HomeMy WebLinkAbout2015-11-18 PACKET 04.C. REQUEST OF CITY COUNCIL ACTION COUNCIL AGENDA
MEETING ITEM # � �
DATE 11/18/15 .
.
PREPARED BY: Public Safety Craig Woolery
ORIGINATING DEPARTMENT STAFF AUTHOR
* * * * * * * * * * * * * * * * * * * * � � * * * * * * * * * * * * * * * * * * * * * * :� * :� *
COUNCIL ACTION REQUEST:
City Council pass a motion to approve the ambulance billing contract between the city of
Cottage Grove and Expert T Billing, Inc. for 2016 - 2020 and the required HIPAA Buisness
Associate Addendum.
STAFF RECOMMENDATION:
Pass a motion to approve the ambulance billing contract between the city of Cottage Grove,
and Expert T Billing, Inc. for 2016 - 2020 and the required HIPAA Business Associate
Addendum.
SUPPORTING DOCUMENTS:
MEMO/LETTER: Memo from Director of Public Safety Craig Woolery dated 11-2-15
❑ OTHER: 2016 —2020 Agreement between Expert T billing and the city of Cottage Grove
HIPAA Business Associate Addendum
ADMINISTRATORS COMMENTS:
�� � w.
�,,�r ���� '� �f �� ��
City Administrator D te
* * * * * * * * * * � * * * * * * * * * * * * * * * * * * � * * * * * * * * * * * * * * * * * *
COUNCIL ACTION TAKEN: ❑ APPROVED ❑ DENIED ❑ OTHER
Cottage
, Grove City of Cottage Grove
�he�ePridea�derpSPef�tyMeet public Safety — Police/Fire/EMS Memo
To: Honorable Mayor and City Council
Charlene Stevens, City Administrator
From: Craig Woolery, Director of Public Safety
Date: November 2, 2015
Subject: REQUEST APPROVAL TO RENEW THE AMBULANCE BILLING CONTRACT
AND HIPAA BUSINESS ASSOCIATE AGREEMENT WITH EXPERT T
BILLING SERVICES FOR A 5 YEAR TERM
Introduction
The current 2 year ambulance billing agreement with Expert T will expire December 31, 2015.
Attached for your approval is a renewal contract and HIPAA Business Associate Agreement for
a five year term.
Discussion
Cottage Grove EMS has utilized the services of Expert T for over 15 years. Expert T represents
a large number of both public and private ambulances services in the metropolitan area and
outstate Minnesota.
Expert T provides a valuable service that has in turn increased the ambulance services revenue
capture, assists in training and keeping abreast of the changes in the health care industry.
The billing rates have remained fairly constant during the past several years and the current
agreement represents a 2% increase in the billing rate per ambulance transport.
Charges per billable transport
2012-2013 $26.00
2013-2015 $26.50
2016-2018 $27.00
Note -The proposed agreement is for five years (2016-2020), the rate is guaranteed for two
years (2016-2018).
Section 4.5 in the proposed agreement provides for a written 60 day opt out clause.
The finance department and Public Safety Department recommend the approval of the
agreement.
Recommendation
Authorize approval of the Ambulance Billing Service Agreement and the HIPAA Business
Associate agreement with Expert T Billing Service for a five (5) year term from 2016-2020.
Ambulance Service Billing Agreement
EXPERT T BILLING
AND
THE CITY OF COTTAGE GROVE AMBULANCE
This agreement for service commencing on January l,2016 between the City of Cottage Grove, a
Minnesota municipal corporation ("CIT� and Expert T Billing, a Minnesota corporation
("CONTRACTOR") shall specify the billing seivices the CONTRACTOR will provide to the
CITY.
l. CONTRACTOR SERVICES AND OBLIGATIONS
1.1 The CONTRACTOR agrees to provide and furnish ambulance billing service for
� the accounts receivable of the CITY as follows: � �
1.1.1 Preparation of initial and monthly statements for all accounts and mailing
to responsible parties.
1.1.2 Submitting claims to all insurance companies, including Medicare,
Medicaid,VA and other insurance providers.
1.1.3 Processing and assisting individuals with accounts and with third party
insurance payments (private insurance) in order to coordinate payment to
the CITY.
1.1.4 Issue up to three(3)billing statements on each account. �
1.1.5 Issue delinquent account letters on all accounts that have not had
payment activity for 120 days.
1.1.6 Perform telephone follow-up calls on accounts to patients, medical
providers, insurance carriers, or other facilitators to ensure reasonable
collection efforts have been attempted. This would include the use of
internet resources when applicable.
1.1.7 Per CITY authorization or directive, refer to a designated collection
agency delinquent accounts which have failed to have payment activity
after the delinquent account letter was mailed.
1.1.8 All accounts authorized for collection agency handling and as permitted
under MN State Statute 270 A, shall be submitted to the Minnesota
Department of Revenue and certified for collection per the Minnesota
Revenue Recapture Act.
1.1.9 Furnish to the CITY a monthly accounting of all charges and revenue
statements handled during the month as well as other billing system
reports,
-1-
1.1.10 Respond to inquiries from individuals who have received ambulance
service which are related to their accounts and balances due.
l.l.11 Forward complaints and all written comments received regarding the
CITY to the CITY'S designee.
1.1.12 Retain possession of a back-up billing software program at a secure off- .
site location.
1.1.13 Perform and maintain a computer back-up of accounts receivable records
on a daily basis.
1.1.14 At the termination of this agreement, return to the CITY all accounts
receivable records and billing information as provided by the CITY over
the course of the billing agreement(s).
1.1.15 Train and, where required, license CONTRACTOR personnel to provide
services hereunder and to provide such seivices in accordance with all
applicable laws, ordinances, regulations and rules of federal, state and
local authority. CONTRACTOR will obtain all necessary certificates,
pernuts and licenses at CONTRACTOR'S sole expense and, upon
request,provide the CITY with evidence thereof.
1.1.16 Maintain a general liability insurance policy with a contract liability rider
of $2,000,000 annual aggregate and $1,000,000 per occurrence. The
CITY shall be named as an additional insured on the policy.
2. CITY OBLIGATIONS
�
2.1 The CITY agrees to provide and furnish the CONTRACTOR the following:
2.11 Information required by the CONTRACTOR to properly bill the
accounts, Information shall be in the form of legible paper EMS Patient
Care Reports (PCRs) or from electronic Patient Care Reports. Legible
information shall be required from electronic as well as paper
information.
2.1.2 THE CITY shall whenever possible, provide the CONTRACTOR with
hospital admission face sheets and other information, including patient
signatures, which may be available and legally obtainable for individuals
receiving ambulance service when necessary for billing purposes.
2.1.3 The CITY shall provide the CONTRACTOR with information that is
necessary regarding collection for accounts that remain delinquent after
the CONTRACTOR has provided billing services.
-2-
3. PAYMENT FOR SERVICES
3.1 The CITY agrees to pay for services performed by the CONTRA.CTOR as
follows:
3.1.1 The charge of$27.00 per each billable transport and will be in effect for
a minimum of 2 years. Pricing will be reviewed and potentially adjusted
every 2 years.
3.2 The CONTRACTOR shall invoice the CTTY on a monthly basis for services
rendered and payment of each invoice shall be due within 30 days of the date of
the invoice.
4. TERM,DEFAULT,AND TERMINATION
4.1 This agreement shall be effective on the date �rst mentioned above and shall
extend through and include December 31, 2020 unless terminated prior to that
date pursuant to this Article Four.
4.2 If any one or more of the following occurs: (1) a payment due from CITY to
CONTRACTOR shall be and remain unpaid in whole or in part for more than
sixty (60) days after same is due and payable; (2) CITY shall violate or default
on any of the other covenant agreements, stipulations or conditions herein and
such violation or default shall continue for a period of ten(10) days after written
notice from CONTRACTOR of such violation or default;then it shall be optional
for CONTRACTOR, without further demand or notice,to declare this agreement
forfeited and the said Term ended and CONTRACTOR shall not be liable far
damages by reason of such termination; but notwithstanding termination by
CONTRACTOR,the liability of CITY for the payments provided herein shall not
be relinquished or extinguished for the services provided priar to termination.
CITY shall be responsible for, in addition to the payments agreed to be paid
hereunder, reasonable attorneys' fees and costs incuned by CONTRACTOR to
enforce the provisions of this Agreement or to collect the payments due
CONTRACTOR hereunder.
4.3 Each right or remedy of CONTRACTOR provided for in this agreement shall be
cumulative and shall be in addition to every other right or remedy provided for in
this agreement now or hereafter existing at law or in equity or by statute or
otherwise.
4.4 CONTRACTOR shall not be deemed to be in default under this agreement until
CITY has given CONTRACTOR written notice specifying the nature of the
default and CONTRA.CTOR does not cure such default within (30) days after
receipt of such notice or within such reasonable time thereafter as may be
necessary to cure such default where such default is of such a character as to
reasonably require more than thirty(30) days to cure.
_ 4.5 CITY or CONTRACTOR may terminate this agreement for any reason upon 60
days written notice.
-3-
5. INDEMNIFICATION
5.1 Each party agrees that it shall protect, indemnify and hold harmless from and
against all liabilities, actions, damages, claims, demands,judgment, losses, costs,
expenses, suits or actions and attorneys' fees, and shall defend the other in any
suit, including appeals, far loss ar damage to property caused by the negligent
acts or omissions of the indemnifying party, its agents or employees, in
connection with or as a result of this agreement,the performance of either party's
obligations hereunder or the performance of services governed by this agreement.
Neither party shall be required to reimburse, defend or indemnify the other party
for loss or claim due to the negligence of such other party. In case of joint or
concurrent negligence of the parties giving rise to a loss or claim against either
one or both, each shall have full rights of contribution against the other.
5.2 Each party shall promptly notify the other party of the assertion of any claim
against which the party is indemnified by the other party.
6. GENERAI,PROVISIONS
6.1 Nothing in this agreement is intended or shall be construed to create an employer
- employee relationship, a partnership, a joint venture, or a lessor-lessee
relationship between the parties.
6.2 Each party understands and agrees that it is responsible for payment of the
wages, salaries and bene�ts of its own employees and that the other party shall
not pay or withhold any sums for income tax,unemployment insurance, workers
compensation premiums, social security or any other withholding required by
law or any other agreement.
6.3 This agreement shall be interpreted, construed and governed by the laws of the
State of Minnesota.
6.4 This agreement may be amended or modified only in writing and signed by both
parties.
6.5 This agreement constitutes the entire agreement between the parties and shall
bind and inure to the benefit of the CITY and the CONTRACTOR and their
respective successors and assigns.
6.6 This agreement may be executed in multiple counterparts, each of which shall be
deemed an original, but all of which, taken together, shall constitute only one
agreement,
6.7 Any notice required or permitted under this agreement shall be deemed
sufficiently given or served if sent by United States certified mail, return receipt
requested,addressed as follows:
-4-
If to CONTRACTOR to:
Expert T.Billing Attention: Bill Schommer
400 Third Street
Farmington,Minnesota 55024
If to CITY to:
City of Cottage Grove
12800 Ravine Pkwy
Cottage Grove,MN 55016
CONTRACTOR and CITY shall each have the right from time to time to change
the place notice is to be given under this paragraph by written notice thereof to
the other party.
6.8 If any term or provision of this agreement shall to any extent be held invalid or
unenforceable, the remainder shall not be affected thereby, and each other term
and provision of this agreement shall be valid and be enforced to the fiillest
extent permitted by law. No receipts or acceptance by CONTRACTOR from
CITY of less than the monthly payments herein stipulated shall be deemed to be
other than a partial payment on account for any due and unpaid amounts; no
endorsement or statement of any check or any letter or other writing
accompanying any check or payment of rent to CONTRACTOR shall be deemed
an accord and satisfaction, and CONTRACTOR may accept and negotiate such
check or payment without prejudice to CONTRACTOR's rights to(i)recover the
remaining balance of such unpaid amounts or (ii) pursue any other remedy
provided in this agreement. Time is of the essence with respect to the due
performance of the terms, covenants and conditions herein contained.
6.9 HIl'AA BUSINESS ASSOCIATE ADDENDUM
The attached updated HIl'AA Business Associate Addendum is incorparated
herein in order to satisfy the requirements of the fmal and/or amended regulations
in compliance with the privacy regulations pursuant to Public Law 104-191 of
August 21, 1996,known as the Health Insurance Portability and Accountability
Act of 1996.
IN WITNESS WIIEREOF, each of the.parties hereto has caused this agreement to be executed
on its behalf by its duly authorized officer or other representatives on this day of
,2015.
CITY OF COTTAGE GROVE EXPERT T BII,LING
By: By;
Bill Schommer
Its: Its: President
By:
Its:
-5-
City of Cottage Grove
HIPAA Business Associate Agreement
THIS AGREEMENT is made effective, January 1, 2016 bjr and between EXPERT T
BILLING ("BUSINESS ASSOCIATE") and CITY OF COTTAGE GROVE , on
its own behalf and for the benefit of all present and future entities that are legal affiliates
of CITY OF COTTAGE GROVE. The purpose of this Agreement is to satisfy certain
obligations of Business Associate and CITY OF COTTAGE GROVE under the Health
Insurance Portability and Accountability Act of 1996 and its implementing regulations (45
C.F.R. Parts 160-64) ("HIPAA"), and the federal Health Information Technology for
Economic and Clinical Health Act ("HITECH Act")to ensure the integrity and
confidentiality of Protected Health Information ("PHl") and Electronic Protected Health .
Information ("EPHI").
I
In consideration of the foregoing and other good and valuable consideration, the ..
receipt and sufficiency of which are hereby acknowledged, Business Associate and CITY
OF COTTAGE GROVE agree as follows:
1. Definitions. Capitalized terms used, but not otherwise defined, in this
Agreement shall have the meanings given them in HIPAA. Nothing in this
definitions section shall be construed to conflict with the definitions contained in
HIPAA, the HITECH Act, or any regulations implementing the provisions of
HIPAA and the HITECH Act. For convenience of reference, the following are
applicable as of the Effective Date as follows:
1.1 "Breach" means the acquisition, access, use, or disclosure of protected
health information ("PHI") in a manner not permitted under HIPAA which
compromises the security or privacy of the PHI.
Breach excludes:
a. Any unintentional acquisition, access, or use of PHI by a workforce
member or person acting under the authority of a covered entity or
business associate if such acquisition, access, or use was made in good
faith and within the scope of authority and does not result in further use of
disclosure in a manner not permitted under HIPAA.
b. Any inadvertent disclosure by a person who is authorized to access PHI at
a covered entity or business associate to another person authorized to
access PHI at the same covered entity or business associate, or
organized health care arrangement in which the covered entity
participates, and the information received as a result of such disclosure is
notfurther used ordisclosed in a manner not permitted under HIPAA.
� 1
c. A disclosure of PHI where a covered entity or business associate has a
good faith belief that an unauthorized person to whom the disclosure was
made would not reasonably have been able to retain such information.
Except as provided in paragraph (a) of this definition, an acquisition, access, use, or
disclosure of protected health information in a manner that is not permitted under 45 .
C.F.R. Part 164, Subpart E is presumed to be a breach unless the covered entity
or business associate, as applicable, demonstrates that there is a low probability
that the protected health information has been compromised based on a risk
assessment of at least the following factors:
a. The nature and extent of the protected health information involved,
including the types of identifiers and the likelihood of re-identification;
b. The unauthorized person who used the protected health information or to
whom the disclosure was made; �
,
c. Wliether the protected health information was actually acquired or viewed;
and
d. The extent to which the risk to the protected health information has been
mitigated.
•"Covered Entity" means a health plan, health care clearinghouse, or a
healthcare provider who transmits any health information in connection with a
transaction that •fallswithin the scope of HIPAA, the HITECT Act, or any ,,
regulations implementing HIPAA and the HITECH Act.
1.2 "Electronic Protected Health Information" ("EPHI") means PHI that is
transmitted by electronic media or maintained in electronic media.
1.3 "Individually Identifiable Health Information" means information thatis
a subset of health information, including demographic information collected from
an individual, and (i) is created or received by a healthcare provider, health plan,
employer, or health care clearinghouse; and (ii) relates to the past, present, or
future physical or mental health or condition of an individual; the provision of
health care to an individual; or the past, present, or future payment for the
provision of health care to an individual; and (a)that identifies the individual, or
(b)with respect to which there is a reasonable basis to believe the information
can be used to identify the individual.
1.4 "Privacy Rule" means the Standards for Privacy of Individually
Identifiable Health Information at 45 C.F.R. Part 160 and Part 164, Subparts A
and E.
2
1.5 "Protected Health Information" ("PHI") means individually Identifiable
Health Information that Business Associate receives from CITY OF COTTAGE
GROVE or from another business associate of CITY OF COTTAGE GROVE or
which Business Associate creates for CITY OF COTTAGE GROVE which is �
transmitted or maintained in any form or medium. "Protected Health Information"
shall not include education records covered by the Family Educational Right and
Privacy Act, as amended, 20 U.S.C. §12329, or records described in 20 U.S.C.
§1232g (a)(4)(B)(iv), or employment records held by CITY OF COTTAGE GROVE
in its role as employer.
1.6 "Security Incident" means the attempted or successful unauthorized
access, use, disclosure, modification, or destruction of information or interference
with system operations in an information system.
1.7 "Security Rule" means the standards for security of electronically stored
protected health information as outlined at 45 C.F.R. Part 160 and Part 164,
Subparts A and E: --�
1.8 "Secretary" shall mean the Secretary of the United States Department of
Health and Human Services.
2. Applicability of Terms: Conflicts: This Agreement applies to all past, present,
and future contracts and relationships between Business Associate and CITY
OF COTTAGE GROVE, written or unwritten, formal or informal, in which CITY
OF COTTAGE GROVE provides any Protected Health Information to Business
Associate in any form whatsoever. This Agreement shall automatically be
incorporated in all subsequent agreements between Business Associate and
CITY OF COTTAGE GROVE involving the use or disclosure of Protected Health
Information whether or not specifically referenced therein. In the event of any
_ conflict or inconsistency between a provision of this Agreement and a provision �
of any other agreement between Business Associate and CITY OF COTTAGE
GROVE, the provision of this Agreement shall control unless: (i) CITY OF
COTTAGE GROVE specifically agrees to the contrary in writing, or (ii) the
provision in such other agreement establishes additional rights for CITY OF
COTTAGE GROVE or additional duties for or restrictions on Business Associate
with respect to Protected Health Information, in which case the provision of such
other agreement will control.
3. Obliaations and Activities of Business Associate.
3.1 Non-disclosure: Business Associate will not use or disclose Protected
Health Information other than as permitted or required by this Agreement or as
required by law or as otherwise authorized by CITY OF COTTAGE GROVE.
3
Business Associate must limit any use, disclosure, or request for use or
disclosure to the minimum amount necessary to accomplish the intended
purpose of the use, disclosure, or request inaccordance with the requirements of
H I PAA.
3.2 Safeguards: Business Associate will use appropriate safeguards to
prevent use or disclosure of the Protected Health Information other than as
provided for by this Agreement. Business Associate will develop, implement,
maintain and use appropriate administrative, technical and physical safeguards
to preserve the integrity and confidentiality of and to prevent non-permitted or
violating use or disclosure of Protected Health Information which is transmitted
electronically. Business Associate will document and keep these safeguards
current. Business Associate will also comply with all applicable security
standards outlined in the Security Rule with respect to EPHI. To the extent
. Business Associate perForms Covered Entity's obligations.under 45 C.F.R. Part
164, Subpart E, Business Associate shall comply with all requirements imposed
by 45 C.F.R. Part 164, Subpart E, in the performance of such obligations.
3.3 Mitigation: Business Associate will mitigate, to the extent practicable,
any harmful effect that is known to Business Associate of a use ofdisclosure of
Protected Health Information by Business Associate in violation of the
requirements of thisAgreement.
3.4 Reporting: Business Associate will report to the Privacy Officer of CITY OF
COTTAGE GROVE, in writing, any use and/or disclosure of Protected Health
Information that is not permitted or required by this Agreement or any security
incident of which Business Associate becomes aware. Such report shall be made
as soon as reasonably possible but in no event more than five (5) business days .
after discovery by Business Associate of such unauthorized use or disclosure or
security incident. This reporting obligation shall include breaches by Business
Associate, its employees, subcontractors and/or agents. Each such report under
this section will: (i) identify the nature of the�hon-permitted or violating use or
disclosure; (ii) identify the Protected Health Information used or disclosed; (iii)
identify who made the non-permitted or violating use or disclosure; (iv) identify
who received the non-permitted or violating use or disclosure; (v) identify what
corrective action Business Associate took or will take to prevent further non-
permitted or violating uses or disclosures;
(vi) identify what Business Associate did or will do to mitigate any deleterious
effect of the non-permitted or violating use or disclosure; and (vii) provide such
other information as CITY OF COTTAGE GROVE may reasonably request.
3.5 Agents and Subcontractors: Business Associate will ensure that any
agent, including a subcontractor, to whom it provides Protected Health
Information received from, or created or received by Business Associate on
behalf of, CITY OF COTTAGE GROVE agrees to the same restrictions
4
and conditions that apply through this Agreement to Business Associate with
respect to such information. In the event any subcontractors create, receive,
maintain, ortransmit EPHI on behalf of Business Associate, Business Associate
must ensure the subcontractors agree to comply with the applicable parts of the
Security Rule by entering into a contract or other arrangement that.complies with
45 C.R.F. § 164.314, as it may be amended from time to fime.
3.6 Access: Business Associate will provide access, within five (5) business
days of receiving a written request from CITY OF COTTAGE GROVE, to
Protected Health Information from a Designated Record Set of CITY OF
COTTAGE GROVE, to CITY OF COTTAGE GROVE (or, as directed by CITY
OF COTTAGE GROVE, to an individual) in order to meet the requirements
under 45 C.F.R. § 164.524. This provision does not apply if Business Associate
� and its employees, subcontractors and agents have no Protected Health �
Information from a Designated Record Set of CITY OF COTTAGE GROVE.
.Business Associate will allow CITY OF COTTAGE GROVE to audit Business
Associate's practices as necessary and appropriate.
3.7 Amendments: Business Associate will make, upon written request from
CITY OF COTTAGE GROVE, any amendment(s) to Protected Health
Information in a Designated Record Set of CITY OF COTTAGE GROVE that
CITY OF COTTAGE GROVE directs or agrees to pursuant to 45 C.F.R. §
164.526. This provision does not apply if Business Associate and 'its
employees, subcontractors and agents have no Protected Health Information
from a Designated Record Set of CITY OF COTTAGE GROVE.
3.8 Records: Business Associate will make internal practices, books, and-
records, including policies and procedures and Protected Health Information,
relating to the use and disclosure of Protected Health Information received from,
or created or received by Business Associate on behalf of, CITY OF COTTAGE
GROVE available to the Secretary during regular business hours within five (5)
business days of receiving a written request from CITY OF COTTAGE GROVE,
or sooner if requested by the Secretary, for purposes of the Secretary
determining CITY OF COTTAGE GROVE's compliance with HIPAA. .
3.9 Accounting for Disclosures: Business Associate will document such
disclosures by Business Associate and its employees, subcontractors and agents
of Protected Health Information and information related to such disclosures as
would be required for CITY OF COTTAGE GROVE to respond to a request by an
Individual for an accounting of disclosures of Protected Health Information in
accordance with 45 C.F.R. §164.528. Business Associate agrees to provide to
CITY OF COTTAGE GROVE (or an individual, at CITY OF COTTAGE
GROVE's request), within five (5) business days of
5
receiving a written request from CITY OF COTTAGE GROVE, information
collected in accordance with the preceding sentence, to permit CITY OF
COTTAGE GROVE to respond to a request by an Individual for such an
accounting of disclosures.
3.10 Alternative Communication: At CITY OF COTTAGE GROVE's
request, Business Associate will implement reasonable alternative means or
locations of communication with an Individual, as necessary to honor a request
granted by CITY OF COTTAGE GROVE pursuant to 45 C.F.R. §§
164.522 or 164.526, respectively. Except as the Agreement or any other
agreement between CITY OF COTTAGE GROVE and Business Associate may
provide otherwise, in the event Business Associate receives an access,
. amendment, disclosure accounting or confidential communications or other .
similar request directly from an Individual, Business Associate will redirect the
Individual to appropriate CITY OF COTTAGE GROVE personneL Business
Associate will maintain records related to disclosures of Protected Health
Information for at least six (6) years after the date of the disclosure.
4. Breach Notification.
Business Associate agrees not to use or disclose (or permit the use or disclosure
of) PHI in a manner that would violate the Privacy Rule or Security Rule if the
PHI were used or disclosed by CITY OF COTTAGE GROVE in the same manner.
Business Associate agrees to implement systems to discover and promptly report
any breach of unsecured PHI, as those terms are defined in 45
C.F.R. §164.402,as itmay beamendedfrom timetotime.
4.1. Notification: Business Associate shall, following the discovery of a
breach of unsecured PHI, notify CITY OF COTTAGE GROVE immediately, and
in no event later than three (3) calendar days after Business Associate discovers
such HIPAA breach, unless Business Associate is prevented from doing so by 45
C.F.R. § 164.412 concerning law enforcement investigations. For purposes of
reporting a HIPAA Breach to CITY OF COTTAGE GROVE, the discovery of a
HIPAA Breach shall occur as of the first day on which such HIPAA Breach is
known to the Business Associate or, by exercising reasonable diligence, would
have been known to the Business Associate. Business Associate will be
considered to have had knowledge of a HIPAA Breach if the HIPAA Breach is
known, or by exercising reasonable diligence would have been known, to any
person (other than the person committing the HIPAA Breach)who is an
employee, officer or other agent of the Business Associate.
No later than seven (7) calendar days following discovery of a breach,
Business Associate shall provide CITY OF COTTAGE GROVE with sufficient
information to permit CITY OF COTTAGE GROVE to comply with the HIPAA
Breach notification requirements set forth at 45 C.F.R. § 164:400
6
etseq. Specifically, ifthefollowing information is knownto(orcan be reasonably
obtained by)the Business Associate, Business Associate will provide CITY OF
COTTAGE GROVEwith:(i)contactinformationforindividualswhowereorwho
may have been impacted bythe HIPM Breach (e.g.,first and last name,
mailing address, street address, phone number, email address) (ii) a brief
description ofthe circumstances ofthe HIPM Breach, including the date ofthe
HIPM Breach and date of discovery; (iii)a description ofthe types of unsecured
PHI involved in the HIPM Breach (e.g., names, social security number, date of
birth, address(es), account numbers of any type, ciisability codes, diagnostic
and/or billing codes and similarinformation);and(iv)a briefdescription ofwhat
the BusinessAssociate has done or is doing to investigate the HIPAA Breach,
mitigate harm to the individual(s) impacted by the HIPM Breach, and protect
againstfuture HIPM Breaches: Following a HIPAABreach, BusinessAssociate
will have a continuing dutyto inform CITY OF COTTAGE GROVE of new
information learned by Business Associate regarding the HIPM Breach,
_ including but not limited to the information described in items (i) through (iv),
above.
4.2 Data Breach Notification and Mitigation Under Other Laws: Business
Associate agrees to implement reasonable systems for the discovery and prompt
reporting of any breach of individually identifiable information (including but not
limited to Protected Health Information, and referred to hereinafter as
"Individually Identifiable Information") that, ifmisused, disclosed, lost or stolen,
CITY OF COTTAGE GROVE believes would trigger an obligation under one or
more State data breach notification laws (each a."State Breach") to notify the
individuals who are the subject of the information. Business Associate agrees
that in the event any Individually Identifiable information is lost, stolen, used or
disclosed in violation of one or more State data breach notification laws,
Business Associate shall promptly: (i) cooperate and assist CITY OF COTTAGE
GROVE with any investigation into any State Breach or alleged State Breach; (ii)
cooperate and assist CITY OF COTTAGE GROVE with any investigation into
any State Breach or alleged State Breach conducted by any State Attorney
General or State Consumer Affairs Department (or their respective agents); (iii)
comply with CITY OF COTTAGE GROVE determinations regarding CITY OF
COTTAGE GROVE's and Business Associate's obligations to mitigate to the
extent practicable any potential harmto the individuals impacted by the State
Breach; and (iv) assist with the implementation of any decision by CITY OF
COTTAGE GROVE or any State agency, including any State Attorney General
or State Consumer Affairs Department (or their respective agents), to notify
individuals impacted or potentially impacted by a State Breach.
4.3 Breach Indemnification: Business Associate shall indemnify, defend
and hold CITY OF COTTAGE GROVE and its city council members, officers,
directors, employees, agents, successors, and assigns harmless, from and
against all reasonable losses,claims, actions, demands, liabilities, damages,
7
costs and expenses (including costs of judgments, settlements, court costs and
reasonable attorneys' fees actualiy incurred) (collectively, "Information Disclosure
Claims") arising from or related to: (i) the use or disclosure of Individually
Identifiable Information (including Protected Health Information) by Business
Associate, its employees, agents, or subcontractors in violation of the terms of
this Agreement or applicable law, and (ii) whether in oral, paper or electronic
media, any HIPAA Breach of unsecured Protected Health Information and/or
State Breach of Individually Identifiable Information by Business Associate, its
employees, agents, or subcontractors.
To the extent permitted by law, CITY OF COTTAGE GROVEshall
indemnify, defend and hold Business Associate and its officers, directors,
. employees, agents, successors and assigns harmless,,from and against all.
reasonable losses, claims, actions, demands, liabilities, damages, costs and
expenses (including costs of judgments, settlements, court costs and reasonable
attorneys' fees actually incurred) (collectively, "Information Disclosure Claims")
arising from or related to: (i) the user or disclosure of Individually Identifiable
Information (including PHI) by CITY OF COTTAGE GROVE, its subcontra�tors,
agents, or employees in violation of the terms of this Agreement or applicable
law, and (ii) whether in oral, paper or electronic media, any HIPAA Breach of
unsecured PHI and/or State Breach of Individually Identifiable Information by
CITY OF COTTAGE GROVE, its subcontractors, agents, or employees.
Business Associate shall not be considered a subcontractor of CITY OF
COTTAGE GROVE under this indemnification section.
4.4 CITY OF COTTAGE GROVE'S Breach Notification Duties: CITY OF
COTTAGE GROVE shall, following the discovery of a breach of unsecured PHI,
provide notification in accordance with its Breach Notification Policy.
5. Permitted Uses and Disclosures bv Business Associate.
5.1 Functions and Activities on CITY OF COTTAGE GROVE's Behalf.
Except as otherwise limited in this Agreement or any other agreement between
Business Associate and CITY OF COTTAGE GROVE, Business Associate may
use or disclose Protected Health Information on behalf of, or to provide services
to, CITY OF COTTAGE GROVE only for purposes authorized by CITY OF
COTTAGE GROVE in a separate written agreement or through specific oral
instruction, if such use or disclosure of Protected health Information would not
violate HIPAA if done by CITY OF COTTAGE GROVE itself. The uses specified
in such separate written agreements are incorporated herein by reference.
5.2 Disclosures of PHI. Business Associate shall not use or disclose PHI
unless authorized by this agreement or permitted by law. Except as otherwise
limited in this Agreement or any other agreement between BusinessAssociate
8
and CITY OF COTTAGE GROVE: (a) Business Associate may use Protected
Health Information for Business Associate's proper management administration or
to carry out Business Associate's legal responsibilities; (b) Business Associate may
disclose Protected Health Information for Business Associate's proper
management and administration, provided.that disclosures are Required By Law, . :
or Business Associate obtains reasonable assurances from the person to whom
the Protected Health Information is disclosed that (i)it will remain confidential and
will be used or further disclosed only as Required By L.aw or for the purpose for
which it was disclosed to the person, and (ii)the person will notify Business
Associate of any instances of which it is aware in which the confidentiality of the
Protected Health Information has been breached.
5.2 Minnesota Government Data Practices Act. Government data made
� available to Bu'siness Associate in performing its functions pursuant to this or �
other agreement with CITY OF COTTAGE GROVE shall be administered
consistent with the Minnesota Government Data Practices Act, Minn. Stat. Ch.
13. Insofar as, under this or other agreement, Business Associate performs any
function of CITY OF COTTAGE GROVE, data created, collected, received,
stored, used, maintained or disseminated by Business Associate in perForming that
function is subject to the requirements of Minn. Stat. Ch. 13, and Business
Associate must comply with those requirements. This agreement does not permit
Business Associate to provide access to public data to the public.
6. "Tradina Partner" Provisions: Use and Disclosure in Connection with
Standard Transactions. If Business Associate conducts Standard Transactions (as
defined in 45 C.F.R. Part 162)for or on behalf of CITY OF COTTAGE GROVE,
Business Associate will comply, and will require each subcontractor or agent involved
with the conduct of such Standard Transactions to comply, with each applicable
requirement of 45 C.F.R. Part 162. Business Associate will not enter into, or permit
its subcontractors or agents to enter into, any trading partner agreement in connection
with the conduct of Standard Transactions for or on behalf of CITY OF COTTAGE
GROVE that: (i) changes the definition, data condition, or use of a data element or
segment in a standard or operating rule, except where necessary to implement State
or Federal law, or to protect against fraud and abuse; (ii) adds any data elements or
segments to the maximum defined data set; (iii) uses any code or data element that is
marked "not used" in the Standard Transaction's implementation specification or is not
in the Standard Transaction's implementation specification; or(iv) changes the
meaning or intent of the Standard Transaction's implementation specification.
7. 7"erm and Termination.
7.1. Term. The term of this Agreement shall commence as of the Effective
� Date, and shall terminate when all of the Protected Health Informationprovided
by CITY OF COTTAGE GROVE to Business Associate, or created or received
by Business Associate on behalf of CITY OF COTTAGE GROVE, is destroyed or
returned to CITY OF COTTAGE GROVE, or, if itis infeasible to return or destroy
Protected Health Information, protections are extended to such Protected Health
9
Information in accordance with the provisions of this Section 7.
7.2 Termination for Cause. As provided in HIPAA, including 45 C.F.R. §
164.504(e)(2)(iii), upon CITY OF COTTAGE GROVE's reasonable
determination that Business Associate has breached a material term of this
Agreement, CITY OF COTTAGE GROVE shall be entitled to do anyone or
more of the following:
(a) Give Business Associate written notice of the existence of such breach
and given Business Associate an opportunity to cure upon mutually
agreeable terms. If Business Associate does not cure the breach or end
the violation according to such terms, or if CITY OF COTTAGE GROVE �
and Business Associate are unable to agree upon such terms, CITY OF
COTTAGE GROVE may immediately terminate any agreement between
CITY OF COTTAGE GROVE and Business Associate which is the
subject of such breach. � �
(b) Immediately terminate any agreement between CITY OF COTTAGE
GROVE and Business Associate which is the subject of such breach.
(c) Immediately stop all further disclosures of Protected Health Information
to Business Associate.
7.3 Effect of Termination. Upon receipt of written demand from CITY OF
COTTAGE GROVE, Business Associate agrees to immediately return or
destroy, except to the extent infeasible, all Protected health Information
demanded by CITY OF COTTAGE GROVE, including all such Protected Health
Information which Business Associate has disclosed to its employees,
subcontractors and/or agents. Destruction shall include destruction of all copies
including backup tapes and other electronic backup medium. In the event the
return or destruction of some or all such Protected Health Information is
infeasible, Protected Health Information not returned or destroyed pursuant to
this paragraph shall be used or disclosed only for those purposes that make
return or destruction infeasible.
7.4 Continuing Privacy Obligation. Business Associate's obligation to
protect the privacy of Protected Health Information is continuous and survives any
termination, cancellation, expiration, or other conclusions of this Agreement or
any other agreement between Business Associate and CITY OF COTTAGE
GROVE.
10
8. Notices. All notices pursuant to this Agreement must be given in writing and
shall be effective when received if hand-delivered or upon dispatch if sent by
reputable overnight delivery service, facsimile or U.S. Mail to the appropriate
address or facsimile number as set forth at the end of this Agreement. �
9. Miscellaneous. Business Associate and CITY OF COTTAGE GROVE agree that
individuals who are the subject of Protected Health Information are not third-party
beneficiaries of this Agreement. In the event that any provision of this Agreement
violates any applicable statute, ordinance or rule of law in any jurisdiction that
governs this Agreement, such provision shall be ineffective to the extent of such
violation without invalidating any other provision of this
Agreement. This Agreement may not be amended, altered or modified except by
written agreement signed by Business Associate and CITY OF COTTAGE
� GROVE. No provision of this Agreement may be waived except by an agreement in
, writing signed by the waiving party. A waiver of any term or provision shall not be
construed as a waiver of any other term or provision.
Nothing in Section 3 of this Agreement shall be deemed a waiver of any legally-
recognized claim of privilege available to Business Association. The persons
signing below have the right and authority to execute this Agreement for their
respective entities and no further approvals are necessary to create a binding
Agreement. Neither CITY OF COTTAGE GROVE nor Business Associate shall
use the names or trademarks of the other party or of any of .the respective
party's affiliated entities in any advertising, publicity, endorsement, or promotion
unless prior written consent has been obtained for the particular use
contemplated. All references herein to specific statutes, codes or regulations
shall be deemed to be references to those statutes, codes or regulations as may
be amended from time to time.
1a. Independent Contractor. Nothing in this Agreement shall be construed to
create (i) a partnership, joint venture or otherjoint business relationship between
the parties or any of their affiliates, or(ii)a relationship of employer and
employee between the parties. Business Associate is an independent
. contractor, not an agent of CITY OF COTTAGE GROVE.
[SIGNATURE PAGE FOLLOWS]
11
BUSINESSASSOCIATE
BY� Date:
Bill Schommer
Its: President
Address for notices:
Expert T Billing
400 Third Street
Farmington, MN 55024 �
CITY OF COTTAGE GROVE
BY� Date:
Its:
BY� Date:
its:
Address for notices:
12