4-3-17 Regular Meeting - Laserfiche WebLink

Home Browse Search

Consolidated Agreement FYI Page 24 of 33 NORTH CAROLINA DEPARTMENT OF HEALTH AND HUMAN SERVICES BUSINESS ASSOCIATE ADDENDUM TO CONSOLIDATED AGREEMENT This Agreement is made effective July 1, 2017, by and between] Lee County Health Department ("Covered Entity") and the North Carolina Department of Health and Human Services, Division of Public Health, Administrative, Local, Community Support Section, Health Information System and Local Technical Assistance and Training units ("Business Associate") (collectively the "Parties"). 1. BACKGROUND a. Covered Entity and Business Associate are parties to a Memorandum of Understanding, entitled "FY 2018 Consolidated Agreement" (the "MOU"), whereby Business Associate agrees to perform certain services for or on behalf of Covered Entity. b. Covered Entity is a local health department in the State of North Carolina that has been designated in whole or in part by as a "covered entity" for purposes of the HIPAA Privacy Rule. c. The relationship between Covered Entity and Business Associate is such that the Parties believe Business Associate is or may be a "business associate" within the meaning of the HIPAA Privacy Rule. d. The Parties enter into this Business Associate Addendum to the MOU with the intention of complying with the HIPAA Privacy Rule provision that a covered entity may disclose protected health information to a business associate, and may allow a business associate to create or receive protected heath information on its behalf, if the covered entity obtains satisfactory assurances that the business associate will appropriately safeguard the information. 2. DEFINITIONS Unless some other meaning is clearly indicated by the context, the following terms shall have the following meaning in this Agreement: a. "Electronic Protected Health Information" shall have the same meaning as the term "electronic protected health information" in 45 C.F.R. § 160.103. b. "HIPAA" means the Administrative Simplification Provisions, Sections 261 through 264, of the federal Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, as modified and amended by the Health Information Technology for Economic and Clinical Health ("HITECH") Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009, Public Law 111-5. c. "Individual" shall have the same meaning as the term "individual" in 45 C.F.R. § 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 C.F.R. § 164.502(g). d. "Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 C.F.R. Part 160 and Part 164. e. "Protected Health Information" shall have the same meaning as the term "protected health information" in 45 C.F.R. § 160.103, limited to the information created or received by Business Associate from or on behalf of Covered Entity. f. "Required By Law" shall have the same meaning as the term "required by law" in 45 C.F.R. § 164.103. g. "Secretary" shall mean the Secretary of the United States Department of Health and Human Services or the person to whom the authority involved has been delegated. h. Unless otherwise defined in this Agreement, terms used herein shall have the same meaning as those terms have in the Privacy Rule. 3. OBLIGATIONS OF BUSINESS ASSOCIATE a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By Law.