The URL can be used to link to this page

Home My WebLink About2003-094 MOU - HIPAA JACKSON COUNTY Oregon June 26, 2003 Penny Bergman 1005 E, Main Street Medford, OR 97504 Phone: 541 774-7806 Fax: 541 774-7980 bergmapl@jacksoncounty, org www.jacksoncounty, org City of Ashland 20 E. Main Street Ashland, OR 97520 RE: HIPAA Memoradnum of Understanding Dear Sir or Madame: Enclosed please find your executed copy of the above named agreement. If there are any questions or problems please don't hesitate to call Jackson County's HIPAA coordinator Mark Orndoff at 774-7878. Sincerely, Penny Bergrnan Enclosure(s). 3 HIPAA MEMORANDUM OF UNDERSTANDING BETWEEN JACKSON COUNTY AND CITY OF ASHLAND This Memorandum of Understanding (MOU) is between Jackson County, hereinafter called County, a political subdivision of the State of Oregon and the City of Ashland, hereinafter called City, collectively referred to as Parties. I. RECITALS: Whereas the Parties are governmental entities subject to the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 (HIPAA); Whereas county and city laws, ordinances and agreements contractually require or authorize the Parties to create, use, share and disclose Protected Health Information (PHI), as that term is defined in HIPAA, Whereas the Parties are or may be business associates of the other, as that term is defined in 45 CFR § 160.103 with respect to HIPAA covered functions; Whereas the Parties may be trading partners of the other, as that term is defined in 45 CFR {}160.103. Whereas the Parties may exchange PHI electronically and may transmit data using a communications network; NOW THEREFORE, in consideration of the mutual premises set forth above and other good and valuable consideration, the receipt of which is hereby acknowledged, the Parties hereto agree as follows: II. SCOPE OF AGREEMENT: The purpose of this Agreement is to describe how the Parties will cooperate to achieve H[PAA compliance involving shared or combined or jointly maintained PHI. The scope of this Agreement is limited to legal requirements imposed by HIPAA concerning the creating, maintenance, transmission, use or disclosure of PHI. This Agreement does not supercede any other federal or state law or regulation, or contractual agreements, describing the legal relationship between the Parties, their duties and obligations, or the confidentiality of records or information, except to the extent that HIPAA preempts those laws or legal obligations. Any ambiguity in this MOU shall be resolved in favor of a meaning that permits the Parties to comPly with HIPAA. The Parties are separately responsible for their own compliance with applicable HIPAA requirements, which is outside the scope of this Agreement. This Agreement only addresses circumstances in which the Parties perform, assist in the performance of a Draft #2 4/30/03 HIPAA MEMORANDUM OF UNDERSTANDING BETWEEN JACKSON COUNTY AND CITY OF ASHLAND Page 1 of 4 function or activity, or administration thereof, involving the creating, maintenance, use, transmission or disclosure of PHI for Covered Functions, in connection with, or on behalf of, the other. The definitions HIPAA ascribes to Covered Entity, Covered Functions, Disclosure, Individually Identifiable Health Information and Protected Health Information apply to and control the use of the words in this MOU. III. PERMITTED USES AND DISCLOSURE OF PROTECTED HEALTH INFORMATION: The Parties may: 1. Make any and ail uses of PHI necessary to perform their obligations under state and federal law and agreement. All other uses not authorized by law or this MOU are prohibited. 2. Use PHI in its possession for its proper management and administration and to fulfill any present or future legal responsibilities of the party, provided that such uses are permitted under state and federal confidentiality laws. 3. Disclose the PHI in its possession to third parties for the purpose of its property management and administration or to fulfill any present or future legal responsibilities of the parties, as required by law or authorized consistent with HIPAA, or pursuant to a third party's written assurance agreeing to maintain the confidentiality of PHI. 4. Aggregate PHI in its possession with the PHI of another covered entity the Parties have in their possession through business associate agreements, provided the purpose of the aggregation is to provide either party with data analyses relating to health care operations as defined by HIPAA. 5. De-identify all PHI provided the de-identification conforms to HIPAA's specifications and the party conducting the de-identification maintains the documents in a manner required by HIPAA. IV. RESPONSIBILITIES OF THE PARTIES: 1. The Parties may create, maintain, use and/or disclose PHI for purposes of public health and regulatory functions including those listed in 45 CFR § 164.512. 2. The Parties may use and/or disclose PHI only as permitted herein or as authorized by the law. 3. The Parties shall use reasonable and appropriate administrative, technical and physical safeguards to: Draft 1t2 4/30/03 HIPAA MEMORANDUM OF UNDERSTANDING BETWEEN JACKSON COUNTY AND CITY OF ASHLAND Page 2 of 4 Ao Co Protect the integrity and confidentiality of the information; Protect against any reasonably anticipated threats or hazards to the security or integrity fo the information and unauthorized uses or discloses of it; and, Establish and maintain compliance with HIPAA security and privacy requirements on the part of the workforce members. 4. The Parties shall report to the other any use or disclosure of information not provided for by the MOU or permitted by HIPAA of which it becomes aware. 5. The Parties shall require all of its subcontractors and agents that receive, use or have access to, PHI under this MOU, to agree, in writing, to adhere to the same restrictions and conditions on the use and/or disclosure of PHI that apply to the Parties. 6. The Parties shall make available protected health information in accordance with 45 CFR § 164.524, 526 and 528. 7. The Parties shall make available all internal practices, records, books, agreements, policies and procedures relating to the use/and or disclosure of PHI created or received by a party to the Secretary of the United States Department of Health and Human Services for purposes of determining either party's compliance with HIPAA, subject to any applicable legal privileges. 8. Upon prior written request, the Parties shall make available to the other any non- privileged document relating to the use and/or disclosure of PHI to determine the Parties' compliance with the terms of the MOU. 9. The Parties shall disclose to its subcontractors, agents or other third parties only the minimum PHI necessary to perform or fulfill a specific function required hereunder. 10. When an individual makes a HIPAA-related request to either party for access to PHI, amendment of PHI or accounting of PHI, the receiving party shall respond to the request, consistent with applicable HIPAA requirements. V. TERM AND TERMINATION OF MOU 1. The term of this MOU shall be effective as of April 14, 2003 and shall terminate in accordance with the termination provisions of this Section. At the termination of any applicable contract, if feasible, the appropriate party shall return or destroy all PHI received, created, maintained or used pursuant to the MOU. If return or destruction is not feasible, the Parties shall agree to extend the protections of the MOU to the information and limit its further uses and disclosures. A. Either party may terminate this Agreement upon thirty (30) days prior written notice to the other, which notice shall specify the date of termination. Draft #2 4/30~03 HIPAA MEMORANDUM OF UNDERSTANDING BETWEEN JACKSON COUNTY AND CITY OF ASHLAND Page 3 of 4 B. Upon a party's actual knowledge of a material breach by the other of this MOU, the discovering party shall either: o , Provide an opportunity for the other to cure the breach or terminate the MOU if the other does not cure the breach within the time specified by the discovering party; Immediately terminate this MOU if the other has breached a material term and cure is not possible. 2. Any amendment to this MOU shall be in writing and signed by both Parties before it is legally effective. 3. The respective fights and responsibilities of the Part~ under t3}e~OU shall survive its Gino Grimalctl [ (Date) Susan E. Slack (Date) Jackson County Administrator City of Ashland Administrator Approved as to form: Beth A. Lori OSB #91164 Assistant County Counsel Approved as to form: ehuiNol~e - XOSB #69129 City of Ashland Attorney Draft #2 4/30~03 HIPAA MEMORANDUM OF UNDERSTANDING BETWEEN JACKSON COUNTY AND CITY OF ASHLAND Page 4 of 4