Business Associate Contract A. GENERAL PROVISIONS AND RECITALS
Business Associate “Business Associate” shall have the same meaning as the term “business associate” at 45 C.F.R. 160.103, and shall refer to Contractor.
Business Associate Agreement This Agreement may require the exchange of information covered by the U.S. Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). A Business Associate Agreement (“BAA”) executed by the Parties is attached as Appendix [Letter C/D/E etc.].
ATTACHMENT E BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement (“Agreement”) is entered into by and between the State of Vermont Agency of Human Services, operating by and through its Department of Vermont Health Access (“Covered Entity”) and OptumInsight, Inc. (“Business Associate”) as of June 6, 2014 (“Effective Date”). This Agreement supplements and is made a part of the contract/grant to which it is attached. Covered Entity and Business Associate enter into this Agreement to comply with standards promulgated under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), including the Standards for the Privacy of Individually Identifiable Health Information, at 45 CFR Parts 160 and 164 (“Privacy Rule”), and the Security Standards, at 45 CFR Parts 160 and 164 (“Security Rule”), as amended by Subtitle D of the Health Information Technology for Economic and Clinical Health Act (HITECH), and any associated federal rules and regulations. The parties agree as follows:
Business Associate Obligations Business Associate agrees to comply with applicable federal confidentiality and security laws, specifically the provisions of the HIPAA Rules and the HITECH Act applicable to business associates, including:
HIPAA Compliance If this Contract involves services, activities or products subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Contractor covenants that it will appropriately safeguard Protected Health Information (defined in 45 CFR 160.103), and agrees that it is subject to, and shall comply with, the provisions of 45 CFR 164 Subpart E regarding use and disclosure of Protected Health Information.
PCI-DSS Compliance Merchant shall be in full compliance with rules, regulations, guidelines and procedures adopted by any Card Association or Payment Network relating to the privacy and security of Cardholder and Card transaction data, including without limitation the most up-to-date version of the Payment Card Industry Data Security Standard (PCI-DSS), as amended from time to time by the Payment Card Industry Security Standards Council. Detailed information pertaining to aforementioned requirements may be found at xxxxx://xxx.xxxxxxxxxxxxxxxxxxxx.xxx. Additional information regarding security requirements may be found on the Card Association’s respective web sites.
Responsibilities of Business Associate Business Associate agrees:
Provisions for Covered Entity to Inform Business Associate of Privacy Practices and Restrictions (a) Covered Entity shall notify Business Associate of any limitation(s) in the notice of privacy practices of Covered Entity under 45 CFR 164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of protected health information.
Business Associate Addendum The Parties acknowledge and agree that Medical Practice is a Covered Entity and Modernizing Medicine is a Business Associate under HIPAA and each Party shall comply with the Party’s respective obligations under HIPAA. Without limiting the foregoing, each Party shall comply with the Business Associate Addendum attached to these Terms and Conditions as Exhibit A (the “Business Associate Addendum”). The Business Associate Addendum is hereby incorporated into this Agreement.