Business Associate Agreement (BAA)

Purpose:

This agreement establishes the terms and conditions under which SHS will provide services to Covered Entity while ensuring compliance with HIPAA and HITECH Act requirements for the protection of Protected Health Information (PHI).

Key Terms:

• "Protected Health Information" (PHI): Individually identifiable health information
• "Electronic Protected Health Information" (ePHI): PHI that is transmitted by or maintained in electronic media
• "Covered Entity": A health plan, health care clearinghouse, or health care provider
• "Business Associate": A person or entity that performs certain functions involving PHI
• "Secretary": The Secretary of the Department of Health and Human Services
• "Security Incident": The attempted or successful unauthorized access, use, disclosure, modification, or destruction of information

Business Associate agrees to:

• Use and Disclosure: Not use or disclose PHI other than as permitted or required by this Agreement or as required by law
• Safeguards: Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to ePHI, to prevent use or disclosure of PHI other than as provided for by this Agreement
• Reporting: Report to Covered Entity any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, including any Security Incident or Breach of Unsecured PHI
• Subcontractors: Ensure that any subcontractors who create, receive, maintain, or transmit PHI on behalf of the Business Associate agree in writing to the same restrictions and conditions that apply to Business Associate under this Agreement
• Access: Make PHI available to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 CFR 164.524
• Amendment: Make PHI available for amendment and incorporate any amendments as required under 45 CFR 164.526
• Accounting: Make available the information required to provide an accounting of disclosures in accordance with 45 CFR 164.528
• Compliance: Make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining compliance
• Return/Destruction: Upon termination of this Agreement, return or destroy all PHI received from, or created or received on behalf of, Covered Entity, retaining no copies unless required by law

Permitted Activities:

• Service Performance: Use or disclose PHI as necessary to perform services for Covered Entity under the Service Agreement
• Management: Use PHI for proper management and administration of the Business Associate or to carry out its legal responsibilities
• Required Disclosures: Disclose PHI for proper management and administration of the Business Associate, provided the disclosures are required by law, or Business Associate obtains reasonable assurances that the PHI will remain confidential

Covered Entity Responsibilities:

• Permissible Requests: Not request Business Associate to use or disclose PHI in any manner that would not be permissible under HIPAA if done by Covered Entity
• Notice Limitations: Notify Business Associate of any limitations in its notice of privacy practices
• Permission Changes: Notify Business Associate of any changes in, or revocation of, permission by an individual to use or disclose PHI
• Restrictions: Notify Business Associate of any restriction on the use or disclosure of PHI to which Covered Entity has agreed

Agreement Terms:

• Term: This Agreement shall be effective as of the Effective Date and shall terminate when all PHI is returned or destroyed
• Termination for Cause: Covered Entity may terminate this Agreement if it determines that Business Associate has violated a material term
• Effect of Termination: Upon termination, Business Associate shall return or destroy all PHI. If return or destruction is infeasible, Business Associate shall extend protections to such PHI

Additional Provisions:

• Regulatory References: A reference in this Agreement to HIPAA or the HITECH Act means the law as amended
• Amendment: The parties agree to take necessary action to amend this Agreement to comply with changes in the law
• Survival: The obligations of Business Associate under this Agreement shall survive termination
• Governing Law: This Agreement shall be governed by and construed under the laws of the State of Delaware