HomeMy WebLinkAboutServe You Custom Prescription Management Account#: 3363
(Serve you.)
THE HAND-CRAFTED PBM
Business Associate Agreement
This HIPAA Business Associate Agreement ("Agreement") is made by and between City of Oshkosh
("Covered Entity"), and Serve You Custom Prescription Management, Inc. ("Business Associate") (each
a "Party" and collectively the "Parties").
1. BACKGROUND
Business Associate performs functions, activities or services for, or on behalf of Covered Entity
and Business Associate creates, receives, maintains, or transmits Protected Health Information ("PHI"),
including Electronic Protected Health Information ("EPHI"), in order to perform such functions, activities
or services. Covered Entity and Business Associate are subject to the Health Insurance Portability and
Accountability Act of 1996 ("HIPAA") and its implementing privacy, security, breach notification and
enforcement rules at 45 C.F.R. Parts 160 and 164 ("HIPAA Rules"), the applicable provisions of the
Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), and any future
implementing regulations and guidance issued by the Secretary. The HIPAA Rules require Covered
Entity and Business Associate to enter into an agreement to provide for the protection of the privacy
and security of PHI, including EPHI, before Business Associate is permitted to create, receive,
maintain, or transmit PHI on behalf of Covered Entity.
2. DEFINITIONS
Capitalized terms not otherwise defined herein shall have the same meaning as those terms in the
HIPAA Rules. Following are some of the key terms of this Agreement.
2.1 Individual. "Individual" shall have the same meaning as the term "individual" in 45 C.F.R.
§ 160.103 and shall include a person who qualifies as a personal representative in accordance with 45
C.F.R. § 164.502(g).
2.2 Limited Data Set. 'Limited Data Set" shall have the same meaning as a "limited data set"
described in 45 C.F.R. § 164.514(e)(2).
2.3 Minimum Necessary. "Minimum Necessary" shall have the same meaning as "minimum
necessary" described in 45 C.F.R. § 164.502(b).
2.4 Privacy Rule. "Privacy Rule" shall mean the Standards for Privacy of Individually
Identifiable Health Information at 45 C.F.R. Parts 160 and Part 164, subparts A and E.
2.5 Security Rule. "Security Rule" shall mean the Security Standards for the Protection of
EPHI at 45 C.F.R. Parts 160 and 164, subparts A and C.
2.6 Protected Health Information. "Protected Health Information" or "PHI" shall have the
same meaning as the term "protected health information" in 45 C.F.R. § 160.103, but shall be limited to
the information created, received, maintained, or transmitted by Business Associate from or on behalf
of Covered Entity.
2.7 Electronic Protected Health Information. "Electronic Protected Health Information" or
"EPHI" shall have the same meaning as the term "electronic protected health information" in 45 C.F.R.
Serve You Custom Prescription Management Business Associate Agreement Page-1
V25513
§ 160.103, but shall be limited to the EPHI that Business Associate creates, receives, maintains, or
transmits on behalf of Covered Entity.
2.8 Required By Law. "Required By Law" shall have the same meaning as the term
"required by law" in 45 C.F.R. § 164.103.
2.9 Secretary. "Secretary" shall mean the Secretary of the United States Department of
Health and Human Services or his designee.
2.10 Security Incident. "Security Incident" shall have the same meaning as "security incident"
in 45 C.F.R. § 164.304.
2.11 Subcontractor. "Subcontractor" shall have the same meaning as the term
"subcontractor" in 45 C.F.R. § 160.103.
3. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE
3.1 Use and Disclosure. Business Associate agrees to not use or further disclose PHI other
than as permitted or required by the Agreement or as Required By Law.
3.2 Safeguards. Business Associate agrees to use appropriate safeguards and comply,
where applicable, with 45 C.F.R. Part 164 Subpart C with respect to EPHI, to prevent use or disclosure
of the EPHI other than as provided for by this Agreement.
3.3 Mitigation. Business Associate agrees to mitigate, to the extent practicable, any harmful
effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in
violation of the requirements of this Agreement.
3.4 Reports of Non-Permitted Use or Disclosure. Business Associate agrees to promptly
report to Covered Entity any use or disclosure of PHI not provided for by this Agreement or permitted
by the HIPAA Rules.
3.5 Reports of Security Incidents. Business Associate agrees to promptly notify Covered
Entity of any Security Incident involving EPHI of which it becomes aware. Business Associate and
Covered Entity agree that this provision constitutes notice of attempted but unsuccessful Security
Incidents that do not result in any unauthorized access, use, disclosure, modification or destruction of
EPHI, or interference with an information system. For purposes of this Agreement, "Unsuccessful
Security Incidents" include activity such as pings and other broadcast attacks on Business Associate's
firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above,
so long as no such incident results in unauthorized access, use or disclosure of PHI.
3.6 Subcontractors. Business Associate agrees to ensure that any Subcontractor that
creates, receives, maintains, or transmits PHI on behalf of the Business Associate agrees to the same
restrictions and conditions that apply through this Agreement to Business Associate with respect to
such information, including but not limited to, compliance with the applicable requirements of 45 C.F.R.
Parts 160 and 164.
3.7 Designated Record Set.
(a) If Business Associate has PHI in a Designated Record Set, Business Associate
agrees to provide access, at the request of Covered Entity, to PHI in a Designated
Record Set, to Covered Entity or, as directed by Covered Entity, to an Individual in
order to meet the requirements under 45 C.F.R. § 164.524 within fifteen (15) days of
Serve You Custom Prescription Management Business Associate Agreement Page-2
V25513
receipt of a request. If Covered Entity requests an electronic copy of PHI that is
maintained electronically in a Designated Record Set in the Business Associate's
custody or control, Business Associate will provide an electronic copy in the form and
format specified by the Individual if it is readily producible in such format. If it is not
readily producible in such format, Business Associate will work with Covered Entity
and the Individual to determine an alternative form and format that enables Covered
Entity to meet its electronic access obligations under 45 C.F.R. § 164.524.
(b) If Business Associate has PHI in a Designated Record Set, Business Associate
agrees to make any amendment(s) to PHI in a Designated Record Set that Covered
Entity directs or agrees to pursuant to 45 C.F.R. § 164.526 at the request of Covered
Entity or an Individual.
3.8 Internal Practices. Business Associate agrees to make its internal practices, books, and
records relating to the use and disclosure of PHI received from, or created, received, maintained, or
transmitted by Business Associate on behalf of, Covered Entity available to the Secretary for purposes
of the Secretary determining Covered Entity's compliance with the HIPAA Rules.
3.9 Documentation of Disclosures.
(a) Business Associate agrees to document such disclosures of PHI and information
related to such disclosures as would be required for Covered Entity to respond to a
request by an Individual for an accounting of disclosures of PHI in accordance with
45 C.F.R. § 164.528. In accordance with HITECH and any future implementing
regulations and guidance issued by the Secretary, if Business Associate uses or
maintains an electronic health record with respect to PHI, Business Associate agrees
to document disclosures made through an electronic health record for treatment,
payment, or health care operations, and information related to such disclosures as
would be required for Covered Entity to respond to a request by an Individual for an
accounting of disclosures in accordance with 45 C.F.R. § 164.528.
(b) Business Associate agrees to provide to Covered Entity information collected in
accordance with Section 3.9(a) of this Agreement, to permit Covered Entity to
respond to a request by an Individual for an accounting of disclosures of PHI in
accordance with 45 C.F.R. § 164.528.
3.10 Business Associate's Obligations Related to Breach of Unsecured PHI.
(a) For purposes of this Section 3.10, "Breach" and "Unsecured PHI" shall have the
same meaning as "breach" and "unsecured protected health information,"
respectively, as such terms are defined by 45 C.F.R. § 164.402.
(b) Following the discovery of a Breach of Unsecured PHI, Business Associate shall
notify Covered Entity of the Breach. Such notification shall be made without
unreasonable delay after discovering the Breach, but no later than sixty (60)
calendar days after its discovery.
(c) Business Associate's notice shall include, to the extent possible, the information set
forth at 45 C.F.R. § 146.410(c).
3.11 Carrying Out Obligations of Covered Entity. To the extent the Business Associate is to
carry out Covered Entity's obligation(s) under the Privacy Rule, Business Associate shall comply with
Serve You Custom Prescription Management Business Associate Agreement Page-3
V25513
the requirements of the Privacy Rule that apply to the Covered Entity in the performance of such
obligation.
3.12 Prohibition on the Sale of PHI or Electronic Health Records. Business Associate shall
comply with 45 C.F.R. § 164.502(a)(5), which relates to the prohibition on the sale of electronic health
records and PHI.
3.13 Conditions on Certain Marketing and Fundraising Contacts. Business Associate shall
not use or disclose PHI for marketing or fundraising without consent of Covered Entity and only to the
extent permitted by 45 C.F.R. §§ 164.508(a)(3) and 164.514(f).
4. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE
4.1 General Use and Disclosure. Except as otherwise limited in this Agreement, Business
Associate may use or disclose PHI to perform functions, activities, or services for, or on behalf of,
Covered Entity as such services may be specified in any underlying agreement(s), provided that such
use or disclosure would not violate the Privacy Rule if done by Covered Entity.
4.2 Specific Use and Disclosure.
(a) Business Associate may use or disclose PHI for the proper management and
administration of Business Associate and to carry out its legal obligations, provided
that disclosures are Required by Law, or Business Associate obtains reasonable
assurances from the person to whom the information is disclosed that it will remain
confidential and used or further disclosed only as Required by Law or for the purpose
for which it was disclosed to the person, and the person notifies Business Associate
of any instances of which it becomes aware in which the confidentiality of the
information has been breached.
(b) Business Associate may use PHI to provide Data Aggregation services to Covered
Entity as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B).
(c) Business Associate may use PHI to create de-identified information in accordance
with the requirements outlined in the Privacy Rule. Data that has been de-identified
will no longer be subject to the terms of this Agreement.
(d) Business Associate may use PHI to report violations of law to appropriate state and
federal authorities, to the extent permitted or required by 45 C.F.R. § 164.502(j)(1)
and state law.
4.3 Minimum Necessary. All uses and disclosures of PHI must comply with the minimum
necessary requirements under the Privacy Rule. The Party disclosing PHI shall determine what
constitutes the minimum necessary to accomplish the intended purpose of the disclosure. Until the
effective date of further guidance or regulations issued on the meaning of minimum necessary,
Business Associate shall use a Limited Data Set when using, disclosing, and requesting PHI, to the
extent practicable. If using a Limited Data Set is not practicable, any use, disclosure, or request of PHI
must be limited to the Minimum Necessary to accomplish the intended purpose of the use, disclosure,
or request. After the effective date of subsequent implementing guidance and/or regulations on the
meaning of Minimum Necessary, Business Associate shall comply with such guidance or regulations.
Serve You Custom Prescription Management Business Associate Agreement Page-4
V25513
5. OBLIGATIONS OF COVERED ENTITY
5.1 Privacy Practices. Covered Entity shall provide Business Associate with the notice of
privacy practices that Covered Entity produces in accordance with 45 C.F.R. § 164.520, and shall
promptly provide Business Associate with any changes to such notice.
5.2 Notice of Changes and Restrictions. Covered Entity shall notify Business Associate of
any changes in, or revocation of, permission by Individual to use or disclose PHI, to the extent such
changes affect Business Associate's permitted or required uses and disclosures. Such notification
shall include any restriction that Covered Entity has agreed to in accordance with 45 C.F.R. § 164.522.
If Business Associate receives a request to restrict the disclosure of PHI directly from an Individual,
Business Associate shall notify Covered Entity of such request and Covered Entity shall be responsible
for making the determination, in accordance with the Privacy Rule, as to whether Business Associate
shall comply with the Individual's request.
5.3 Permissible Requests by Covered Entity. Covered Entity shall not request Business
Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if
done by Covered Entity, except that Business Associate may use or disclose PHI as set forth in Section
4.2.
5.4 Other Business Associates. Covered Entity shall require that all of its business
associates agree in writing to similar terms and conditions as are contained in this Agreement in
accordance with the HIPAA Rules. Covered Entity may request Business Associate to Disclose Health
Information to other business associates of Covered Entity. Such requests must be made in writing,
specify the authorized recipient (i.e., name of other business associate), and the nature and duration of
the Disclosure. Covered Entity represents and warrants that any requests made pursuant to this
Section 5.4 are permissible under the HIPAA Rules by virtue of a business associate relationship
having been established between the Covered Entity and other business associate.
6. TERM AND TERMINATION
6.1 Term. This Agreement shall be effective upon execution by the Parties and shall
remain in effect for the duration of the relationship, functions or services giving rise to the necessity of a
Business Associate Agreement, and until all of the PHI provided by Covered Entity to Business
Associate, or created, received, maintained, or transmitted by Business Associate on behalf of Covered
Entity, is destroyed or returned to Covered Entity, or, if it is infeasible to return or destroy PHI,
protections are extended to such information, in accordance with the termination provisions in this
Section 6.
6.2 Termination.
(a) Termination Resulting from the End of Relationship, Functions or Services. This
Agreement shall terminate in the event that the underlying relationship, functions, or
services that give rise to the necessity of a Business Associate Agreement terminate
for any reason.
(b) Termination for Cause. Upon either Party's knowledge of a material breach of this
Agreement by the other Party, the non-breaching Party must provide an opportunity
for the breaching Party to cure the breach or end the violation, and if the breaching
Party does not cure the breach or end the violation within thirty (30) days of the
breach, the non-breaching Party shall terminate this Agreement and any underlying
agreement(s).
Serve You Custom Prescription Management Business Associate Agreement Page-5
V25513
6.3 Return or Destruction of PHI.
(a) Except as provided in paragraph (b) of this Section 6.3, upon termination of this
Agreement for any reason, Business Associate shall return or destroy all PHI all PHI
created, received, maintained, or transmitted by Business Associate from or on
behalf of the Covered Entity.
(b) In the event that Business Associate determines that returning or destroying the PHI
is infeasible, Business Associate shall extend the protections of this Agreement to
such PHI and limit further uses and disclosures of such PHI to those purposes that
make the return or destruction infeasible, for so long as Business Associate
maintains such PHI.
MISCELLANEOUS
7.1 Regulatory References. A reference in this Agreement to a section in the HIPAA Rules
or HITECH, or any other reference to a law or regulation, means the section or law as in effect as of the
date of this Agreement or as subsequently amended.
7.2 Amendment. The Parties agree to take such action as is necessary to amend this
Agreement from time to time to comply with the requirements of the HIPAA Rules or HITECH.
7.3 Survival. The respective rights and obligations of Business Associate under Sections
6.3, 7.8 and 7.10 of this Agreement shall survive the termination of this Agreement.
7.4 Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning
that permits compliance with the HIPAA Rules and HITECH.
7.5 Relationship to Other Agreement Provisions. In the event that a provision of this
Agreement is contrary to a provision of an underlying agreement or agreements under which Covered
Entity discloses PHI to Business Associate, the provision of this Agreement shall control. Otherwise,
this Agreement shall be construed under, and in accordance with, the terms of such underlying
agreement or agreements between the Parties.
7.6 Prior Business Associate Agreements. Consistent with Section 7.5, this Agreement shall
supersede any and all prior business associate agreement(s), addenda, exhibits or similar provisions
thereof.
7.7 Modification of Agreement. No alteration, amendment or modification of the terms of this
Agreement shall be valid or effective unless in writing and signed by Business Associate and Covered
Entity.
7.8 Relationship of Parties. Business Associate, in furnishing services to Covered Entity, is
acting as an independent contractor, and Business Associate has the sole right and obligation to
supervise, manage, contract, direct, procure, perform or cause to be performed, all work to be
performed by Business Associate under this Agreement. Business Associate is not an agent of
Covered Entity, and has no authority to represent Covered Entity as to any matters, except as
expressly authorized in this Agreement.
7.9 Notices. Any notices required or permitted to be given under this Agreement by either
Party shall be given in writing: (a) by personal delivery; (b) by electronic facsimile with confirmation
sent by United States first class mail; (c) by bonded courier or nationally recognized overnight delivery
service; or (d) by United States first class registered or certified mail, postage prepaid, return receipt
Serve You Custom Prescription Management Business Associate Agreement Page-6
V25513
requested, addressed to the Parties at the addresses set forth in Section 17.2 of the Self-Funded
Prescription Drug Program Agreement or to such other addresses as the Parties may request in writing
by notice pursuant to this Section 7.9. Notices shall be deemed received on the earliest of personal
delivery, upon the next business day after delivery by electronic facsimile with confirmation that the
transmission was completed or upon receipt by any other method of delivery.
7.10 Applicable Law. This Agreement shall be governed by and construed in accordance with
the internal laws of the State of Wisconsin.
BUSINESS ASSOCIATE COVERED ENTITY
SERVE YOU
CUSTOM PRESCRIPTION MANAGEMENT, CITY OF OSHKOSH
INC.
BY: (3'417- - BY: 4 —
Vice
n Ray Mark /€o Mo rT
• -sident nt of Finance
Print Name
C y �uqnQy €r
Title
DATE: ,Z -12- / l DATE: ZI 7 111-1
Serve You Custom Prescription Management Business Associate Agreement Page-7
V25513