Business Associate Agreement Business Associate Agreement This agreement is entered into on Date of Contractual Agreement* MM slash DD slash YYYY between Business Associate Name*Titleselect the one that applies Independent Contractor for Behavioral Health Services Licensing Supervisor Business Associate to be referred to as Business Associate within this contract and Transformation: Hope for Today’s Families, LLC to be referred to as Transformations within this contract. Whereas, Transformations will make available and/or receive from Transformations Protected Health Information, in conjunction with goods or services that are being provided by Business Associate to Transformations, that is confidential and must be afforded special treatment and protections. Whereas, Business Associates will have access to and/or receive from Transformations Protected Health Information Portability and Accountability Act (HIPAA) Privacy Rule (45CFR Parts 160 and 164). Whereas, Transformations must have a valid business associate contract/agreement in effect in order to comply with the HIPAA Privacy Rule when providing Business Associate access to PHI. Now, Therefore, Transformations and Business Associate agree as follows: 1. Definitions: 1. Business Associate shall mean subcontractor listed above. 2. Covered Entity shall mean Transformation: Hope for Today’s Families, LLC or Transformation 3. Individual shall have the same meaning as a personal representative in accordance with 45 CPR 164.502 (g). 4. HIPAA Privacy Rule shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and Part 164, subparts A and E. 5. Protected Health Information shall have the same meaning as the term “required by law” in 45 CFR 163.501. Required by law shall have the same meaning as the term “required by law” in 45 CFR 164.501. 6. Secretary shall mean the Secretary of Department of Health and Human Services or his/her designee. Other terms used in this Agreement, but not identified above shall be defined as they are defined in the HIPAA Privacy Rule. 2. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE Business Associate agrees to: a. Not use or disclose Protected Health Information other than permitted or required by the Agreement or as required by law. 2. Use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement. 3. Mitigate, to the extent practicable, any harmful effects that are known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of this Agreement. 4. Report to Transformations any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware. 5. Ensure any agent, including any subcontractor to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of Transformations agrees to the same restrictions and conditions they apply through this Agreement to Business Associate with respect to such information. 6. Provide access, at the request of Transformations, and in the time and manner-at the initial start of services, updates every six (6) months, and whenever new team members are added, -to Protected Health Information in a Designated Record Set to Transformations or as directed by Transformations to an Individual in order to meet the requirements under 45 CFR 164.524. 7. Make any amendment(s) to Protected Health Information in a Designated Record Set that Transformations directs or agrees to pursuant to 45 CFR 164.526 at the request or Transformations or an individual, and in the time and manner directed by the HIPAA standards. 8. Make internal practices, books, and records, including policies and procedures and Protected Health Information, relation to the use and disclosure and Protected Health Information, received from, created or received by Business Associate on behalf of Transformations available to the Secretary or designated by the Secretary, for the purposes of the Secretary determining Transformations compliance with the HIPAA Privacy Rule. 9. Document such disclosures of Protected Health Information and information related to such disclosures as would be required for Transformations to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528. 3. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE a. General Use and Disclosure Provisions ** Except at otherwise limited in this Agreement, Business Associate may use or disclose Protected Health Information on behalf of, or to provide services to Transformation for the purposes of billing, service renewal, fulfillment of contract, supervision and approval of services, if such use would not violate HIPAA Privacy Rule if done by Transformations. All services performed, unless directed by the laws of the state of Kentucky, will be authorized by the client, parent or guardian within approved written format. 4. OBLIGATIONS OF TRANSFORMATIONS 1. Provisions for Transformations to inform Business Associate of Privacy Practices and Restrictions i. Notify Business Associate of any limitations of its notice of Privacy Practices ii. Notify Business Associate of any changes in, or revocation of, permission by Individual to use or disclose Protected Health Information, to the extent that such changes may affect Business Associates use or disclosure of Protected Health Information. iii. Notify Business Associate of any restriction to the use or disclosure of Protected Health Information that Transformations has agreed to in accordance with 45 CFR 164.522, to the extent that such restrictions may affect Business Associates use or disclosure of Protected Health Information. 2. Permissible Requests by Transformations: Transformations shall not request Business Associates to use or disclose Protected Health Information in any manner that would not be permissible under the HIPAA Privacy Rule. 5. TERM AND TERMINATION 1. Term: the Term of this Agreement shall be effective as of October 16, 2003 or date of initial contract with Transformation if after October 16, 2003, and shall terminate when all of the Protected Health Information provided by Transformations to Business Associate, or created or received by the Business Associated on behalf of Transformations, is returned to Transformations. 2. Termination for Cause: Upon Transformations knowledge of a material breach by Business Associate, Transformations shall either: i. Provide an opportunity for Business Associate to cure the breach or end the violation and terminate the Agreement if not cured within 15 days; ii. Immediately terminate the Agreement if Business Associate has breached a material term of the Agreement iii. If neither termination nor cure is feasible, Transformations will notify the Secretary of the violation. 3. Effect of Termination: All Protected Health Information will be returned to Transformations by Business Associate. 6. GOVERNING LAW This Agreement shall be governed by the state of Kentucky. 7. INJUNCTIVE RELIEF Notwithstanding any rights of remedies provided for in this Agreement, Transformations retains all rights to seek injunctive relief to prevent or stop the unauthorized use or disclosure of Protected Health Information by Business Associate, or any agent, or third party that received Protected Health Information from Business Associate. 8. BINDING NATURE AND ASSIGNMENT This Agreement shall be binding on the Parties hereto and their successor and assigns, by neither Party may assign this Agreement without prior written consent of the other, which consent shall not be unreasonably held. 9. NOTICES Whenever under this Agreement one party is required to give notice to the other, such notice shall by deemed given if mailed by First Class United States mail, postage prepaid, and addressed as follows: Transformations 4010 Dupont Circle Suite 582 Louisville, KY 40207 Either Party at any time may change its address for notification purposes by mailing a notice stating the change and setting forth the new address. ENTIRE AGREEMENT This Agreement consists of this document and constitutes the entire agreement between the Parties in relation to HIPAA, and Protected Health Information. There are no understandings or agreements relating to this Agreement which are not fully expressed in this Agreement and not change, waiver, or discharge of obligations arising under this Agreement shall be valid unless, in writing and executed by the Party against whom such charge, waiver, or discharge is sought to be enforced. MISCELLANEOUS 1. Regulatory References: A reference in this Agreement to a section in the HIPAA Privacy rule means the section as in effect or as amended. 2. Amendment: The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for Transformations to comply with the requirements of the HIPAA Privacy Rule and the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191. 3. Survival: The respective rights and obligations of Business Associate under Section d. Interpretation: Any ambiguity in this Agreement shall by resolved to permit Transformations to comply with the Privacy Rule. In Witness Whereof, Business Associate and Transformations have caused this Agreement to be signed and delivered by their dully authorized representatives, as of the date set forth above. Business Associate Signature*Email Address of Business Associate Transformations Representative Signature*Transformations Representative Email Address
