ROWAN UNIVERSITY POLICY
Title: Disclosures of Personally Identifiable Health Information to Business Associates
Subject: Office of Compliance & Corporate Integrity (OCCI)
Policy No: OCCI: 2013: P08
Issuing Authority: Rowan President & RowanSOM Dean
Responsible Authority: RowanSOM Chief Compliance and Privacy Officer & Rowan Security Officer
Adopted: April 14, 2003
Amended: July 1, 2013.
Reviewed: Dec 30, 2014
To assure compliance with the requirements of the Health Insurance Portability and Accountability Act (HIPAA) of 2004, Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 and the Omnibus Privacy Final Rule of 2013 in relation to disclosures of Protected Health Information (PHI) and to entering into contracts with business associates.
Under the direction of the President, the Deans, Executive Vice President for Administration and Strategic Planning, Executive Vice President for Academic and Clinical Affairs, Chief Compliance and Privacy Officer, Vice President for Finance and CFO and General Counsel shall ensure compliance with this policy.
This policy shall apply to disclosures to business associates of health information that is generated during provisions of health care to patients in any of the RowanSOM's patient care units, patient care centers of faculty practices as well as Human Subjects research under the auspices of RowanSOM or by any of its agents in all RowanSOM, Units, Departments and University owned or operated facilities.
A. "Protected Health Information (PHI)" - Protected health information means individually identifiable health information that relates to the past, present or future physical or mental health or condition of an individual, the provision of health care to an individual or the past, present or future payment for the provision of health care to an individual and identifies or could reasonably be used to identify the individual. PHI of a decedent, who has been deceased for more than 50 years, is no longer considered protected PHI [160.103 and 164.502(f)].
B. "Business Associates (BA)" – Entity that "creates, receives, maintains, or transmits" PHI on behalf of the CE [Patient Safety and Quality Improvement Act (PSQIA) of 2005, 42 U.S.C. 299b-22, et seq.]. The BA now has direct liability for compliance with this rule (164.500), including implementing and operating Minimum Necessary [164.502(b)]. A Subcontractor is a person, who the BA has delegated a function, activity or services that the BA has agreed to perform on behalf of the CE (160.103). Subcontractors must also comply with the privacy and security rules under the BA Agreement [164.504(e)(4)(ii)(B)]. The CE and BA are obligated to assess, administer and monitor of the organizations "downstream" from the CE that manage PHI. The BA is required to enter into a BA Agreement (BAA) with the subcontractor, not the CE and subcontractor. person other than in the capacity of a member of the workforce that on behalf of RowanSOM, its units, or any organized health care arrangement in which it participates, performs or assists in the performance of:
C. "Workforce" – Faculty, employees, students, volunteers, trainees, and other persons whose conduct, in the performance of work for RowanSOM and/or its units, is under the direct control of such entity(ies), whether or not they are paid by Rowan University SOM.
D. "HITECT ACT" - Section 13402 of the Health Information Technology for Economic and Clinical Health (HITECH) Act, part of the American Recovery and Reinvestment Act of 2009 (ARRA) that was enacted on February 17, 2009.
A. 45 CFR 160.103(a), Code of Federal Regulations, Title 45, Part 164, Section 103, Subpart A, General Administrative Requirements, General Provisions, Definitions
B. 45 CFR 164.501(e), Code of Federal Regulations, Title 45, Part 164, Section 501, Subpart E, Security and Privacy, Definitions, Privacy of Individually Identifiable Health Information
C. 45 CFR 164.502(e), Code of Federal Regulations, Title 45, Part 164, Section 502, Subpart E, Security and Privacy, Uses and Disclosures of Protected Health Information: General Rules, Privacy of Individually Identifiable Health Information
D. 45 CFR 164.504(e), Code of Federal Regulations, Title 45, Part 164, Section 504, Subpart E, Security and Privacy, Uses and Disclosures: Organizational Requirements, Privacy of Individually Identifiable Health Information
E. 45 CFR 164.532 (d) and (e), Code of Federal Regulations, Title 45, Part 164, Section 532, Subpart E, Security and Privacy, Uses and disclosures: Organizational requirements, Privacy of Individually Identifiable Health Information and (d) Standard: Effect of Prior Contracts or Other Arrangements with Business Associates
F. Section 13404 and 13410(d) of the HITECH Act - Breach Notification Interim Final Regulation (74 FR 42740) - August 2009.
G. Uses and Disclosures of Health Information With and Without an Authorization
H. Omnibus Privacy Final Rule 2013
I. Standards for Privacy of Individually Identifiable Health Information
By Direction of the President:
Signature on file
RowanSOM Chief Compliance and Privacy Officer
By Direction of the President:
Signature on file
Rowan Security Officer
Is a Person or Entity a "Business Associate" and
Required to Enter Into a Written Business Associate Contract?
Examples of Potential Business Associates
(This is not an all-inclusive list, nor is every arrangement listed necessarily a business associate. Use the attached flowchart and policy and procedure to analyze whether the relationship is a business associate relationship under HIPPA. Contact Legal Management at 2-4705 for assistance in the analysis.)
Accounting services and firms
Architects, builders, and contractors
Asset-based lenders to healthcare facilities
Billing service companies
Bulk mailing services
Care management programs
Civic groups and other local groups help out on ad hoc basis with patients who are hospitalized for a traumatic event or complicated illness (e.g., Shrine Temples, Ronald McDonald House)
Coding providers and experts
Community health management information systems
Computer maintenance services and companies
Contract Research Organization – An entity used by pharmaceutical and device manufactures to monitor clinical research trials
Data aggregation services
Document storage and destruction vendors
Financial service companies
Government health data systems
Healthcare consultants (e.g., risk management, information technology, billing, coding and management)
Hospital associations (National and State)
ATTACHMENT 2 (continued)
Examples of Potential Business Associates
Independent service organizations (ISO) offering clinical/biomedical engineering services
Interpreter services (both deaf and foreign language)
Janitorial services; waste disposal and recycling services and companies
Law firms, its staff and employees
Marketing services or firms
Medical equipment testing/ repair services
Medical or Physician associations (National and State)
Medical record moving companies
Medical record storage companies
Medical record transcription services
Medical software vendors
Microfilm conversion providers
Organ and Tissue Banks
Organ procurement organization
Outsourced document shredders
Plasma Donor Centers
Printing companies (ID cards and other member materials)
Private health data systems
Professional liability insurance carriers
Recycling services and companies
Temporary Staffing Companies
Utilization management vendors
Value added networks
Vendors to business associates if involving the disclosure of independently identifiable health information
Waste disposal services and companies
Treatment, Payment and Health Care Operations
A."Treatment" - the provision, coordination, or management of health care and related services by one or more health care providers, including:
B."Payment" - the activities undertaken to obtain payment for the provision of healthcare; and relates to the individual to whom health care is provided and includes, but is not limited to:
C."Health Care Operations" - any of the following activities:
Business Associates Agreement Involving the Access to Protected Health Information
This Business Associate Agreement
Is Related To and a Part of the Following
Effective Date of Underlying Agreement:_________
Business Associate Agreement
Involving the Access to Protected Health Information
This Business Associate Agreement ("BAA") is entered into between RowanSOM - [Name of School/Department/Unit]("Rowan University"), a body corporate and politic of the State of New Jersey having its principal administrative offices at 40 East Laurel Road, UEC Bldg. Suite # 1031, Stratford, NJ 08084 (hereinafter referred to as "Covered Entity") and [Name and Address of Contracting Party] (hereinafter referred to as "Business Associate") (the "Covered Entity" and "Business Associate" hereinafter collectively referred to as the "Parties"). Any conflict between the terms of this BAA and the Underlying Agreement between the Parties shall be governed by the terms of this BAA.
WHEREAS, in connection with the Underlying Agreement the Business Associate provides services to Covered Entity and Covered Entity discloses to Business Associate certain Protected Health Information that is subject to protection under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act (Title XIII of the American Recovery and Reinvestment Act of 2009) (the "HITECH Act"), and regulations promulgated by the U.S. Department of Health and Human Services (the "HHS") (hereinafter the "HIPAA Regulations" and the "HITECH Regulations," respectively) and/or applicable state and/or local laws and regulations; and
WHEREAS, for good and lawful consideration and with acknowledgment of the mutual promises, set forth in the Underlying Agreement and herein, the Parties, intending to be legally bound, hereby agree as follows:
I. Definitions An expanded definition of the following terms, as well as the definition of other relevant terms are availableon RowanSOM website at https://www.rowan.edu/compliance. Terms used in this Business Associate Agreement but not otherwise defined shall have the meaning ascribed to those terms in HIPAA, the HITECH Act, and any current and future regulations promulgated under HIPAA and/or the HITECH Act. See 45 C.F.R. 160.103, 164.402 and 164.501.
A. Breach means the unauthorized acquisition, access, use, or disclosure of protected health information ("PHI") which compromises the security or privacy of such information in violation of HIPAA, the HITECH Act, the HIPAA Regulations, and/or the HITECH Regulations, except when the covered entity demonstrates that there is a low probability that the PHI has been compromised. The term "Breach" does not include:
1.Any unintentional acquisition, access, or use of PHI by an employee or person acting under the authority of a Covered Entity or Business Associate if:
a.Such acquisition, access, or use was made in good faith and within the course and scope of the employment or other professional relationship of such employee or person, respectively, with the Covered Entity or Business Associate; and
b.Does not result in further unauthorized use or disclosure; or
BBusiness Associate means a service provider that receives PHI from, or creates or maintains or transmits PHI on behalf of, a Covered Entity including, but not limited to, claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, billing, benefits management, practice management, re-pricing, transcription, legal, actuarial, accounting, consulting, data aggregation, administrative, accreditation or financial services, and vendors that offer personal health records to patients as part of a Covered Entity's electronic health record, where the service or function involves the use or disclosure of individually identifiable health information from the Covered Entity or from another Business Associate of the Covered Entity. A Business Associate excludes, among others, employees of Covered Entities.
C. Covered Entities include health care providers that transmit patient health information electronically in connection with a covered transaction, (ii) health plans (including employer-sponsored employee welfare benefit plans and self-insured employer-offered health plans), and (iii) health care clearinghouses.
D. Data Aggregation means, with respect to PHI created or received by a Business Associate, the combining of PHI received by a Business Associate in its capacity as a Business Associate for more than one Covered Entity to permit data analyses that relate to the health care operations of the respective Covered Entities.
E. Designated Record Set means any grouping of information that includes PHI and is maintained, collected, used, or disseminated by or for a Covered Entity that is medical records and billing records about individuals, and/or (ii) enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan, used, in whole or in part, by or for the Covered Entity, to make decisions about individuals.
F. Electronic Protected Health Information ("Electronic PHI") means PHI that is transmitted by or maintained in electronic media.
G. Individual (or patient) means the person who is the subject of PHI and includes a person who qualifies as a personal representative (45 C.F.R. 164.502(g)).
H. Protected Health Information ("PHI") means physical and/or mental health and demographic information collected from an individual and created or received by a Covered Entity and/or Business Associate that identifies or could reasonably identify an individual (i.e., is "individually identifiable") and is held or transmitted in any form including electronic media. PHI excludes educational records and employment records held by a Covered Entity as an employer (45 C.F.R. 164.501). If the patient has been deceased for more than fifty (50) years, the information will no longer be PHI.
I. Required By Law means that Covered Entities may use and disclose PHI without individual authorization as required by law (including by statute, regulation, or court orders) in accordance with the requirements in 45 C.F.R. 164.512(c), (e) or (f).
II. Permitted Uses and Disclosures of PHI by Business Associate
A.Except as otherwise limited in this BAA, Business Associate may use or disclose PHI to perform functions, activities, or services for, or on behalf of, Covered Entity as specified in the Underlying Agreement, provided that such uses and/or further disclosures do not violate the requirements of HIPAA's Business Associate contract standard at 45 C.F.R. 164.504(e)(1) and/or the HITECH Act, if done by the Covered Entity, (ii) are the minimum necessary PHI to accomplish the intended purpose, or (iii) are Required By Law.
Except as otherwise limited in this BAA, Business Associate may use or disclose PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of Business Associate, provided, however, that any such uses or disclosures are Required By Law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the PHI will remain confidential and used or further disclosed only as Required By Law or for the purpose for which it was disclosed to the person, and (ii) the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been Breached.
C.Except as otherwise limited in this BAA, Business Associate may use PHI to provide Data Aggregation services to Covered Entity (42 C.F.R. 164.504(e)(2)(B)).
D.Business Associate may use PHI to report violations of law to appropriate federal and state authorities as permitted under HIPAA and/or other federal and state laws. (45 C.F.R. 164.502(j)(1)).
III. Duties and Obligations of Business Associate Related to PHI
B.Business Associate shall use and implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of PHI and/or Electronic PHI that it creates, receives, maintains, or transmits on behalf of Covered Entity.
C.Business Associate shall notify, in writing, the Covered Entity when the Business Associate discovers a Breach of Unsecured PHI. A Breach is deemed to have been discovered by a Business Associate as of the first day on which Business Associate (by its employee, officer, or other agent) knows or would have known of such Breach by exercising reasonable diligence. Business Associate's notification to Covered Entity (i.e., RowanSOM) shall:
DISCLOSURES OF PERSONALLY IDENTIFIABLE HEALTH INFORMATION TO BUSINESS ASSOCIATES
D.Business Associate is subject to the same legal requirements to cure, terminate or report violations to the Secretary of HHS under the same duty and in the same manner as Covered Entity.
E. Business Associate shall mitigate, to the extent practicable, any harmful effect known to it resulting from an unauthorized use or disclosure of PHI or Breach of Unsecured PHI.
F. Business Associate shall ensure that any agent, including a subcontractor, to whom it provides PHI received from, or (ii) created or received by Business Associate on behalf of, a Covered Entity agrees, in writing, to the same restrictions and conditions that apply through this BAA to Business Associate with respect to such PHI.
G.Business Associate shall provide Covered Entity access to its premises for a review and demonstration of its internal practices and procedures for safeguarding PHI and, (ii) to the extent applicable, shall provide access for inspection and copying of PHI in a Designated Record Set at reasonable times at the request of Covered Entity or, as directed by Covered Entity, to an Individual (45 C.F.R. 164.524). If Business Associate maintains an Electronic Health Record, Business Associate shall provide such information in electronic format to enable Covered Entity to fulfill its obligations under the HITECH Act. (42 U.S.C. §17935(e)).
H.Business Associate shall, upon request with reasonable notice, provide Covered Entity with an accounting of uses and disclosures of PHI provided to it by Covered Entity.
I. Business Associate agrees to use, disclose and request only the minimum necessary PHI, as defined by law, and (ii) to the extent practicable, only the limited data set of PHI excluding direct identifiers, as defined in 45 C.F.R. 164.514(e)(2).
J.Business Associate shall document such disclosures of PHI and information related to such disclosures as would be required for a Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI (45 C.F.R. 164.528). Should a Covered Entity or an Individual request an accounting of disclosures of PHI pursuant to 45 C.F.R. 164.528, Business Associate agrees to promptly provide Covered Entity with information in a format and manner sufficient to respond no later than sixty (60) days after receipt of such request, subject to specific statutory exceptions.
K.Business Associate shall make its internal practices, books and records, including policies and procedures, relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of, Covered Entity, available to Covered Entity at the request of Covered Entity, or the Secretary of HHS, for purposes of the Secretary determining Covered Entity's compliance with HIPAA and/or the HITECH Act in the time, manner and place designated by the Covered Entity and/or the Secretary.
L.To the extent applicable, Business Associate shall make any amendment(s) to PHI in a Designated Record Set that Covered Entity directs or agrees to, no later than sixty (60) days after receipt of such request from a Covered Entity or Individual.
M. Business Associate agrees to abide by the limitations on marketing communications to Individuals regarding the purchase and use of products or services set forth in the HITECH Act and the HITECH Regulations.
N.Business Associate agrees and acknowledges that the administrative rules governing, and the civil and criminal penalties for violating, HIPAA, the HITECH Act, the HIPAA Regulations and the HITECH Regulations, apply to it in the same manner as they apply to Covered Entity, as more fully set forth at RowanSOM website at https://www.rowan.edu/compliance
IV. Term and Termination
A. Term. The term of this BAA shall be effective as of the effective date of the Underlying Agreement and shall terminate when all of the PHI provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or, if it is infeasible to return or destroy PHI, protections are extended to such information, in accordance with the termination provisions of this Section IV.
B. Termination for Cause. Upon Covered Entity's knowledge of a material breach by Business Associate, Covered Entity shall either:
2.Immediately terminate this BAA and/or the Underlying Agreement if Business Associate has breached a material term of this BAA and cure is not possible; or
3.If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary of HHS.
C. Effect of Termination.
1.(a) Except as provided in paragraph C.2 of this Section, upon termination of this BAA, for any reason, Business Associate shall return or destroy all PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity. This provision shall apply to PHI that is in the possession of subcontractors or agents of Business Associate. Business Associate shall retain no copies of PHI.
(b) Except as provided in paragraph C.2 of this Section, if Covered Entity, in its sole discretion, requires that Business Associate destroy any or all PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity, either due to the termination of this BAA or otherwise, Business Associate shall certify, in writing, to Covered Entity that the PHI has been destroyed and rendered indecipherable, pursuant to HIPAA and the HITECH Act. This provision also shall apply to PHI that is in the possession of subcontractors or agents of Business Associate.
2.In the event that Business Associate determines that returning or destroying the PHI is infeasible, Business Associate shall provide to Covered Entity written notification of the conditions that make return or destruction infeasible within thirty (30) calendar days of such request. In such case, Business Associate shall extend the protections of this BAA to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such PHI. This provision also shall apply to PHI that is in the possession of subcontractors or agents of Business Associate.
3.Should the Business Associate make a disclosure of PHI in violation of this BAA, Covered Entity shall have the right to immediately terminate any contract, other than this BAA, then in force between the Parties, including the Underlying Agreement.
4.The provisions of this Section IV.C. shall survive the termination of this BAA and the Underlying Agreement for any reason.
V. Remedies In Event of Breach
A.Business Associate agrees and acknowledges that there is a more than low probability that the PHI has been compromised and irreparable harm will result to Covered Entity, and to its business, in the event of breach by Business Associate of any covenants, duties, obligations and assurances in this BAA and further agrees that remedy at law for any such breach shall be inadequate and that damages resulting there from, are not susceptible to being measured in monetary terms. In the event of any such breach or threatened breach by Business Associate, Covered Entity shall be entitled to immediately enjoin and restrain Business Associate from any continuing violations and (ii) reimbursement for reasonable attorneys' fees, costs and expenses incurred as a proximate result of the breach. The remedies in this Section V shall be in addition to any action for damages and/or other remedy available to Covered Entity for such breach.
B.Business Associate shall indemnify and hold Covered Entity, its directors, officers, employees and agents harmless from any and all liabilities, damages, reasonable attorneys' fees, costs and expenses incurred by Covered Entity as a result of a breach of this BAA caused by Business Associate's actions or inactions and/or those of its employees and agents.
C.Business Associate agrees and acknowledges that the provisions of this BAA shall be strictly construed.
Parties other than that of independent entities contracting with each other unless otherwise explicitly stated in this BAA or the Underlying Agreement.
F. Authority. The signatories below have the right and authority to execute this BAA for their respective entities and no further approvals are necessary to create a binding agreement.
K. Notices to Parties. Any notice required under this BAA to be given shall be made in writing to:
To The Covered Entity: To The Business Associate:
IN WITNESS WHEREOF, the parties have executed this Business Associate Agreement the day and year first written below.
By: ROWANSOM By: [BUSINESS ASSOCIATE]