Loading...
HomeMy WebLinkAboutC-6182 - Business Associate Agreement C)0 BUSINESS ASSOCIATE AGREEMENT BETWEEN SHIRA A. SCHLESINGER, MD, MPH, PC AND CITY OF NEWPORT BEACH is entered this 18TH THIS BUSINESS ASSOCIATE AGREEMENT ("Agreement") day of December 2014 ("Effective Date") between THE CITY OF NEWPORT BEACH, a California municipal corporation and charter city ("City') and SH IRA A. SCHLESINGER, MD, MPH, PC, a California sole proprietor ("Evaluator"), whose address is 3044 E. 5th Street Long Beach, California 90814, and is made with reference to the following: RECITALS A. City is a municipal corporation duly organized and validly existing under the laws of the State of California with the power to carry on its business as it is now being conducted under the statutes of the State of California and the Charter of the City. B. Evaluator is an independent contractor of the City tasked with assisting the Orange County Fire Chiefs Association, Newport Beach Fire Department (NBFD), and other members of the Orange County Alternate Destination Community Paramedicine Project Advisory Council (Advisory Council) in fulfillment of the requirements of the California EMS Authority (EMSA) as an approved Pilot Site for the California Office of Statewide Health Planning and Development (OSHPD) approved Community Paramedicine pilot project. The purpose of the project is to determine whether paramedics working in an expanded role in their community can help improve health system integration, efficiency, and/or fill identified health care needs. The Pilot Project will allow the Newport Beach Fire Department, Orange County EMS Agency (OCEMS) and the EMSA to generate, collect and analyze data that will examine the practice of community paramedicine and serve as a basis to recommend changes to existing statutes and regulations to allow transport of patients with specified conditions that can be managed in health care settings to alternate locations other than an acute care emergency department, such as an urgent care or general medical clinic. C. The Evaluator will work in a volunteer capacity with the NBFD and the Advisory Council to collect, maintain, and analyze data on EMS responses who are deemed potentially eligible for Alternate Destination Transport, or who were transported to an Alternate Destination (Urgent Care Clinic) as part of the Alternate Destination Pilot Project. Evaluator shall accomplish this by accessing, collecting, and maintaining patient care and billing data on patients meeting criteria for the study, contacting the hospitals and billing company to collect financial transport data, and reporting patient care, hospital outcomes, and billing data to the California EMSA on behalf of the Fire Department, in accordance with the Fire Department's obligation to meet reporting requirements as a Community Paramedicine Pilot Project site. D. This Agreement is executed to ensure that Evaluator will appropriately safeguard protected health information ("PHI") that is created, received, maintained, or transmitted on behalf of the City in compliance with the applicable provisions of Public Law 104-191 of August 21, 1996, known as the Health Insurance Portability and Accountability Act of 1996, Subtitle F — Administrative Simplification, Sections 261, et seq., as amended ("HIPAA"), the regulations codified at 45 C.F.R. Parts 160 and 164 ("HIPAA Regulations"), and with Public Law 111-5 of February 17, 2009, known as the American Recovery and Reinvestment Act of 2009, Title XII, Subtitle D — Privacy, Sections 13400, et seq., the Health Information Technology and Clinical Health Act, as amended (the "HITECH Act"). NOW, THEREFORE, it is mutually agreed by and between the undersigned parties as follows: A. General Provisions 1. Meaning of Terms. The terms used in this Agreement shall have the same meaning as those terms defined in the HIPAA, the HIPAA Regulations, and the HITECH Act. 2. Regulatory References. Any reference in this Agreement to a regulatory section means the section currently in effect or as amended. 3. Interpretation. Any ambiguity in this Agreement shall be interpreted to permit compliance with the HIPAA, the HIPAA Regulations, and the HITECH Act. B. Obligations of Business Associate 1. Evaluator shall not use or further disclose protected health information ("PHI") other than as permitted or required by this Agreement or as required by law. 2. Evaluator shall use appropriate safeguards and comply, where applicable, with the HIPAA Security Rule with respect to electronic protected health information ("e-PHI") and implement appropriate physical, technical and administrative safeguards to prevent use or disclosure of PHI other than as provided for by this Agreement. 3. Evaluator shall report in writing to City each security incident (as defined in the HIPAA Security Rule) or any use or disclosure of PHI not provided for by this Agreement no later than three (3) business days after becoming aware of such security incident or non-permitted use or disclosure. If such security incident or non-permitted use or disclosure constitutes a breach of unsecured SHIRA A. SCHLESINGER, MD, MPH, PC Page 2 PHI, then Evaluator shall comply with the requirements of Section (13)(4) below. 4. Evaluator shall investigate each unauthorized access, acquisition, use or disclosure of PHI that it discovers to determine whether such unauthorized access, acquisition, use or disclosure constitutes a reportable breach of unsecured PHI. If Evaluator determines that a reportable breach of unsecured PHI has occurred, Evaluator shall notify City of such breach in writing without unreasonable delay but no later than sixty (60) calendar days after discovery of the breach, in accordance with 45 C.F.R. §164.410(c). City shall have sole control over the timing and method of providing notification of such breach to the affected individual(s), the Secretary of the Department of Health and Human Services and, if applicable, the media, as required by the HITECH Act. Evaluator shall reimburse City for its reasonable costs and expenses in providing the notification, including, but not limited to, any administrative costs associated with providing notice, printing and mailing costs, and costs of mitigating the harm (which may include the costs of obtaining credit monitoring services and identity theft insurance) for affected individuals whose PHI has or may have been compromised as a result of the breach. 5. In accordance with 45 CFR 164.502(e)(1) and 164.308(b), ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Evaluator agree to the same restrictions, conditions, and requirements that apply to Evaluator with respect to such information. 6. Make PHI in a designated record set available to City and to an individual who has a right of access in a manner that satisfies the City's obligations to provide access to PHI in accordance with 45 CFR §164.524 within thirty (30) days after receipt of a request. 7. Make any amendment(s) to PHI in a designated record set as directed by the City, or take other measures necessary to satisfy the City's obligations under 45 CFR §164.526. 8. Maintain and make available information required to provide an accounting of disclosures to the City or an individual who has aright to an accounting within sixty (60) days and as necessary to satisfy the City's obligations under 45 CFR §164.528. 9. To the extent that Evaluator is to carry out any of the City's obligations under the HIPAA Privacy Rule, Evaluator shall comply with the requirements of the Privacy Rule that apply to the City when it carries out that obligation. 10.Make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by Evaluator on behalf of the City, SHIRA A. SCHLESINGER, MD, MPH, PC Page 3 available to the Secretary of the Department of Health and Human Services for purposes of determining Evaluator's and City's compliance with HIPAA, the HIPAA Regulations, and the HITECH Act. 11.Restrict the use or disclosure of PHI if the City notifies Evaluator of any restriction on the use or disclosure of PHI that the City has agreed to or is required to abide by under 45 CFR §164.522. 12.If the City is subject to the Red Flags Rule (found at 16 CFR §681.1 et seq.), Evaluator agrees to assist the City in complying with its Red Flags Rule obligations by: (a) implementing policies and procedures to detect relevant Red Flags (as defined under 16 C.F.R. §681.2); (b) taking all steps necessary to comply with the policies and procedures of the City's Identity Theft Prevention Program; (c) ensuring that any agent or third party who performs services on its behalf in connection with covered accounts of the City agrees to implement reasonable policies and procedures designed to detect, prevent, and mitigate the risk of identity theft; and (d) alerting the City of any Red Flag incident (as defined by the Red Flag Rules) of which it becomes aware, the steps it has taken to mitigate any potential harm that may have occurred, and provide a report to the City of any threat of identity theft as a result of the incident. C. Permitted Uses and Disclosures by Business Associate The specific uses and disclosures of PHI that may be made by Evaluator on behalf of the City include: 1. Extract information from Fire Department's electronic Patient Care Records on all patients who meet Primary Impression criteria for the Alternate Destination Pilot Project. 2. Maintain database of all patients who meet Primary Impression criteria for the Alternate Destination Pilot Project. 3. Deliver a monthly list of eligible Alternate Destination patient candidates to the Orange County EMS Agency for hospital outcomes follow-up, as permitted for Quality Assurance purposes. 4. Deliver a monthly list of eligible Alternate Destination patient candidates to the Fire Department's billing agency for collection of transport charges and claims data. 5. Contact the billing company on behalf of the Fire Department in order to discuss reporting of transport charges and claims data. SHIRA A. SCHLESINGER, MD, MPH, PC Page 4 6. Collect and maintain transport and billing data for all transported patients who meet criteria for Alternate Destination Pilot Project participation. 7. Collect and maintain database of patient care and billing data on patients transported to Alternate Destination sites (Urgent Care Clinics) as part of the Alternate Destination Pilot Project. 8. Report patient care, hospital outcomes, and billing data to the California EMSA on behalf of the Fire Department, and in accordance with the Fire Department's obligation to meet reporting requirements as a Community Paramedicine Pilot Project site. 9. Report aggregate data on eligible patients from NBFD and other participating fire departments, number of eligible patients, ambulance disposition, and transport costs from pre-implementation/baseline period, to NBFD, Huntington Beach Fire Department, Fountain Valley Fire Department and Advisory Council. For this purpose, only aggregate data will be shared with the other Fire Departments. No proprietary or individual patient data will be disclosed as part of this report. D. Relationship of Parties 1. Evaluator is an independent contractor and not an agent of City under this Agreement. Evaluator has the sole right and obligation to supervise, manage, contract, direct, procure, perform or cause to be performed all of Evaluator's obligations under this Agreement. E. Indemnification 1. At Evaluator's expense, Evaluator agrees to indemnify, defend and hold harmless City and City's employees, directors, officers, managers, or agents (the "Indemnities") from and against any and all fines, penalties, damages, losses, claims or causes of action and expenses (including, without limitation, court costs and reasonable attorneys' fees) arising from any violation of the HIPAA, the HIPAA Regulations, or the HITECH Act or from any negligence or wrongful acts or omissions, including but not limited to failure to perform its obligations that results in a violation of the HIPAA, the HIPAA Regulations, or the HITECH Act, by Evaluator or its employees, directors, officers, subcontractors, agents or other members of Evaluator's workforce. Evaluator's obligation to indemnify the Indemnities shall survive the expiration or termination of this Agreement for any reason. SHIRA A. SCHLESINGER, MD, MPH, PC Page 5 F. Term and Termination 1. The term of this Agreement shall be effective as of the Effective Date and shall terminate as of the date that all of the PHI provided by City to Evaluator, or created or received by Evaluator on behalf of City, is destroyed or returned to City, or, if it is infeasible to return or destroy the PHI, protections are extended to such information, in accordance with Section (F)(3) below. 2. Upon City's knowledge of a material breach or violation of this Agreement by Evaluator, City shall either: a. Notify Evaluator of the breach in writing, and provide an opportunity for Evaluator to cure the breach or end the violation within ten (10) business days of such notification; provided that if Evaluator fails to cure the breach or end the violation within such time period to the satisfaction of City, City shall have the right to immediately terminate this Agreement and the underlying services agreement between City and Evaluator upon written notice to Evaluator; b. Upon written notice to Evaluator, immediately terminate this Agreement and the underlying services agreement between City and Evaluator if City determines that such breach cannot be cured; or C. If City determines that neither termination nor cure is feasible, City shall report the violation to the Secretary of the Department of Health and Human Services. 3. Upon termination of this Agreement for any reason, Evaluator shall return to the City or destroy all PHI received from the City, or created, maintained, or received by Evaluator on behalf of the City that Evaluator still maintains in any form. Evaluator shall retain no copies of the PHI. However, if Evaluator determines that neither return nor destruction of PHI is feasible, Evaluator shall notify City of the conditions that make return or destruction infeasible, and may retain PHI provided that Evaluator: (a) continues to comply with the provisions of this Agreement for as long as it retains PHI, and (b) further limits uses and disclosures of such PHI to those purposes that make the return or destruction of PHI infeasible. G. Notices 1. All notices, demands, requests or approvals to be given under the terms of this Agreement shall be given in writing, and conclusively shall be deemed served when delivered personally, or on the third business day after the deposit thereof in the United States mail, postage prepaid, first-class mail, addressed as hereinafter provided. All notices, demands, requests or approvals from Evaluator to City shall be addressed to City at: SHIRA A. SCHLESINGER, MD, MPH, PC Page 6 Attn: Cathy Ord, EMS Manager Fire Department City of Newport Beach 100 Civic Center Drive PO Box 1768 Newport Beach, CA 92658 2. All notices, demands, requests or approvals from City to Evaluator shall be addressed to Evaluator at: SHIRA A. SCHLESINGER, MD, MPH, PC 3044 E. 51" Street Long Beach, CA 90814 H. Amendment to Comply with Law 1. This Agreement shall be deemed amended to incorporate any mandatory obligations of City or Evaluator under the HITECH Act and it's implementing HIPAA Regulations. Additionally, City and Evaluator agree to take such action as is necessary to amend this Agreement from time to time as necessary for City to implement its obligations pursuant to the HIPAA, the HIPAA Regulations, or the HITECH Act. I. Applicable Law and Venue 1. This Agreement shall be governed by and construed in accordance with the laws of the State of California (without regards to conflict of laws principles). City and Evaluator agree that all actions or proceedings arising in connection with this Agreement shall be tried and litigated exclusively in the State or federal (if permitted by law and if a party elects to file an action in federal court) courts located in Orange County, California. J. Counterparts This Agreement may be executed in two or more counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. [SIGNATURES ON NEXT PAGE] SHIRA A. SCHLESINGER, MD, MPH, PC Page 7 IN WITNESS WHEREOF, the parties have caused this Agreement to be executed on the dates written below. APPROVED AS TO FORM: CITY OF NEWPORT BEACH, OFFICE OFJHCITY ATTORNEY A California municipal corporation Date: k S Date:_ APR29 2015 By: By: _ �L Aa o . Harp Omi hr Chief Scoflos er City Attorney Fire Department ATTEST: SHIRA A. SCHLESINGER, MD, MPH, PC, a California So Proprietor Date: �� ��N Date: / Zo/J� By: By: ��i�i Leilani I. B own ra c singer, MD, MPH, PC City Clerk Sole Proprietor _F R1 U n 9��FORN�P SHIRA A. SCHLESINGER, MD, MPH, PC Page 8