Common use of Business Associate Agreement Clause in Contracts

Business Associate Agreement. The Parties acknowledge that CITY is a Covered Entity as defined in the Healthcare Insurance Portability and Accountability Act of 1996 (“HIPAA”) and is required to comply with the HIPAA Privacy Rule governing the access, use, disclosure, transmission, and storage of protected health information (PHI) and the Security Rule under the Health Information Technology for Economic and Clinical Health Act, Public Law 111-005 (“the HITECH Act”). 1. Do at least one or more of the following: A. Create, receive, maintain, or transmit PHI for or on behalf of CITY/SFDPH (including storage of PHI, digital or hard copy, even if Contractor does not view the PHI or only does so on a random or infrequent basis); or B. Receive PHI, or access to PHI, from CITY/SFDPH or another Business Associate of City, as part of providing a service to or for CITY/SFDPH, including legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial; or C. Transmit PHI data for CITY/SFDPH and require access on a regular basis to such PHI. (Such as health information exchanges (HIEs), e- prescribing gateways, or electronic health record vendors) CITY/SFDPH Business Associate Agreement (BAA) (04-12-2018) Attachment 1: CITY/SFDPH Attestation 1 PRIVACY (06-07-2017) Attachment 2: CITY/SFDPH Attestation 2 DATA SECURITY (06- 07-2017) 2. NOT do any of the activities listed above in subsection 1;

Business Associate Agreement. The Parties parties acknowledge that CITY City is a Covered Entity as defined in the Healthcare Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and is required to comply with the HIPAA Privacy Rule governing the access, use, disclosure, transmission, and storage of protected health information (PHI) and the Security Rule under the Health Information Technology for Economic and Clinical Health Act, Public Law 111-005 (“the HITECH Act”). 1. Do at least one or more of the following: A. Create, receive, maintain, or transmit PHI for or on behalf of CITY/SFDPH (including storage of PHI, digital or hard copy, even if Contractor does not view the PHI or only does so on a random or infrequent basis); or B. Receive PHI, or access to PHI, from CITY/SFDPH or another Business Associate of City, as part of providing a service to or for CITY/SFDPH, including legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial; or C. Transmit PHI data for CITY/SFDPH and require access on a regular basis to such PHI. (Such as health information exchanges (HIEs), e- e-prescribing gateways, or electronic health record vendors) CITY/) a. Appendix E SFDPH Business Associate Agreement (BAA) (04-12-2018) Attachment ) 1: CITY/. SFDPH Attestation 1 PRIVACY (06-07-2017) Attachment ) 2: CITY/. SFDPH Attestation 2 DATA SECURITY (06- 06-07-2017) 2. NOT do any of the activities listed above in subsection 1;

Business Associate Agreement. The Parties parties acknowledge that CITY is a Covered Entity as defined in the Healthcare Insurance Portability and Accountability Act of 1996 (“"HIPAA”") and is required to comply with the HIPAA Privacy Rule governing the access, use, disclosure, transmission, and storage of protected health information (PHI) and the Security Rule under the Health Information Technology for Economic and Clinical Health Act, Public Law 111-005 (“the HITECH Act”). 1. Do at least one or more of the following: A. Create, receive, maintain, or transmit PHI for or on behalf of CITY/SFDPH (including storage of PHI, digital or hard copy, even if Contractor does not view the PHI or only does so on a random or infrequent basis); or B. Receive PHI, or access to PHI, from CITY/SFDPH or another Business Associate of City, as part of providing a service to or for CITY/SFDPH, including legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial; or C. Transmit PHI data for CITY/SFDPH and require access on a regular basis to such PHI. (Such as health information exchanges (HIEs), e- e-prescribing gateways, or electronic health record vendors) CITY/) a. Appendix E SFDPH Business Associate Agreement (BAA) (04-12-2018) Attachment ) 1: CITY/. SFDPH Attestation 1 PRIVACY (06-07-2017) Attachment ) 2: CITY/. SFDPH Attestation 2 DATA SECURITY (06- 06-07-2017) 2. NOT do any of the activities listed above in subsection 1;; DPH NOTE: This option requires review and approval from the SFDPH Office of Compliance and Privacy Affairs.

Business Associate Agreement. The Parties parties acknowledge that CITY is a Covered Entity as defined in the Healthcare Insurance Portability and Accountability Act of 1996 (“"HIPAA”") and is required to comply with the HIPAA Privacy Rule governing the access, use, disclosure, transmission, and storage of protected health information (PHI) and the Security Rule under the Health Information Technology for Economic and Clinical Health Act, Public Law 111-005 (“the HITECH Act”). 1. Do at least one or more of the following: A. Create, receive, maintain, or transmit PHI for or on behalf of CITY/SFDPH (including storage of PHI, digital or hard copy, even if Contractor does not view the PHI or only does so on a random or infrequent basis); or B. Receive PHI, or access to PHI, from CITY/SFDPH or another Business Associate of City, as part of providing a service to or for CITY/SFDPH, including legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial; or C. Transmit PHI data for CITY/SFDPH and require access on a regular basis to such PHI. (Such as health information exchanges (HIEs), e- e-prescribing gateways, or electronic health record vendors) CITY/) a. Appendix E SFDPH Business Associate Agreement (BAA) (04-12-2018) Attachment ) 1: CITY/. SFDPH Attestation 1 PRIVACY (06-07-2017) Attachment ) 2: CITY/. SFDPH Attestation 2 DATA SECURITY (06- 06-07-2017) 2. NOT do any of the activities listed above in subsection 1;

Business Associate Agreement. The Parties parties acknowledge that CITY is a Covered Entity as defined in the Healthcare Insurance Portability and Accountability Act of 1996 (“"HIPAA”") and is required to comply with the HIPAA Privacy Rule governing the access, use, disclosure, transmission, and storage of protected health information (PHI) and the Security Rule under the Health Information Technology for Economic and Clinical Health Act, Public Law 111-005 (“the HITECH Act”). 1. Do at least one or more of the following: A. Create, receive, maintain, or transmit PHI for or on behalf of CITY/SFDPH (including storage of PHI, digital or hard copy, even if Contractor Grantee does not view the PHI or only does so on a random or infrequent basis); or B. Receive PHI, or access to PHI, from CITY/SFDPH or another Business Associate of City, as part of providing a service to or for CITY/SFDPH, including legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial; or C. Transmit PHI data for CITY/SFDPH and require access on a regular basis to such PHI. (Such as health information exchanges (HIEs), e- e-prescribing gateways, or electronic health record vendors) CITY/) a. Appendix E SFDPH Business Associate Agreement (BAA) (04-12-2018) Attachment ) 1: CITY/. SFDPH Attestation 1 PRIVACY (06-07-2017) Attachment ) 2: CITY/. SFDPH Attestation 2 DATA SECURITY (06- 06-07-2017) 2. NOT do any of the activities listed above in subsection 1;