2021/06/30 Council Agenda Packet

BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement (the "Agreement") is entered into between Snohomish Health District (the "Covered Entity") and City of Everett (the "Business Associate"), collectively (the "Parties") and individually (a "Party"). This Agreement is effective as of RECITALS WHEREAS, Business Associate provides certain services to Covered Entity (the "Services") related to Activities performed as part of the COVID response. The performance of these Services may include but not be limited to (i) the creation, receipt, maintenance, transmission, access to or use of Protected Health Information and Electronic Protected Health Information by Business Associate, or (ii) the disclosure of Protected Health Information and Electronic Protected Health Information by Covered Entity (or another business associate of Covered Entity) to Business Associate. Accordingly, the creation, receipt, transmission, access to or maintenance of Protected Health Information and Electronic Protected Health Information by Business Associate is subject to the Privacy, Security, Breach Notification, and Enforcement rules promulgated pursuant to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") at 45 C.F.R. Parts 160 and 164. This Agreement is intended to document the business associate assurances required by the HIPAA Privacy Regulations at 45 C.F.R. § 164.504(e), the HIPAA Security Regulations at 45 C.F.R. § 164.314(a) and the obligations of the Parties under the State Health Care Information Act pursuant to Chapter 70.02 RCW. WHEREAS, this Agreement will govern the terms and conditions under which Covered Entity may disclose or have disclosed Protected Health Information and Electronic Protected Health Information to Business Associate, and under which Business Associate may create, receive, maintain, transmit, access or use Protected Health Information and Electronic Protected Health Information on behalf of Covered Entity. NOW, THEREFORE, in consideration of the covenants hereinafter set forth and for other good and valuable consideration, the sufficiency of which are hereby acknowledged, Covered Entity and Business Associate agree as follows: AGREEMENT 1. Definitions. Capitalized terms used in this Agreement, but not otherwise defined in this Agreement shall have the same meanings as those terms in the HIPAA Privacy and Security Regulations at 45 C.F.R. Parts 160 and 164. Unless otherwise stated, a reference to a "Section" is to a Section in this Agreement. For Purposes of this Agreement, the following terms shall have the following meanings. 1.1. Breach. "Breach" shall have the same meaning as the term "breach" in 45 C.F.R § 164.402 1.2. Designated Record Set. "Designated Record Set" shall have the same meaning as the term "designated record set" in 45 C.F.R. § 164.501. 1.3. Electronic Protected Health Information or EPHI. "Electronic Protected Health Information" or "EPHI" shall have the same meaning as the term "electronic protected health information" in 45 C.F.R. § 160.103, limited to the information created or received by Business Associate from or on behalf of Covered Entity.