Orange County NC Website
Browse       Search
DocuSign Envelope ID:B749018F-351A-4D6F-9FC5-C2EB21856524 <br /> Consolidated Agreement FY22 Page 18 of 27 <br /> ATTACHMENT B <br /> BUSINESS ASSOCIATE ADDENDUM TO CONSOLIDATED AGREEMENT <br /> This Agreement is made effective July 1, 2021, by and between Orange County Health Department <br /> ("Covered Entity") and the North Carolina Department of Health and Human Services,Division of Public <br /> Health ("Business Associate") (collectively the "Parties"). <br /> 1. BACKGROUND <br /> a. Covered Entity and Business Associate are parties to a Memorandum of Understanding, entitled <br /> "FY 2022 Consolidated Agreement" (the "MOU"), whereby Business Associate agrees to perform <br /> certain services for or on behalf of Covered Entity. <br /> b. Covered Entity is an LHD in the State of North Carolina that has been designated in whole or in part by <br /> as a"covered entity" for purposes of the HIPAA Privacy Rule. <br /> c. The relationship between Covered Entity and Business Associate is such that the Parties believe <br /> Business Associate is or may be a"business associate"within the meaning of the HIPAA Privacy Rule. <br /> d. The Parties enter into this Business Associate Addendum to the MOU with the intention of complying <br /> with the HIPAA Privacy Rule provision that a covered entity may disclose protected health information <br /> to a business associate and may allow a business associate to create or receive protected heath <br /> information on its behalf, if the covered entity obtains satisfactory assurances that the business associate <br /> will appropriately safeguard the information. <br /> 2. DEFINITIONS <br /> Unless some other meaning is clearly indicated by the context, the following terms shall have the following <br /> meaning in this Agreement: <br /> a. "Electronic Protected Health Information" shall have the same meaning as the term"electronic protected <br /> health information" in 45 C.F.R. § 160.103. <br /> b. "HIPAA"means the Administrative Simplification Provisions, Sections 261 through 264, of the federal <br /> Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, as modified and <br /> amended by the Health Information Technology for Economic and Clinical Health ("HITECH") Act, <br /> Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of <br /> 2009, Public Law 111-5. <br /> c. "Individual" shall have the same meaning as the term "individual" in 45 C.F.R. § 160.103 and shall <br /> include a person who qualifies as a personal representative in accordance with 45 C.F.R. § 164.502(g). <br /> d. "Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health Information at <br /> 45 C.F.R. Part 160 and Part 164. <br /> e. "Protected Health Information" shall have the same meaning as the term "protected health information" <br /> in 45 C.F.R. § 160.103, limited to the information created or received by Business Associate from or on <br /> behalf of Covered Entity. <br /> f. "Required By Law" shall have the same meaning as the term"required by law" in 45 C.F.R. § 164.103. <br /> g. "Secretary" shall mean the Secretary of the United States Department of Health and Human Services or <br /> the person to whom the authority involved has been delegated. <br /> h. Unless otherwise defined in this Agreement, terms used herein shall have the same meaning as those <br /> terms have in the Privacy Rule. <br /> 3. OBLIGATIONS OF BUSINESS ASSOCIATE <br /> a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or <br /> required by this Agreement or as Required By Law. <br /> b. Business Associate agrees to use appropriate safeguards and comply, where applicable, with subpart C <br /> of 45 C.F.R. Part 164 with respect to electronic protected health information, to prevent use or <br /> disclosure of the Protected Health Information other than as provided for by this Agreement. <br />