Legal HIPAA Compliance Agreement

LEGAL HIPAA COMPLIANCE AGREEMENT

This Legal HIPAA Compliance Agreement ("Agreement") is entered into as of by and between Covered Entity Name: with principal address: (hereafter "Covered Entity"), and Business Associate Name: with principal address: (hereafter "Business Associate").

RECITALS

WHEREAS: Covered Entity creates, receives, maintains or transmits Protected Health Information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA Rules"), including the Privacy Rule and Security Rule; and

WHEREAS: Business Associate performs certain services for Covered Entity, and in connection with such services, Business Associate will create, receive, maintain or transmit PHI on behalf of Covered Entity; and

WHEREAS: The parties desire to set forth their respective rights and obligations with respect to PHI and to ensure that Business Associate complies with applicable HIPAA Rules.

NOW, THEREFORE, in consideration of the mutual covenants and agreements contained herein, the parties agree as follows:

1. DEFINITIONS

Capitalized terms used but not otherwise defined in this Agreement shall have the meanings given in the HIPAA Rules. For purposes of this Agreement, the following definitions apply: "Protected Health Information" or "PHI" means individually identifiable health information that is transmitted or maintained in any form or medium, whether electronic, paper, or oral, that relates to the past, present or future physical or mental health condition of an individual, the provision of health care to an individual, or payment for the provision of health care to an individual.

2. PERMITTED USES AND DISCLOSURES

Business Associate may use and disclose PHI only as necessary to perform the services described in the underlying services agreement between the parties, and as otherwise permitted by this Agreement. Business Associate shall not use or disclose PHI in a manner that would violate the HIPAA Rules if done by Covered Entity. Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities, provided that such uses are permitted by the HIPAA Rules and only to the extent permitted by this Agreement.

3. OBLIGATIONS OF BUSINESS ASSOCIATE

Business Associate shall:

a. Implement appropriate administrative, physical and technical safeguards to prevent the use or disclosure of PHI other than as permitted by this Agreement and to protect the confidentiality, integrity and availability of Electronic PHI in accordance with the HIPAA Security Rule;

b. Ensure that any agent, including a subcontractor, to whom it provides PHI agrees in writing to the same restrictions and conditions that apply to Business Associate under this Agreement;

c. Not de-identify PHI except in accordance with the HIPAA Rules and only upon prior written authorization from Covered Entity;

d. Use appropriate sanctions against workforce members who fail to comply with the privacy and security policies required by this Agreement; and

e. Make available to Covered Entity such information as Covered Entity may require to satisfy its obligations under the HIPAA Rules, including but not limited to accounting of disclosures, access, and amendment requests, to the extent Business Associate maintains such information.

4. SAFEGUARDS; RISK MANAGEMENT

Business Associate shall implement administrative, physical and technical safeguards sufficient to reasonably and appropriately protect the confidentiality, integrity, and availability of PHI in its possession, including but not limited to:

a. Conducting and documenting periodic risk analyses and applying risk management updates;

b. Implementing access controls, authentication mechanisms, encryption where appropriate, audit controls and secure disposal procedures;

c. Maintaining written policies and providing workforce training addressing the handling of PHI and security incidents.

5. BREACH NOTIFICATION

Business Associate shall report to Covered Entity any use or disclosure of PHI not permitted by this Agreement, any security incident affecting Electronic PHI, and any actual or suspected breach of unsecured PHI. Such notification shall be made without unreasonable delay and in any event no later than 60 calendar days after discovery of the breach. The notification shall include, to the extent known, the nature of the breach, the PHI involved, steps taken to mitigate harm, and steps to prevent future occurrences.

6. SUBCONTRACTORS

Business Associate shall require each subcontractor or agent that creates, receives, maintains, or transmits PHI on behalf of the Business Associate to execute a written agreement obligating the subcontractor to comply with the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such PHI.

7. ACCESS, AMENDMENT AND ACCOUNTING

Business Associate shall make available to Covered Entity such PHI in a designated record set as is necessary for Covered Entity to fulfill its obligations to provide access or make amendments to PHI and to account for disclosures, within the timeframes required by the HIPAA Rules. Business Associate shall, at Covered Entity's direction, provide access directly to the individual when applicable.

8. RETURN OR DESTRUCTION

Upon termination of this Agreement, Business Associate shall, at Covered Entity's option, return or destroy all PHI received from Covered Entity that Business Associate still maintains in any form. If return or destruction is infeasible, Business Associate shall extend the protections of this Agreement to such PHI and limit further uses and disclosures to those purposes that make the return or destruction infeasible.

9. INDEMNIFICATION

Business Associate shall indemnify, defend and hold harmless Covered Entity from and against any and all claims, liabilities, losses, damages, fines and expenses (including reasonable attorneys' fees) arising from Business Associate's breach of this Agreement or violation of the HIPAA Rules to the extent caused by Business Associate's negligent or willful acts or omissions.

10. AUDIT; RECORDS

Business Associate shall document and retain policies, procedures, records of disclosures, risk assessments and other materials necessary to demonstrate compliance with this Agreement and shall make such records available to Covered Entity and to the Secretary of the relevant regulatory authority upon request as required by law.

11. TERM AND TERMINATION

This Agreement shall commence on the Effective Date and shall remain in effect for the term of the underlying services agreement, unless earlier terminated. Covered Entity may terminate this Agreement and the underlying services agreement upon written notice if Covered Entity determines Business Associate has committed a material breach of this Agreement and such breach is not cured within thirty (30) days following written notice specifying the breach. If termination is not feasible, Covered Entity shall report the problem to the Secretary of the relevant regulatory authority.

12. NOTICES

All notices, demands or communications required or permitted under this Agreement shall be in writing and delivered to the addresses set forth below by hand, registered mail, or certified mail, return receipt requested, or by nationally recognized overnight courier.

13. MISCELLANEOUS

Governing Law: This Agreement shall be governed by and construed in accordance with the laws of the state identified by Covered Entity's principal address, without regard to conflict of law principles.

Entire Agreement: This Agreement contains the entire understanding of the parties with respect to the subject matter hereof and supersedes all prior oral or written agreements between the parties concerning the subject matter.

Severability: If any provision of this Agreement is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.

Amendment: This Agreement may be amended only by a written instrument signed by both parties. Any amendment required by changes in applicable law shall be effective as of the date required by law; the parties shall promptly execute a written amendment to reflect such change.

Waiver: No failure or delay by either party in exercising any right under this Agreement shall constitute a waiver of that right.

Counterparts: This Agreement may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one instrument. Photocopies or electronic copies of signatures shall be binding.

ADDITIONAL BUSINESS ASSOCIATE REPRESENTATIONS

Vendor Contractor Other

Sign Now