2019-303-E Emergency Svc - NCHIEA participation agreement

Browse Search

36 Attachment 5 Business Associate Agreement This Business Associate Agreement (“BAA”) is made effective on the date of execution by both parties of the Participation Agreement, by and between ______________________________________________________________ (name of Participant) (“Covered Entity”) and the North Carolina Health Information Exchange Authority (“Business Associate”) (collectively the “Parties”). 1. BACKGROUND a. Covered Entity and Business Associate are parties to the NC HIEA Full Participation Agreement for NC HealthConnex Access and Data Use (the “Participation Agreement”), whereby Business Associate agrees to perform certain services for or on behalf of Covered Entity. b. The relationship between Covered Entity and Business Associate is such that the Parties believe Business Associate is or may be a “business associate” within the meaning of the HIPAA Privacy Rule. c. The Parties enter into this Business Associate Addendum to the Participation Agreement with the intention of complying with the HIPAA Privacy Rule provision that a covered entity may disclose protected health information to a business associate, and may allow a business associate to create or receive protected heath information on its behalf, if the covered entity obtains satisfactory assurances that the business associate will appropriately safeguard the information. 2. DEFINITIONS Unless some other meaning is clearly indicated by the context, the following terms shall have the following meaning in this BAA: a. “Electronic Protected Health Information” shall have the same meaning as the term “electronic protected health information” in 45 C.F.R. § 160.103. b. “HIPAA” means the Administrative Simplification Provisions, Sections 261 through 264, of the federal Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, as modified and amended by the Health Information Technology for Economic and Clinical Health (“HITECH”) Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009, Public Law 111-5. c. “Individual” shall have the same meaning as the term “individual” in 45 C.F.R. § 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 C.F.R. § 164.502(g). d. “Privacy Rule” shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 C.F.R. Part 160 and Part 164. e. “Protected Health Information” shall have the same meaning as the term “protected health information” in 45 C.F.R. § 160.103, limited to the information created or received by Business Associate from or on behalf of Covered Entity. f. “Required By Law” shall have the same meaning as the term “required by law” in 45 C.F.R. § 164.103. g. “Secretary” shall mean the Secretary of the United States Department of Health and Human Services or the person to whom the authority involved has been delegated. h. Unless otherwise defined in this BAA, terms used herein shall have the same meaning as those terms have in the Privacy Rule. 3. OBLIGATIONS OF BUSINESS ASSOCIATE a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this BAA, the Participation Agreement, or as Required By Law. b. Business Associate agrees to use appropriate safeguards and comply, where applicable, with subpart C of 45 C.F.R. Part 164 with respect to electronic protected health information, to prevent use or disclosure of the Protected Health Information other than as provided for by this BAA. c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this BAA. Orange County, North Carolina by and through its "Emergency Services Department" DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC