11-038 - King County Community and Human Services - 2011-2012 Minor Home Repair / Human Services

Browse Search

A. Obligations and Activities of the Agency The Agency agrees not to use or disclose protected health information other than as permitted or required by this Contract, HIPAA and the Health Information Technology for Economic and Clinical Health Act HITECH). The Agency shall use and disclose protected health information only if such use or disclosure, respectively, is in compliance with each applicable requirement of 45 CFR 164.504(e). The Agency is directly responsible for full compliance with the privacy provisions of HIPAA and HITECH that apply to business associates. 2. The Agency agrees to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the protected health information that it creates, receives, maintains, or transmits on behalf of the County as required by 45 CFR, Part 164, Subpart C. The Agency is directly responsible for compliance with the security provisions of HIPAA and HITECH that apply to business associates, including sections 164.308, 164.310, 164.312, and 164.316 of title 45 CFR. 3. Within two (2) business days of the discovery of a breach as defined at 45 CFR 164.402 the Agency shall notify the County of any breach of unsecured protected health information. The notification shall include the identification of each individual whose unsecured protected health information has been, or is reasonably believed by the Agency to have been, accessed, acquired, or disclosed during such breach; a brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known; a description of the types of unsecured protected health information that were involved in the breach (such as whether full name, social security number, date of birth, home address account number, diagnosis, disability code, or other types of information were involved); any steps individuals should take to protect themselves from potential harm resulting from the breach; a brief description of what the Agency is doing to investigate the breach, to mitigate harm to individuals, and to protect against any further breaches; the contact procedures of the Agency for individuals to ask questions or learn additional information, which shall include a toll free number, an e-mail address, Web site, or postal address; and any other information required to be provided to the individual by the County pursuant to 45 CFR 164.404, as amended. A breach shall be treated as discovered in accordance with the terms of 45 CFR 164.410. The information shall be updated promptly and provided to the County as requested by the County. 4. The Agency agrees to mitigate; to the extent practicable, any harmful effect that is known to the Agency of a use or disclosure of protected health information by the Agency in violation of the requirements of this Contract or the law. 5. The Agency agrees to report in writing all unauthorized or otherwise improper disclosures of protected health information or security incident to the County within two days of the Agency knowledge of such event. 6. The Agency agrees to ensure that any agent, including a subcontractor, to whom it provides protected health information received from, or created or received by the Agency on behalf of the County, agrees to the same restrictions and conditions that apply through this Contract to the Agency with respect to such information. City of Tukwila Page 16 of 19 2011 Contract