mehealth - Sign Up

Definitions.

Unless otherwise provided in this Agreement, capitalized terms have the same meanings as set forth in the Privacy Rule, Security Rule, and HITECH.

"PHI" means "Protected Health Information," as that term is defined in the Privacy and Security Rules. "ePHI" means "Electronic Protected Health Information," as that term is defined in the Privacy and Security Rules. PHI includes PHI that is ePHI as well as PHI that does not constitute ePHI.

"Unsecured PHI" or "Unsecured Protected Health Information" includes PHI in any form that is not secured through use of a technology or methodology specified in the HITECH, those being: (1) encryption for ePHI in accordance with the appropriate NIST standards for data at rest and in transit; or (2) destruction for other forms of PHI.

Scope of Uses and Disclosures by Business Associate.

In General. Except as otherwise limited in this Agreement or by law, Business Associate may use or disclose PHI provided to Business Associate by Covered Entity to perform the functions, activities, or services for or on behalf of Covered Entity that are specified in the Underlying Agreement, provided that such uses or disclosures would not violate the Privacy Rule if done by Covered Entity or the Minimum Necessary policies and procedures of Business Associate.

Use of PHI. Except as otherwise limited in this Agreement or by law, Business Associate may use PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate.

Disclosure of PHI. Except as otherwise limited in this Agreement or by law, Business Associate may disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided that disclosures are required by law, or Business Associate obtains reasonable assurances, in writing, from the person to whom the information is disclosed that it will remain confidential and be used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies Business Associate, in writing, within five (5) business days, of any instances of which it is aware in which the confidentiality of the information has been breached.

Data Aggregation. Except as otherwise limited in this Agreement or by law, Business Associate may use PHI to provide Data Aggregation services to Covered Entity as permitted by 45 CFR § 164.504(e)(2)(i)(B).

De-Identification. Business Associate may de-identify any and all PHI created or received by Business Associate under this Agreement or the Underlying Agreement, provided however, that the de-identification conforms to the requirements of the Privacy Rule. Such resulting de-identified information would not be subject to the terms of this Agreement.

Limitation on Use and Disclosure of PHI. With regard to its use and/or disclosure of PHI necessary to perform its obligations to Covered Entity, Business Associate agrees to limit disclosures of PHI to the Minimum Necessary (as defined in the Privacy Rule, as modified by HITECH and implementing regulations) to accomplish the intended purpose of the use, disclosure or request, respectively, whenever the Privacy Rule limits the use or disclosure in question to the Minimum Necessary.

Limitation on Remuneration for PHI. With regard to its use and/or disclosure of PHI necessary to perform its obligations to Covered Entity and to comply with HITECH, Business Associate agrees not to receive direct or indirect remuneration for any exchange of PHI not otherwise authorized under HITECH without individual authorization, unless (i) specifically required for the provision of services under the Underlying Agreement (ii) for treatment purposes; (iii) providing the individual with a copy of his or her PHI; or (iv) otherwise determined by the Secretary in regulations.

Reporting Violation of Law. Business Associate may use PHI to report a violation of law to appropriate Federal and/or State authorities, consistent with 45 CFR §164.502(j)(1).

Obligations of Business Associate.

In General. Business Associate shall use or further disclose PHI only as permitted or required by this Agreement or as required by law.

Safeguards. Business Associate shall use reasonable and appropriate safeguards to prevent use or disclosure of PHI other than as specifically authorized by this Agreement. Such safeguards shall at a minimum include: (i) a comprehensive written information privacy and security policy addressing the requirements of the Privacy and Security Rules, as amended by HITECH, that are directly applicable to Business Associate; and (ii) periodic and mandatory privacy and security training and awareness for members of Business Associate's Workforce.

Mitigation. Business Associate shall mitigate any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate that violates the requirements of this Agreement or applicable law.

Reporting. Business Associate shall report to Covered Entity any use or disclosure of PHI that is not sanctioned by this Agreement of which Business Associate becomes aware within five (5) business days.

Subcontractors. Business Associate shall require subcontractors or agents to whom Business Associate provides PHI to agree, in writing, to comply with the Privacy and Security Rules, as amended by HITECH, to the same extent Business Associate is required to comply.

Inspection by Secretary. Business Associate shall make available to the Secretary of Health and Human Services Business Associate's internal practices, books and records relating to the use and disclosure of PHI for purposes of determining Covered Entity and Business Associate's compliance with the Privacy and Security Rules and HITECH, subject to any applicable legal privileges.

Accounting of Disclosures of PHI. Business Associate shall document disclosures of PHI and information related to those disclosures necessary to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with the Privacy Rule, when and as required by HITECH, and provide to Covered Entity, and in the time and manner it reasonably specifies but in no case longer than five (5) business days, the information necessary to make an accounting of disclosures of PHI about an Individual. If PHI is maintained in an Electronic Health Record ("EHR"), Business Associate shall document and maintain documentation of such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures in an EHR, when and as required by HITECH.

Access to PHI. Business Associate shall provide to Covered Entity, at Covered Entity's request and in the time and manner it reasonably specifies but in no case longer than ten (10) business days, PHI necessary to respond to Individuals' requests for access to PHI about them, in the event that the PHI in Business Associate's possession constitutes a Designated Record Set. If PHI is maintained in an Electronic Health Record, Business Associate shall provide access electronically, upon reasonable request of Covered Entity, when and as required by HITECH.

Amendment to PHI. Business Associate shall, upon receipt of notice from Covered Entity but in no case longer than ten (10) business days, incorporate any amendments or corrections to the PHI in accordance with the Privacy Rule, in the event that the PHI in Business Associate's possession constitutes a Designated Record Set.

Security of PHI. Business Associate shall, as described in HITECH Act §13401, comply with 45 CFR §§ 164.308, 164.310, 164.312, and 164.316 of the Security Rule and acknowledges that such provisions apply to Business Associate in the same manner that they apply to Covered Entity. Therefore, Business Associate agrees that it is required to maintain appropriate and reasonable administrative, physical, and technical safeguards, including documentation of the same, so as to ensure that PHI is not used or disclosed other than as provided by this Agreement or as required by law, including the following:

Administrative safeguards (implementation of policies and procedures to prevent, detect, contain, and correct security violations; conducting and documentation of risk analysis and risk management);

Physical safeguards (implementation of policies and procedures to limit physical access to PHI or ePHI or electronic information systems and related facilities);

Technical safeguards (implementation of policies and procedures creating and tracking unique user identification, authentication processes, and transmission security, which may include encryption);

Policies and procedures to reasonably and appropriately document the foregoing safeguards as required by the Security Rule; and

Ensuring that any agent, including any subcontractor, to whom Business Associate provides ePHI agrees, in writing, to comply with these administrative, physical, and technical safeguards, as well as the policies, procedures, and document requirements contained within the Security Rule.

Civil and Criminal Liability. Business Associate acknowledges that it shall be liable under the civil and criminal enforcement provisions set forth at 42 USC §§1320d-5 and 1320d-6, as amended from time to time, for failure to comply with any use or disclosure requirements of this Agreement with respect to PHI and for failure to comply with its direct obligations under the Privacy and Security Rules and HITECH.

Notification of Security Incidents and Breach of Unsecured PHI. Business Associate shall promptly following discovery, notify Covered Entity of any actual or suspected Security Incident or Breach of Unsecured Protected Health Information. The notice shall include: (i) the identification of each Individual whose PHI or Unsecured PHI has been or is reasonably believed by Business Associate to have been accessed, acquired, used or disclosed during the Security Incident or Breach, (ii) a brief description of what happened, including the date of the Security Incident or Breach and the date of the discovery of the Security Incident or Breach, (iii) a description of the types of PHI or Unsecured PHI that were involved in the Security Incident or Breach, (iv) any preliminary steps taken to mitigate the damage, and (v) a description of any investigatory steps taken. Such notice shall be supplemented as Business Associate learns more information. In addition, Business Associate shall provide any additional information reasonably requested by Covered Entity for purposes of investigating a Breach of Unsecured PHI. A Breach shall be treated as discovered by Business Associate as of the first day on which the Breach is known to Business Associate (including any person, other than the Individual committing the Breach, that is an employee, officer, or other agent of Business Associate) or should reasonably have been known to Business Associate to have occurred. Covered Entity shall have the sole right to determine, with respect to a Breach: (i) whether notice is to be provided to Individuals, regulators, law enforcement agencies, consumer reporting agencies, media outlets and/or the Department of Health and Human Services, or others as required by law or regulation, in Covered Entity's discretion; and (ii) the contents of such notice, whether any type of remediation may be offered to Individuals affected, and the nature and extent of any such remediation. The provision of the notices to affected Individuals, and any remediation which Covered Entity determines is required or reasonably necessary, shall be at Business Associate's sole cost and expense. The Parties acknowledge and agree that this Section constitutes notice by Business Associate to Covered Entity of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined below) for which notice to Covered Entity by Business Associate shall be required only upon request. "Unsuccessful Security Incidents" shall include, but not be limited to, pings and other broadcast attacks on Business Associate's firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as no such incident results in unauthorized access, use or disclosure of PHI.

Obligations of Covered Entity.

Limitation in Notice of Privacy Practices. Covered Entity will notify Business Associate of any limitation in Covered Entity's Notice of Privacy Practices in accordance with the Privacy Rule, to the extent that the limitation may affect Business Associate's use or disclosure of PHI.

Changes in Permission by Individual. Covered Entity will notify Business Associate of any changes in, or revocation of, permission by an Individual to use or disclose PHI to the extent that the change may affect Business Associate's use or disclosure of PHI.

Restriction on Use/Disclosure of PHI. Covered Entity will notify Business Associate of any restriction on the use or disclosure of PHI that has been agreed to with an Individual and any restrictions on marketing or fundraising to the extent that the restriction may affect Business Associate's use or disclosure of PHI.

Permitted by the Privacy Rule or HITECH. Covered Entity will not request Business Associate to use or disclose PHI in any manner that would not be permissible under the Privacy Rule or HITECH if done by Covered Entity, except to the extent Business Associate will use or disclose PHI for, and this Agreement includes provisions for, Data Aggregation by or for management, administrative, and legal activities of Business Associate.

Term and Termination.

Term of the Agreement. The term of this Agreement begins on the Effective Date and ends when all of the PHI provided to Business Associate by Covered Entity, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity. To the extent it is infeasible for Business Associate to return or destroy the PHI, upon the agreement of Covered Entity, protections shall be extended to that PHI in accordance with the termination provisions in this Section.

Termination for Breach. Either party may terminate this Agreement if it determines that the other party has breached a material term of this Agreement. Alternatively, the non-breaching party may choose to provide the breaching party with notice of the existence of an alleged material breach and afford an opportunity to cure the material breach. If the breaching party fails to cure the breach to the satisfaction of the non-breaching party, the non-breaching party may immediately thereafter terminate this Agreement and report the breaching party to the Secretary.

Automatic Termination. This Agreement will automatically terminate on the date Business Associate ceases to provide the services described in the Underlying Agreement.

Effect of Termination. Upon termination of this Agreement, Business Associate will return or destroy all PHI received from Covered Entity or created or received by Business Associate on behalf of Covered Entity that Business Associate still maintains and will retain no copies of that PHI. However, if this return or destruction is not feasible, upon the agreement of Covered Entity, then Business Associate will extend the protections of this Agreement to the PHI and will limit further uses and disclosures to those purposes that make the return or destruction of the information infeasible.

Agreement. Covered Entity and Business Associate agree to take any reasonable action as is necessary to amend this Agreement from time to time as is necessary for Covered Entity and Business Associate to comply with the requirements of the Privacy and Security Rules, HITECH, and any other implementing regulations or guidance.

Interpretation. Any ambiguity in this Agreement shall be resolved to permit Covered Entity to comply with the Privacy and Security Rules and HITECH.

Survival. The obligations of Business Associate under Section 5(d) of this Agreement survive any termination of this Agreement.

No Third Party Beneficiaries. Nothing express or implied in this Agreement is intended to confer, nor shall anything in this Agreement confer, upon any person other than the parties and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.

Notices. Any notices required by this Business Associate Agreement will be sent to the party's address provided below by (i) registered or certified mail or by private delivery service that provides receipts to the sender and recipient, (ii) personally delivered, or (iii) by regular mail. Each party reserves the right to designate a different address for notices to be sent. Notices are deemed given on (i) the date shown on the registered mail, certified mail or private delivery service receipt, (ii) the date personally delivered, or (iii) two business days after the date of mailing of a notice sent by regular mail. All notices to Business Associate must be sent to Children’s Hospital Medical Center, Division of Behavioral Medicine and Clinical Psychology, 3333 Burnet Ave, ML 10006, Cincinnati, OH 45229-3039, Attn: Dr. Jeffery Epstein. All notices sent to Covered Entity at its address posted on the internet will be considered properly addressed.

Who we are

Get in touch

mehealth™ for TBI New Practice Registration

Account

Practice

Complete

Who we are

Get in touch