Res 2016-077/approving an administrative services agreement with United Healthcare Services, Inc. for the provision of medical, pharmacy, dental, flexible spending accounts (fsa), retiree, online enrollment tool and cobra benefits administration in a tot

Home Browse Search

ys This Business Associate Agreement ( "BAA ") is incorporated into and made part of the Administrative Services Agreement ( "Agreement ") between United HealthCare Services, Inc. on behalf of itself and its affiliates ( "Business Associate ") and City of San Marcos ( "Covered Entity ") and is effective on January 1, 2017(Effective Date). The parties hereby agree as follows: 1. DEFINITIONS 1.1 Unless otherwise specified in this BAA, all capitalized terms used in this BAA not otherwise defined have the meanings established for purposes of the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations as amended from time to time (collectively, "HIPAA "). 1.2 "Privacy Rule" means the federal privacy regulations, as amended from time to time, issued pursuant to HIPAA and codified at 45 C.F.R. Parts 160 and 164 (Subparts A & E). 1.3 "Security Rule" means the federal security regulations, as amended from time to time, issued pursuant to HIPAA and codified at 45 C.F.R. Parts 160 and 164 (Subparts A & C). 1.4 "Services" means, to the extent and only to the extent they involve the receipt, creation, maintenance, transmission, use or disclosure of PHI, the services provided by Business Associate to Covered Entity as set forth in the Agreement, including those set forth in this BAA in Section 4, as amended by written agreement of the parties from time to time. 2. RESPONSIBILITIES OF BUSINESS ASSOCIATE With regard to its use and /or disclosure of Protected Health Information (PHI), Business Associate agrees to: 2.1 not use and/or disclose PHI except as necessary to provide the Services, as permitted or required by this BAA and/or the Agreement, and in compliance with each applicable requirement of 45 C.F.R. 164.504(e), or as otherwise Required by Law; provided that, to the extent Business Associate is to carry out Covered Entity's obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to Covered Entity in the performance of those obligations. 2.2 implement and use appropriate administrative, physical and technical safeguards and comply with applicable Security Rule requirements with respect to Electronic Protected Health Information, to prevent use or disclosure of PHI other than as provided for by this BAA and/or the Agreement. 2.3 without unreasonable delay, report to Covered Entity (i) any use or disclosure of PHI not provided for by this BAA and/or the Agreement, of which it becomes aware in accordance with 45 C.F.R. 164.504(e)(2)(ii)(C); and/or (ii) any Security Incident of which Business Associate becomes aware in accordance with 45 C.F.R. 164.314(a)(2)(i)(C). 2.4 with respect to any use or disclosure of Unsecured PHI not permitted by the Privacy Rule that is caused solely by Business Associate's failure to comply with one or more of its obligations under this BAA, Covered Entity hereby delegates to Business Associate the responsibility for determining when any such incident is a Breach. In the event of a Breach, Business Associate shall (i) provide Covered Entity with written notification, and (ii) provide all legally required notifications to Individuals, HHS and/or the media, on behalf of Covered Entity, in accordance with 45 C.F.R. 164 (Subpart D). Business Associate shall pay for the reasonable and actual costs associated with those notifications. 2.5 in accordance with 45 C.F.R. 164.502(e)(1)(ii) and 45 C.F.R. 164.308(b)(2), ensure that any subcontractors of Business Associate that create, receive, maintain or transmit PHI on behalf of Business Associate agree, in writing, to the same restrictions and conditions on the use and/or disclosure of PHI that apply to Business Associate with respect to that PHI. 2.6 make available its internal practices, books and records relating to the use and disclosure of PHI to the Secretary for purposes of determining Covered Entity's compliance with the Privacy Rule. 2.7 after receiving a written request from Covered Entity or an Individual, make available an accounting of disclosures of PHI about the Individual, in accordance with 45 C.F.R. 164.528. 43