Business Associate Agreement & Data Services Agreement - SEMMA Health, Inc.

Home Browse Search

BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement ("Agreement") is entered into by and between CITY OF SOUTH BEND {referred to as "Covered Entity") and SEMMA HEALTH, INC. ("Business Associate"). This Agreement is effective as of May 15", 2017 ("Effective Date"). RECITALS WHEREAS, Business Associate provides services to CITY OF SOUTH BEND, a Covered Entity as that term is defined under the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, and its implementing regulations (collectively, "HIPAA"), as amended by the final regulations promulgated pursuant to the Health Information Technology for Economic and Clinical Health (such regulations, "HITECH") Act (Division A, Title XIII and Division B, Title IV of Pub. L. No. 111-5) (which was part of the American Recovery and Reinvestment Act of 2009); and WHEREAS, Covered Entity is required to protect the privacy and security of Protected Health Information, including Electronic Protected Health Information (sometimes collectively referred to as "PHI" or individually as "PHI" and "EPHI"), and to obtain written assurances that Business Associate will protect the privacy and security of PHI disclosed to or created by Business Associate on its behalf in compliance with HIPAA and HITECH; and WHEREAS, the HIPAA Privacy Rule and Security Rules and HITECH require Covered Entity and Business Associate to enter into this Agreement containing specific requirements prior to the disclosure of PHI, as set forth in, but not limited to, Title 45, Sections 164.502(e) and 164.504(e) of the Code of Federal Regulations ("CFR"); and NOW, THEREFORE, in consideration of the mutual promises below and other consideration contained herein, the sufficiency of which is hereby acknowledged, the parties agree as follows: I. DEFINITIONS A. "Breach" shall have the meaning set forth in 45 C.F.R. Section 164.402. B. "Breach Notification Rule" shall mean the rule related to breach notification for Unsecured Protected Health Information codified at 45 C.F.R. Parts 160 and 164, Subpart D. C. "Electronic Protected Health Information" or "EPHI" shall have the meaning given to such term under the Security Rule, including, but not limited to, 45 C.F.R. § 160.103, limited to the information created or received by Business Associate from or on behalf of Covered Entity. D. "HIPAA Rules" shall mean the Privacy, Security and Breach Notification Rules. E. "Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health Information, codified at 45 C.F.R. Parts 160 and 164, Subparts A and E.