Agenda - 04-01-2008-4g - Laserfiche WebLink

Browse Search

I~ Consolidated Agreement- Final Page 16 of 19 NORTH CAROLINA DEPARTMENT OF HEALTH AND HUMAN SERVICES BUSINESS ASSOCIATE ADDENDUM TO MEMORANDUM OF UNDERSTANDING This Agreement is made effective the 1st day of July, 2008, by and between (name of Local Health Department or "Covered Entity") and the Division of Public Health ("Business Associate") (collectively the "Parties"). 1. BACKGROUND a. Covered Entity and Business Associate are parties to a Memorandum of Understanding "entitled" The FY2009 Consolidated Agreement (the "MOU"), whereby Business Associate agrees to perform certain services for or on behalf of Covered Entity. . b. Covered Entity is an organizational unit of the North Carolina Department of Health and Human Services (the "Department") that has been designated in whole or in part by the Department as a health care component for purposes of the HIPAA Privacy and Security Rules. c. The relationship between Covered Entity and Business Associate is such that the Parties believe Business Associate is or may be a "business associate" within the meaning of the HII'AA Privacy and Security Rules. d. The Parties enter into this Business Associate Addendum to the MOU with the intention of complying with the HIPAA Privacy and Security Rules provision that a covered entity may disclose electronic protected health information or other protected health information to a business associate, and may allow a business associate to create or receive electronic protected health information or other protected heath information on its behalf, if the covered entity obtains satisfactory assurances that the business associate will appropriately safeguard the information. - 2. DEFINITIONS. Unless some other meaning is clearly indicated by the context, the following terms shall have the following meaning in this Agreement: a. "Electronic Protected Health Information" shall have the same meaning as the term "electronic protected health information" in 45 CFR 160.103, limited to the information created or received by Business Associate from or on behalf of a Covered Entity. b. "HIPAA" means the Administrative Simplescation Provisions, Sections 261 through 264, of the federal Health Insurance Portability and Accountability Act of 1996, Public Law 104-191. c. "Individual" shall have the same meaning as the term "individual" in 45 CFR 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(8). d. "Privacy and Security Rules" shall mean the Standards for Privacy of Individually Identifiable Health Information and Security Standards for the Protection of Electronic Protected Health Information in accordance with 45 CFR part 160 and part 164, subparts A and E. e. "Protected Health Information" shall have the same meaning as the term "protected health information" in 45 CFR 160.103, limited to the information created or received by Business Associate from or on behalf of Covered Entity. f. "Required By Law" shall have the same meaning as the term "required by law" in 45 CFR 164.103. g. "Secretary" shall mean the Secretary of the United States Department of Health and Human Services or his designee.