HIPAA Business Associate Agreement

HIPAA BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement (“Agreement”) by and between PROFESSIONAL AMBULANCE BILLING, LLC, a New York limited liability company having its principal place of business at 8610 Main Street, Williamsville, New York 14221 (“Business Associate”) and Town of Webster Emergency Medical Service a New York corporation having a principal place of business at 1000 Ridge Road, Webster, NY 14580 (“Covered Entity”) is effective as of the date of the Service Agreement (defined below) (the “Agreement Effective Date”). WITNESSETH: WHEREAS, Covered Entity wishes to disclose certain information to Business Associate pursuant to the terms of an agreement whereby Business Associate will provide certain services to or perform functions on behalf of Covered Entity (the “Service Agreement”); and WHEREAS, Business Associate may have access to information, some of which may be Protected Health Information (“PHI”) as defined below, in fulfilling its responsibilities under the Service Agreement; and WHEREAS, Covered Entity and Business Associate intend to protect the privacy and security of PHI disclosed to Business Associate in compliance with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), regulations promulgated thereunder, as amended and other applicable laws. NOW, THEREFORE, in consideration of the mutual promises below and the exchange of information pursuant to this Agreement, the parties agree as follows: 1.

Definitions.

a. Breach means the acquisition, access, use, or disclosure of PHI in a manner not permitted under HIPAA which compromises the security or privacy of PHI. b. Business Associate shall have the meaning given to such term under the Privacy and Security Rules, including, but not limited to 45 CFR §160.103. c. Covered Entity shall have the meaning given to such term under the Privacy and Security Rules, including, but not limited to 45 CFR §160.103. d. Data Aggregation shall have the meaning given to such term under the Privacy and Security Rules, including, but not limited to, 45 CFR §164.501. e. Designated Record Set shall have the meaning given to such term under the Privacy and Security Rules, including, but not limited to, 45 CFR §164.501. Subject to the foregoing, a Designated Record set means: (1) a group of records maintained by or for a covered entity that is: (i) the medical records and billing records about individuals maintained by or for a covered health care provider; (ii) the enrollment, payment, claims adjudication and case or 1

medical management record systems maintained by or for a health plan; or (iii) used, in whole or in part, by or for the covered entity to make decisions about individuals. f. Disclosure means the release, transfer, provision of access to, or divulging in any other manner, of PHI, outside the entity (i.e. covered entity or business associate) holding the information. g. Electronic Health Record is an electronic record of health-related information on an individual that is created, gathered, managed, and consulted by authorized health care clinicians and staff. h. Electronic Protected Health Information or “EPHI” means Protected Health Information, as defined herein, that is transmitted by or maintained in electronic media. For purposes of this Agreement, unless otherwise specified, any obligations of Business Associate relating to PHI shall also apply to EPHI. i. Health Care Operations shall have the meaning given to such term under the Privacy and Security Rules, including, but not limited to, 45 CFR §164.501. j. Individual shall have the same meaning as the term “Individual” in 45 CFR §160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR §164.502(g). k. Limited Data Set means information that excludes names, postal address (other than town, city, state, and zip code), telephone and fax numbers, email address, social security and medical record numbers, health plan beneficiary numbers, account numbers, certificate license numbers, vehicle identifiers and serial numbers including license plate numbers, device identifiers and serial numbers, Web Universal Resource Locators, Internet Protocol address numbers, biometric identifiers including finger and voice prints and full face photographic images and any comparable images. l. Personal Health Record is an electronic record of an individual’s health information by which the individual controls access to the information and may have the ability to manage, track, and participate in their own health care. m. and 164.

Privacy Rule shall mean the HIPAA Regulation that is codified at 45 CFR §§160

n. Protected Health Information or “PHI” means any information, whether oral or recorded in any form or medium: (i) that relates to the past, present or future physical or mental condition of an Individual, the provision of health care to an Individual, or the past, present or future payment for the provision of health care to an Individual, and (ii) that identifies the Individual or with respect to which there is a reasonable basis to believe the information can be used to identify the Individual, (iii) that is transmitted by electronic media, maintained in electronic media or transmitted or maintained in any other form or medium; and (iv) shall have the meaning given to such term under the Privacy and Security Rules, including, but not limited to, 45 CFR §160.103. 2

o. Secured PHI means PHI that is unusable, unreadable, or indecipherable to unauthorized individuals. HHS guidance states there are only two methods for making PHI secured: encryption and destruction. p. Security Incident means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system. q. Unsecured Protected Health Information means PHI that is not secured through technology or methodology that HHS has stated renders the PHI unusable, unreadable, or indecipherable to unauthorized Individuals through the use of a technology or methodology spc. r. Use means, with respect to PHI, the sharing, employment, application, utilization, transmission, examination, or analysis of such information within an entity (i.e. covered entity or business associate) that maintains such information. 2.

Obligations of Business Associate.

a. Permitted Uses. Business Associate shall use and/or disclose PHI only as permitted or required by this Agreement or as otherwise required by HIPAA and applicable state law. Business Associate acknowledges that certain sections of the Privacy Rule and the Security Rule apply directly to Business Associate in the same manner as they apply to Covered Entity and agrees to comply with such rules and regulations as applicable. Business Associate shall not use PHI in any manner that would constitute a violation of HIPAA if so used by Covered Entity, except that Business Associate may use PHI (i) for the proper management and administration of Business Associate, (ii) to carry out the legal responsibilities of Business Associate, (iii) to report violations of law to appropriate federal and state authorities consistent with 45 CFR §164.502(j)(1), or (iv) for Data Aggregation purposes for the Health Care Operations of Covered Entity. b. Permitted Disclosures. Business Associate shall not disclose PHI in any manner that would constitute a violation of HIPAA if disclosed by Covered Entity, except that Business Associate may disclose PHI (i) in a manner permitted pursuant to this Agreement, (ii) for the proper management and administration of Business Associate; (iii) as required by law, or (iv) for Data Aggregation purposes for the Health Care Operations of Covered Entity. c. Appropriate Safeguards. Business Associate shall implement appropriate safeguards as are necessary to prevent the use or disclosure of PHI otherwise than as permitted by this Agreement, HIPAA and state law and to protect the confidentiality, integrity and availability of electronic PHI created, received, maintained or transmitted on behalf of Covered Entity. d. Reporting of Improper Use or Disclosure. Business Associate shall report to Covered Entity in writing any Security Incident, unauthorized access of PHI, Use or Disclosure of PHI otherwise than as provided for by this Agreement, Breach involving Unsecured PHI, or any known pattern of activity or practice that constitutes a material breach of this Agreement, 3

within two (2) business days of becoming aware of such improper Use or Disclosure, unauthorized access, Security Incident or Breach. In the event of a Breach, if the identity and/or contact information of all such Individuals is not known, Business Associate must nevertheless notify Covered Entity of the Breach within the two (2) business day timeframe and provide additional information concerning the identification of affected Individuals as soon as it is available. Business Associate shall: (i) take prompt action to mitigate the harmful effects of any Security Incident, Breach, improper Use or Disclosure or unauthorized access of PHI in violation of this Agreement and state or federal law; (ii) take additional action to mitigate as requested by Covered Entity; and (iii) upon request, assist Covered Entity in the performance of a risk assessment to determine if a Breach has occurred. e. Business Associate’s Agents/Subcontractors. Business Associate may disclose PHI to and permit the use of PHI by its employees, contractors, agents, or other representatives only if and to the extent directly related to, and necessary for, the performance of services for or on behalf of Covered Entity. Business Associate shall ensure that any agents, including subcontractors, to whom it provides PHI agree to the same restrictions and conditions that apply to Business Associate with respect to such PHI. f. Access to PHI. Business Associate shall make PHI maintained by Business Associate or its agents or subcontractors in Designated Records Sets or in an Electronic Health Record available to Covered Entity for inspection and copying to enable Covered Entity to fulfill its obligations under HIPAA or other applicable laws. g. Amendment of PHI. Business Associate or its agents or subcontractors shall make PHI available to Covered Entity for amendment and incorporate any such amendment to enable Covered Entity to fulfill its obligations under HIPAA or other applicable laws. h. Accounting Rights. The Business Associate and its agents or subcontractors shall make available to the Covered Entity the information required to provide an accounting of disclosures to enable the Covered Entity to fulfill its obligations under HIPAA or other applicable laws. Business Associate agrees to implement a process that allows for an accounting to be collected and maintained by Business Associate and its agents or subcontractors for at least six (6) years prior to the request, or at least three (3) years prior to the request if the records are maintained in an Electronic Health Record. i. Governmental Access to Records. Business Associate shall make its internal practices, books and records relating to the use and disclosure of Covered Entity’s PHI, and relating to security incidents involving Covered Entity’s Electronic PHI, available to the Secretary of the U.S. Department of Health and Human Services (the “Secretary”) for purposes of determining Business Associate’s compliance with HIPAA. j. Minimum Necessary. Business Associate and its agents or subcontractors shall only request, use and disclose, to the extent practicable, a Limited Data Set, or the minimum amount of PHI necessary to accomplish the intended purpose of the request, use or disclosure.

4

k. Retention of PHI. Notwithstanding Section 3(d) of this Agreement, Business Associate and its subcontractors or agents shall retain the information required under Section 2(h) of this Agreement for a period of six (6) years after termination of this Agreement. l. Audits, Inspection and Enforcement. Within reasonable written request by Covered Entity, Business Associate and its agents or subcontractors shall allow Covered Entity to conduct a reasonable inspection of the facilities, systems, books, records, agreements, policies and procedures relating to the use or disclosure of PHI and the implementation of appropriate security safeguards pursuant to this Agreement for the purpose of determining whether Business Associate has complied with this Agreement. This access excludes proprietary software, policies and operational procedure information not related to PHI. 3.

Term and Termination.

a. Term. This Agreement shall become effective on the Agreement Effective Date and shall continue until terminated by Covered Entity or until the Service Agreement expires or is terminated. In addition, certain provisions and requirements of this Agreement shall survive its expiration or other termination in accordance with Sections 2, 4, 5, 6, 7 and 9 of this Agreement. b. Material Breach. A breach by Business Associate of any material provision of this Agreement, as determined by Covered Entity, shall constitute a material breach of the Agreement and shall provide grounds for termination of the Agreement by Covered Entity. c. Reasonable Steps to Cure Breach. If Covered Entity knows of a pattern of activity or practice of Business Associate that constitutes a material breach or violation of Business Associate’s obligations under HIPAA, the provisions of this Agreement or the Service Agreement and does not terminate the Agreement, then Business Associate shall take reasonable steps to cure such breach or end such violation, as applicable. If Business Associate’s efforts to cure such breach or end such violation are unsuccessful, Covered Entity shall terminate the Agreement and the Service Agreement, if feasible. If a Business Associate knows of a pattern of activity or practice of subcontractor that constitutes a material breach or violation under this Agreement, Business Associate must take reasonable steps to cure the breach or end the violation. If such steps are unsuccessful, the Business Associate must terminate the Subcontractor Agreement if feasible. Business Associate shall provide written notice to Covered Entity of any pattern of activity or practice of subcontractor that Business Associate believes constitutes a material breach or violation of subcontractor’s obligations under the Subcontractor Agreement within five (5) days of discovery and shall meet with subcontractor to discuss and attempt to resolve the problem as one of the reasonable steps to cure the breach or end the violation. d. Effect of Termination. Upon termination of the Agreement for any reason, Business Associate shall return or destroy all PHI that Business Associate or its agents or subcontractors still maintain in any form, and shall retain no copies of such PHI. If return or destruction is not feasible, Business Associate shall continue to extend the protections of

5

Sections 2(a), 2(b), 2(c) and 2(e) of this Agreement to such information, and limit further use of such PHI to those purposes that make the return or destruction of such PHI infeasible. 4. Limitation on Liability. Covered Entity will not be liable to Business Associate or any other person for any consequential, incidental, punitive or other damages arising from or relating to the PHI (including but not limited to errors or omissions in the PHI) or for Covered Entity’s performance or failure to perform under this Agreement. 5. Indemnification. Each Party agrees to indemnify, defend and hold harmless the other party and its respective employees, directors, officers, subcontractors, and agents from and against all claims, actions, damages, losses, liabilities, fines, penalties, costs or expenses (including without limitation reasonable attorney’s fees) arising from or in connection with any Breach of this Agreement, or any negligent or wrongful acts or omissions in connection with this Agreement, by the indemnifying party or its employees, directors, subcontractors, or agents. This indemnification obligation shall survive the expiration or termination of this Agreement. 6. Injunction. Covered Entity and Business Associate agree that any violations of the provisions of this Agreement may cause irreparable harm to Covered Entity. Accordingly, in addition to any other remedies available to Covered Entity at law or in equity, or under this Agreement, in the event of any violation by Business Associate of any of the provisions of this Agreement, or any explicit threat thereof, Covered Entity shall be entitled to an injunction or other decree of specific performance with respect to such violation or explicit threat thereof, without any bond or other security being required and without the necessity of demonstrating actual damages. The parties’ respective rights and obligations under this section shall survive the expiration or termination of this Agreement. 7. Disclaimer. Covered Entity makes no warranty or representation that compliance by Business Associate with this Agreement, HIPAA or state law will be adequate or satisfactory for Business Associate’s own purposes. Business Associate is solely responsible for all decisions made by Business Associate regarding the safeguarding of PHI. 8.

Amendment.

a. Written Amendment Required. This Agreement may not be modified or amended except by a writing duly signed by an authorized representative of each party. b. Amendment to Comply with Law. The parties agree to take such action as is necessary to implement the standards and requirements of HIPAA and other applicable laws relating to the security or confidentiality of PHI. 9. No Third-Party Beneficiaries. Nothing express or implied in this Agreement is intended to confer, nor shall anything herein confer, upon any person other than Covered Entity, Business Associate and their respective successors or assigns, any rights, remedies, obligations or liability whatsoever. 10. No Waiver. No waiver of a breach of any provision of this Agreement shall be construed to be a waiver of any breach of any other provision of this Agreement or of any succeeding breach of the same provision. No delay in action with regard to any breach of any provision of this Agreement shall be construed to be a waiver of such breach. 6

11. Independent Contractor Relationship. This Agreement is not intended to create, and will not be construed to create, any relationship between the parties other than that of independent contractors. Neither of the parties nor any of their respective representatives will be construed to be the agent, employee, or representative of the other. 12. Notice. Any notices required to be given pursuant to the terms and conditions hereof shall be in writing and shall be sent by certified or registered mail, return receipt requested, to the respective parties at their addresses stated below. Notices shall be deemed to be effective on the date when they are mailed. TO:

TO:

13. Severability. If any section or portion of this Agreement shall be determined to be invalid, such determination shall not affect the enforceability or validity of the remainder of this Agreement. 14. Interpretation. The terms and conditions of this Agreement shall supersede any conflicting terms and conditions in the underlying Service Agreement (as amended from time to time) between the parties and shall supersede the terms and conditions of any existing Business Associate Agreement between the parties. This Agreement shall be interpreted as broadly as necessary to implement and comply with HIPAA and applicable laws. The parties agree that any ambiguity in this Agreement shall be resolved to permit Covered Entity to comply with HIPAA and applicable laws. IN WITNESS WHEREOF, the parties hereto have duly executed this Business Associate Agreement as of the Service Agreement Effective Date. COVERED ENTITY:

BUSINESS ASSOCIATE:

By:

By:

Title:_______________________________

Charles Jordan, President

Date:_______________________________

Doc #1972621.1

7