provisions of the American Recovery and Reinvestment Act of 2009, 42 U.S.C. 17921-17954, and all associated existing and future implementing regulations,when and as each is effective. 1.8 "PHI' means Protected Health Information, as defined in 45 C.F.R. 160.103, and is limited to the Protected Health Information received from, or received, maintained created or transmitted on behalf of, Covered Entity by Business Associate in performance of the Services. 1.9 "Privacy Rule" means the federal privacy regulations, as amended from time to time, issued pursuant to HIPAA and codified at 45 C.F.R.Parts 160 and 164(Subparts A&E). 1.10 "Security Rule"means the federal security regulations, as amended from time to time, issued pursuant to HIPAA and codified at 45 C.F.R.Parts 160 and 164(Subparts A&C). 1.11 "Services" means, to the extent and only to the extent they involve the receipt, creation, maintenance, transmission,use or disclosure of PHI,the services provided by Business Associate to Covered Entity as set forth in the Agreement,including those set forth in this BAA in Sections 4.3 through 4.7,as amended . by written agreement of the Parties from time to time. 2. RESPONSIBILITIES OF BUSINESS ASSOCIATE With regard to its use and/or disclosure of PHI,Business Associate agrees to: 2.1 not use and/or further disclose PHI except as necessary to provide the Services, as permitted or required by this BAA and/or the Agreement,and in compliance with each applicable requirement of 45 C.F.R. 164.504(e),or as otherwise Required by Law,provided that,to the extent Business Associate is to carry out Covered Entity's obligations under the Privacy Rule,Business Associate will comply with the requirements of the Privacy Rule that apply to Covered Entity in the performance of those obligations. 2.2 implement and use appropriate administrative, physical and technical safeguards and as of the Compliance Date comply with applicable Security Rule requirements with respect to ePHI, to prevent use or disclosure of PHI other than as provided for by this BAA and/or Agreement. 29