3-7-22 BOC Regular Meeting - Laserfiche WebLink

Home Browse Search

Consolidated Agreement FY23 Page 19 of 28 ATTACHMENT B BUSINESS ASSOCIATE AGREEMENT ADDENDUM TO THE CONSOLIDATED AGREEMENT This Business Associate Agreement (the "Agreement") is made effective June 1, 2022, by and between Lee County Health Department ("Covered Entity") and the North Carolina Department of Health and Human Services, Division of Public Health and the North Carolina Department of Health and Human Services, Division of Child and Family Well-Being (collectively, the "Business Associate"), (the Covered Entity and the Business Associate collectively, the "Parties"). 1. BACKGROUND a. Covered Entity and Business Associate are parties to the "FY 2023 Consolidated Agreement" (the "Consolidated Agreement"), whereby Business Associate agrees to perform certain services for or on behalf of Covered Entity. b. Covered Entity is an LHD in the State of North Carolina that has been designated in whole or in part by as a "covered entity" for purposes of the HIPAA Privacy Rule. c. The relationship between Covered Entity and Business Associate is such that the Parties believe Business Associate is or may be a"business associate" within the meaning of the HIPAA Privacy Rule. d. The Parties enter into this Business Associate Agreement Addendum to the Consolidated Agreement with the intention of complying with the HIPAA Privacy Rule provision that a covered entity may disclose protected health information to a business associate and may allow a business associate to create or receive protected heath information on its behalf, if the covered entity obtains satisfactory assurances that the business associate will appropriately safeguard the information. 2. DEFINITIONS Unless some other meaning is clearly indicated by the context, the following terms shall have the following meaning in this Agreement: a. "Electronic Protected Health Information" shall have the same meaning as the term "electronic protected health information" in 45 C.F.R. § 160.103. b. "HIPAA"means the Administrative Simplification Provisions, Sections 261 through 264, of the federal Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, as modified and amended by the Health Information Technology for Economic and Clinical Health ("HITECH") Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009, Public Law 111-5. c. "Individual" shall have the same meaning as the term "individual" in 45 C.F.R. § 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 C.F.R. § 164.502(g). d. "Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 C.F.R. Part 160 and applicable parts of Part 164. e. "Protected Health Information" shall have the same meaning as the term "protected health information" in 45 C.F.R. § 160.103, limited to the information created or received by Business Associate from or on behalf of Covered Entity. f. "Required By Law" shall have the same meaning as the term "required by law" in 45 C.F.R. § 164.103. g. "Secretary"shall mean the Secretary of the United States Department of Health and Human Services or the person to whom the authority involved has been delegated. h. Unless otherwise defined in this Agreement, terms used herein shall have the same meaning as those terms have in the Privacy Rule. 3. OBLIGATIONS OF BUSINESS ASSOCIATE a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By Law.