No preview available
HomeMy WebLinkAboutC11-335 Medical Care Advocacy Services MEDICAL CARE ADVOCACY SERVICES AGREEMENT with EAGLE COUNTY, COLORADO Effective date: October 1, 2011 This MEDICAL CARE ADVOCACY SERVICES AGREEMENT, effective October 1, 2011 is made by and between EAGLE COUNTY, COLORADO, a body corporate and politic ( "Employer ") and MEDCOM CARE ADVOCACY, LLC., a Louisiana limited liability company ( "Care Advocates ") to provide medical advocacy services to the employees of the Employer. WHEREAS, Employer desires that a third party provide certain medical advocacy services to its employees; and WHEREAS, Care Advocates is in the business of providing and desires to provide such advocacy services, more fully described below. NOW, THEREFORE, in consideration of the promises and agreements contained herein, the Employer and Care Advocates agree as follows: 1. SERVICES. Care Advocates shall provide the following medical care advocacy services .( "Medical Care Advocacy Services ") for the employees and their dependents and /or parents: BenefitBasics, which provides benefit coverage assistance, including assistance with benefit questions, billing issues, eligibility questions, finding prescription alternatives, understanding Explanation of Benefits, and explaining certain medical plan terms like coordination of benefits, deductibles, co- payments, out -of- pockets, pre - authorizations, and pre- existing; ClannsAssist, which provides claims assistance, including assistance with filing appeals, investigation claim issues, provider billing issues, explaining claim denials and payments due providers, and facilitating coordination of benefits filings and provider discussions regarding reasonable and customary charges; CareChoice, which provides medical care coordination assistance, including assistance with bill reviews, referrals, coordinating testing, locating physicians, scheduling appointments, preparing for office visits, preparing for surgery and post surgery, coordinating home -care, lodging, transportation or transfers, and facilitating the transfer of medical records; ParentCare, which provides care coordination for elderly parents, including assistance with bill reviews, referrals, coordinating testing, locating physicians, scheduling appointments, preparing for office visits, preparing for surgery and post surgery, coordinating home -care, lodging, transportation or transfers, facilitating the transfer of medical records, assisting with Medicare and Medicaid questions, and providing alternative treatment information, disease state information, information on community services and prescription information; and if chosen for an additional fee, to be paid by the employee, C ( ( -336 CafrSavings, which provides bill negotiation, audit review and a prescription membership program discount card. The classes of Medical Care Advocacy Services to be provided pursuant to this Agreement and their corresponding fees are indicated on the Fee Schedule attached hereto. Medical Care Advocacy Services is initiated by MedCom's receipt of either a written or oral request from the employee. Care Advocates shall have the right to limit the services if it beeves that the requested volume is beyond what Care Advocates deems as reasonable and customary in the industry. MedCom's medical care advocacy services are provided solely for assisting employees and their dependents and /or parents in their continuing medical care and are not intended for legal or insurance concerns, including medical malpractice lawsuits. 2. COMPENSATION. Care Advocates shall be compensated for providing the Medical Cate Advocacy Services as described in detail in Section 1- Services above in the amount set forth in the attached Fee Schedule, subject to the terms and conditions set forth herein. The Be e it Basics, ClaimsAssist, CareChoice, ParentCare, and EnrollAssist, if selected, services wi be charged to the Employer at a per employee per month fee. The CareSavings service if chosen by the employee will be charged directly to the employee as a percentage of savings or a cost plus percentage fee. For example, if an employee requests that Care Advocates negotiate a dispount with a provider, the employee will be charged 20% of the savings obtained. Additionally, if an employee requests that Care Advocates audit a bill, Care Advocates will utilize the services of a physician to perform the audit, and that physician's flat fee will be charged to the employee in addition to the percentage charged by Care Advocates. Eagle County shell not be responsible for any fees or costs incurred by its employees in connection with the Cate Savings assistance offered by Care Advocates. Any modifications to the terms set forth in the Fee Schedule shall be specified in writing signed by Care Advocates and the Employer. Care Advocates reserves the right, effective on each anniversary date of this Agreement, to modify its Meidical Care Advocacy Services fees. In the event any such modification would increase fees by more than 3 %, Care Advocates shall be required to provide Employer thirty (30) days written notice prior to such increase becoming effective. Payments are due when billed and must be paid within 30 days. Care Advocates may charge a penalty of 10% on amounts not timely paid and in addition, at its option, Care Advocates may cease to provide services until all amounts due and paid in full. If there are no modifications and fee increases, the agreement will automatically review on its anniversary date, January 1, 2013, and every subsequent 12 month period with no need for a written amendment. Notwithstanding anything to the contrary contained in this Agreement, Eagle County sh 11 have no obligations under this Agreement after, nor shall any payments be made to Care A ocates in respect of any period after December 31, 2012 without an appropriation therefore by County in accordance with a budget adopted by the Board of County Commissioners in co pliance with Article 25, Title 30 of the Colorado Revised Statutes, the Local Government Bu get Law (C.R.S. § 29 -1 -101 et seq.) and the TABOR Amendment (Colorado Constitution, Article X, Sec. 20). 3. MPLOYER RESPONSIBILITIES . Employer hereby authorizes Care Advocates to have the use of all data reasonably necessary for the services to be performed, including coverage descriptions EAGLE COUNTY, COLORADO Medical Care Advocacy Services Agreement Page 3 or medical plan documents, and any amendments thereto, helpful to the particular care advocacy service requested. Employer shall also provide Care Advocates with eligibility data on a monthly basis. In the limited instances when Care Advocates will need individual protected health information, a HIPAA Patient Authorization Form will be executed and provided to Care Advocates by the employee on a case -by -case basis in order to allow Care Advocates to perform the selected advocacy service. Care Advocates cannot warrant the accuracy or completeness of the medical records it obtains from any identified source. Illegal Aliens — Public Contracts for Services, and this Agreement. By execution of this Agreement, Care Advocates certifies that it does not knowingly employ or contract with an illegal alien who will perform under this Agreement and that Care Advocates will participate in the E- verify Program or other Department of Labor and Employment program ( "Department Program ") in order to confirm the eligibility of all employees who are newly hired for employment to perform Services or Additional Services under this Agreement. A. Care Advocates shall not: (i) Knowingly employ or contract with an illegal alien to perform Services or Additional Services under this Agreement for services; or (ii) Enter into a contract with a subcontractor that fails to certify to Care Advocates that the subcontractor shall not knowingly employ or contract with an illegal alien to perform work under the public contract for services. B. Care Advocates has confirmed the employment eligibility of all employees who are newly hired for employment to perform Services or Additional Services under this Agreement through participation in the E- verify Program or Department Program, as administered by the United States Department of Homeland Security. Information on applying for the E- verify program can be found at: http:// www .dhs.gov /xprevprot/programs /gc 1185221678150. shim C. Care Advocates shall not use either the E- verify program or other Department Program procedures to undertake pre - employment screening of job applicants while the public contract for services is being performed. D. If Care Advocates obtains actual knowledge that a subcontractor performing work under the public contract for services knowingly employs or contracts with an illegal alien, Care Advocates shall be required to: (i) Notify the subcontractor and ECHDA within three days that Care Advocates t has actual knowledge that the subcontractor is employing or contracting with an illegal alien; and (ii) Terminate the subcontract with the subcontractor if within three days of receiving the notice required pursuant to subparagraph (i) of the paragraph (D) • EAGLE COUNTY, COLORADO Medical Care Advocacy Services Agreement Page 4 the subcontractor does not stop employing or contracting with the illegal alien; except that Care Advocates shall not tenninate the contract with the subcontractor if during such three days the subcontractor provides information to establish that the subcontractor has not knowingly employed or contracted ' with an illegal alien. E. Care Advocates shall comply with any reasonable request by the Department of Labor and Employment made in the course of an investigation that the department is undertaking pursuant to its authority established in C.R.S. § 8- 17.5- 102(5). F. If Care Advocates violates these prohibitions, Eagle County may terminate the Agreement for a breach of the contract. if the Agreement is so terminated specifically for a breach of this provision of this Agreement, Care Advocates shall be liable for actual and consequential damages to Eagle County as required by law. G. Eagle County will notify the office of the Colorado Secretary of State if Care Advocates violates this provision of this Agreement and Eagle County terminates the Agreement for such breach. 4. 1 CONFIDENTIALITY AND PRIVACY. Care Advocates shall own all data, documents, and software used or generated by it in its Medical Care Advocacy Services and shall have the right to retain copies of any documents provided to it by Employer or the employee. If applicable, Employer acknowledges that all medical, financial, and personal information collected and provided to are Advocates by its employees in connection with the Medical Care Advocacy Services, and any patient advocacy encounter reports generated by Care Advocates and provided to Employer upon request, are confidential and will not be released, disclosed, or published except to the persons to whim disclosure is required by law. Employer shall not have access to any Care Advocates system used in providing the services. Employer shall enter into a Business Associate Agreement ( "BAA ") with Care Advocates, which will control the handling of the employee's protected health information. Thi BAA will be attached as an addendum to this service Agreement. (Addendum # 1). 5. INDEMNIFICATION. To the extent permitted by law each party agrees: Care Advocates indemnifies and holds harmless Employer with respect to any actually adjudicated claims, suiljs, actions, liabilities, and costs of any kind brought against Employer, arising from Care Ad ocate's performance of services hereunder, only to the extent it is determined that such claim, sui action, liability, or cost was caused by or resulted from the willful misconduct or the dishonest, fra dulent or criminal acts of Care Advocates, its employees or authorized agents. Employer ind mnifies and holds harmless Care Advocates its employees and authorized agents with respect to an and all actually adjudicated claims, suits, actions, liabilities, and costs of any kind brought agnst Care Advocates, its employees or its authorized agent, arising from Employer's material brelich of any of its duties under this Agreement, or any other violation of this Agreement. EAGLE COUNTY, COLORADO Medical Care Advocacy Services Agreement Page 5 • 6. MISCELLANEOUS. a. Entire Agreement, Governing Law and Notice. This is the entire agreement between the parties and supersedes any oral understandings. This Agreement will be construed and interpreted under the laws of the United States and the State of Colorado, and the forum for any unresolved dispute will be Eagle County, Colorado. The parties shall abide by all applicable federal and state laws throughout the term of this agreement. All notices hereunder shall be in writing and delivered by hand, by regular mail, by certified mail with return receipt requested, or by overnight delivery, unless otherwise specified in writing. Notices shall be addressed as follows: lfto MedCom: If to Employer : MedCom Care Advocacy, LLC EAGLE COUNTY COLORADO 2100 Covington Centre Post Office Box 850 Covington LA 70433 500 Broadway 1 -985- 898 -1694 Eagle, Colorado 81631 Toll Free: 1 -800- 643 -4416 970- 328 -8796 Attn: Lisa Ponder, Human Resource Director a. Customer Call Center. Advocacy care services are handled by qualified clinicians and customer services representatives on Monday — Friday from the hours of 7:00 a.m. to 7:00 p.m. Central. Standard Time, excluding nationally recognized holidays. The dedicated toll free number 1- 866 - 891 -3306. b. Force Majeure. Neither party shall be liable to the other for any delay or failure to perform due to causes beyond its reasonable control, which shall include, but are not limited to those delays or performance failures caused by acts of God, acts of war, terrorism, riot, or civil commotion, computer equipment and/or systems failures, including loss of data, electrical failures, communications system failures, computer viruses, computer wonns, or an act of State, strikes, fire, flood, or the occurrence of any other event beyond the control of the parties hereto. c. Succession and Assignment. This Agreement shall be binding upon and inure to the benefit of the parties named herein and their respective successors and permitted assigns. No party may assign either this Agreement or any of its rights, interest, or obligations hereunder without the prior written approval of the other party; provided however that Employer may assign any or all of its rights and interest hereunder to any assignee that acquires all, or substantially all, of the assets of Employer and assumes its obligations hereunder. E4GLE COUNTY, COLORADO Medical Care Advocacy Services Agreement Page 6 d. No Modification or Waiver. This Agreement shall not be modified or amended except by a further written document signed by the parties. No provision may be waived except by an agreement in writing signed by the waiving party. A waiver of any tern or provision shall not be construed as a waiver of any other term or provision. e. Payroll and Other Taxes. Care Advocates shall pay all taxes imposed by any federal, state or local taxing authority on all payrolls and compensation of its employees and subcontractors and any other taxes, fees and charges le'yied against Care Advocates on account of this Agreement. f. Independent Contractor Status. T performancc of work and services b agreement for the er .o This Agreement constitutes an L p by Care Advocates as an independent contractor and not as an employee of Eagle County_ Nothing contained in this Agreement shall be deemed to create a relationship of employer - employee, master- servant, partnership, joint venture or any other relationship between Care Advocates and Eagle County except that of independent contractor. Care Advocates shall have no authority to bind Eagle County or to approve any additional or other services, unless specifically approved by Employer in writing. g. Insurance Coverages. C re Advocates shall maintain insurance coverages with appropriate limits as other like providers in th same industry. 7 . TERMINATION. The term of this Agreement shall be fifteen months from the effective d e of this Agreement, from October 1, 2011 through December 31, 2012. This Agreement shall be automatically renewed from year to year thereafter. This Agreement may be terminated by either palrty, without cause, upon ninety (90) days written notice by registered mail to the other advising of the intended termination. Such termination shall be effective on any date that is ninety (90) days after said written notice. Upon termination of this Agreement, should there be any care advocacy services, which require additional work beyond the termination date, upon Employer's [Association's] request, Care Advocates may continue to render such service, but is not obligated to do so. If Care Advocates agrees to provide additional care advocacy services, a new fee and duration for providing such post - tetm service, not to exceed 6 months, will be negotiated by Care Advocates and the Employer, or by Care Advocates and the employee, whichever is applicable, depending upon the class of service requested. All Medical Care Advocacy Services performed prior to the termination date shall be billed to and paid by Employer or employee who chose the CaJeSavin s assistance. Care Advocates will provide a report to Employer of cases open as of the termination date, upon request_ EAGLE COUNTY, COLORADO Medical Care Advocacy Services Agreement Page 7 IN WITNESS WHEREOF, this Agreement is executed by authorized representatives of the parties. MEDCOM CARE ADVOCACY, LLC. i EAGLE COUNTY, COLORADO ( "Care Advocates" By and through its c i /� 4119, � Uri tirtl�t � �, �; % �.� BY: �` ; r , .v� By _ -_ , i Print Name: All y! _ ( } t l*j Print Name: J� WI iii , Title: Chief Administrative Officer Title: Gla.air444afi (',OV IIIli MA-14 A - 4/C--. Date: iota()) ( 1 Ot(\k WO GI SBARDAI- ;/19456 v2- MedCom Caro Advocacy_Scrvices. DOC 20110016 • • E GLE COUNTY, COLORADO M ical Care Advocacy Services Agreement Pae 8 MEDICAL CARE ADVOCACY SERVICES AGREEMENT with EAGLE COUNTY COLORADO Effective date: October 1, 2011 FEE SCHEDULE As consideration for providing the services listed below and described in detail in Section 1. Setvices, pursuant to the Medical Care Advocacy Services Agreement between EAGLE COUNTY, COLORADO, a body corporate and politic ( "Employer"), and MedCom Care Advocacy, ( "Care Advocates "), effective October 1, 2011, Employer agrees to pay to Care Advocates the fee associated with each such service listed below as follows: Services Fee To be paid by Employer • Set - up fee (one time only) Waived • Benefit Basics, ClainzsAssist, CareChoice $3.00 per employee per month ParentCare • EnrollAssist $N /A per employee per month MEDCOM CARE ADVOCACY, LLC. EAGLE COUNTY COLORADO ( "Care Advocates ") By and through its Board of County ' Commissioners L ' II By : t. A L/t: / 41 By -- -- Print Name: She P. Lai , rd Print Name: Jon Stavney Title: Chief Administrative Officer Title: Date: (aO1\. \ - — Date: EAGLE COUNTY, COLORADO Medical Care Advocacy Services Agreement Page 9 BUSINESS ASSOCIATE AGREEMENT Addendum # 1 to Medical Care Advocacy Services Agreement Minimum Legal Requirements 1. PREAMBLE EAGLE COUNTY COLORADO ( "Covered Entity"). and MEDCOM CARE ADVOCACY, LLC. ( "Business Associate) (jointly "the Parties ") wish to execute this Addendum to comply with the requirements of: (i) the implementing regulations at 45 C.F.R Parts 160, 162, and 164 for the Administrative Simplification provisions of Tide II, Subtitle F of the Health Insurance Portabi and Accountability Act of 1996 ("HIPAA") (i.e., the HIPAA Privacy Rule, the HIPAA Security Standards, and the HIPAA Standards for Electronic Transactions (collectively referred to in this Addendum as "the HIPAA Regulations ")), and (ii) the requirements of the Health Information Technology for Economic and Clinical Health Act, as incorporated in the American Recovery and Reinvestment Act of 2009 (the "HITECH Act ") that are applicable to business associates, along with any guidance and /or regulations issued by the U.S. Department of Health and Hunan Services ( "DHHS "). Covered Entity and Business Associate agree to incorporate into this Addendum any regulations issued by DHHS with respect to the HITECH Act that relate to the obligations of business associates and that are required to be reflected in a business associate agreement. Business Associate recognizes and agrees that it is obligated by law to meet the applicable provisions of the I IITECH Act. This Addendum is effective October 1, 2011. 2. DEFINITIONS (a) "Electronic PHI" shall mean protected health information that is transmitted or maintained in any electronic media, as this term is defined in 45 C.F.R. § 160.103. (b) "Protected Health Information" or "PHI" shall mean information created or received by a health care provider, health plan, employer, or health care clearinghouse, that: (i) relates to the past, present, or future physical or mental health or condition of an individual, provision of health care to the individual, or the past, present, or future payment for provision of health care to the individual; (ii) identifies the individual, or with respect to which there is a reasonable basis to believe the information can be used to identify the individual; and (iii) is transmitted or maintained in an electronic medium, or in any other form or medium. The use of the term "Protected I- Iealth Information" or "PHI" in this Addendum shall mean both Electronic P1II and non - electronic PHI, unless another meaning is clearly specified. (c) "Security Incident" shall mean the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with systein operations in an information system. (d) All other capitalized terms used in this Addendum shall have the meanings set forth in the applicable definitions under the HIPAA Regulations and /or the security and privacy EAGLE COUNTY, COLORADO Medical Care Advocacy Services Agreement Page 10 provisions of the HITECH Act that are applicable to business associates along with any regulations issued by the DHHS. 3. GENERAL TERMS (a) In the event of an inconsistency between the provisions of this Addendum and a mandatory term of the H1PAA Regulations (as these terms may be expressly amended from time to time by the DHHS or as a result of interpretations by the DHHS, a court, or another regulatory agency with authority over the Parties), the interpretation of the DIMS, such court or regulatory agency shall prevail. In the event of a conflict among the interpretations of these entities, the conflict shall be resolved in accordance with rules of precedence. (b) Where provisions of this Addendum are different from those mandated by the HIPAA Regulations or the HITECII Act, but are nonetheless permitted by the Regulations or the Act, the provisions of this Addendum shall control. (c) Except as expressly provided in the IIIPAA Regulations, the HITECH Act, or this Addendum, this Addendum does not create any rights in third parties. 4. SPECIFIC REQUIREMENTS (a) Privacy of Protected Health Information (i) Permitted Uses and Disclosures of PHI. Business Associate agrees to create, receive, use, or disclose PHI only in a manner that is consistent with this Addendum or the HIPAA Privacy Rule and only in connection with providing the services to Covered Entity identified in the services agreement. Accordingly, in providing services to or for the Covered Entity, Business Associate, for example, will be permitted to use and disclose PIII for "treatment, payment, and health care operations" in accordance with the I 41PAA Privacy Rule. (1) Business Associate shall report to Covered Entity any use or disclosure of PHI that is not provided for in this Addendum. (2) Business Associate shall maintain safeguards as necessary to ensure that PHI is not used or disclosed except as provided for by this Addendum. (ii) Business Associate Obligations. As permitted by the HIPAA Privacy Rule, Business Associate also may use or disclose PHI received by the Business Associate in its capacity as a Business Associate to the Covered Entity for Business Associate's own operations if: • EAGLE COUNTY, COLORADO Medical Care Advocacy Services Agreement Page 11 (1) the use relates to: (1) the proper management and administration of the Business Associate or to carry out legal responsibilities of the Business Associate, or (2) data aggregation services relating to the health care operations of the Covered Entity; or (2) the disclosure of information received in such capacity will be made in connection with a function, responsibility, or services to be perforrned by the Business Associate, and such disclosure is required by law or the Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will be held confidential and the person agrees to notify the Business Associate of any breaches of confidentiality. (iii) Minimum Necessary Standard and Creation of Limited Data Set. Business Associate's use, disclosure, or request of PHI shall utilize a Limited Data Set if practicable. Otherwise, in performing the functions and activities as specified in the services agreement and this Addendum, Business Associate agrees to use, disclose, or request only the minimum necessary PHI to accomplish the intended purpose of the use, disclosure, or request. (iv) Access. In accordance with 45 C.F.R. § 164.524 of the HIPAA Privacy Rule and, where applicable, in accordance with the HITECH Act, Business Associate will make available to those individuals who are subjects of PHI, their PH1 in Designated Record Sets by providing the PHI to Covered Entity (who then will share the PI41 with the individual), by forwarding the PHI directly to the individual, or by making the PIII available to such individual at a reasonable time and at a reasonable location. Business Associate shall make such information available in an electronic format where directed by the Covered Entity. (v) Disclosure Accounting. Business Associate shall make available the information necessary to provide an accounting of disclosures of PHI as provided for in 45 C.F.R. § 164.528 of the IIIPAA Privacy Rule. Where so required by the HITECH Act and /or any accompanying regulations, Business Associate shall make such information available directly to the individual. Business Associate further shall provide any additional information to the extent required by the HITECH Act and any accompanying regulations. (vi) Amendment. Business Associate shall make available PHI for amendment and incorporate any amendment to PI11 in accordance with 45 C.F.R. § 164.526 of the HIPAA Privacy Rule. (vii) Availability of Books and Records. Business Associate shall make available to the DHHS or its agents the Business Associate's internal practices, books, and records relating to the use and disclosure of P111 in connection with this Addendum. EAGLE COUNTY, COLORADO M‘dical Care Advocacy Services Agreement Page 12 (b) Information and Security Standards (i) Business Associate will develop, document, implement, maintain, and use appropriate administrative, physical, and technical safeguards consistent with (and as required by) the HIPAA Security Standards that reasonably protect the integrity, confidentiality, and availability of, and to prevent non - permitted use or disclosure of, PHI created, received, maintained, or transmitted from, or on behalf of, the Covered Entity. (ii) Business Associate agrees that with respect to PHI, these safeguards, at a minimum, shall meet the requirements of the HIPAA Security Standards applicable to Business Associate. (iii) Business Associate shall develop and implement policies and procedures that meet the Security Standards documentation requirements as required by the HITECH Act. (iv) Business Associate agrees that it shall take all commercially reasonable steps to mitigate, to the extent practicable, any harmful effect that is known to Business Associate resulting from a non - permitted use or disclosure of PHI or a Security Incident. (c) Compliance with HIPAA Transaction Standards. In the event that the Business Associate transmits or receives any Covered Electronic Transaction on behalf of Covered Entity, it shall comply with all applicable requirements of the Standards for Electronic Transactions Rule to the extent required by law, and shall ensure that any agents or subcontractors that assist Business Associate in conducting Covered Electronic Transactions on behalf of Covered Entity agree, in writing, to comply with the Standards for Electronic Transactions Rule to the extent required by law. (d) Agents and Subcontractors. Business Associate shall include in all contracts with its agents or subcontractors, if such contracts involve the disclosure of PHI to the agents or subcontractors, the same restrictions and conditions on the use, disclosure, and security of such PHI that are set forth in this Addendum. (c) Other Business Associates. Except as otherwise limited in this Addendum, Business Associate may disclose PHI to other Business Associates of Covered Entity (i) as directed by the Plan Sponsor, or (ii) to perform its duties under the services agreement. (f) Breach of Privacy or Security Obligations. (i) Notice and Reporting to Covered Entity. Business Associate will notify and report to Covered Entity (in the manner and within the timeframcs described EAGLE COUNTY, COLORADO Medical Care Advocacy Services Agreement Page 13 below) any privacy and /or Security Incident of which Business Associate becomes aware of that results in the unauthorized access, use, disclosure, modification, or destruction of the Covered Entity's PHI not permitted by this Addendum, by applicable law, or permitted in writing by Covered Entity. (ii) Notice to Covered Entity. Business Associate will notify Covered Entity following discovery and without unreasonable delay but in no event later than ten (10) calendar days following discovery of any privacy use or disclosure not provided for by this Addendum or Breach of Unsecured Protected health Information. Business Associate shall cooperate with Covered Entity in investigating any unauthorized use or disclosure or Breach and in rneeting the Covered Entity's obligations under the HIPAA Regulations and /or. IHTECH Act and any other security breach notification laws. Business Associate shall follow its notification to the Covered Entity with a report that meets the requirements outlined immediately below. (iii) Reporting to Covered Entity. (1) For successful Security Incidents and any other use or disclosure of PHI that is not permitted by this Addendum, the services agreement, by applicable law, or without the prior written approval of the Covered Entity, Business Associate — without unreasonable delay and in no event later than thirty (30) calendar days after Business Associate learns of such non - permitted use or disclosure — shall provide Covered Entity a report that will: a. Identify (if known) each individual, whose Unsecured Protected Health Information has been, or is reasonably believed by Business Associate to have been accessed, acquired, or disclosed during such Breach; b. Identify the nature of the non - permitted access, use, or disclosure including the date of the incident and the date of discovery; c. Identity the PHI accessed, used, or disclosed (e.g., name; social security number; date of birth); d. Identify what action Business Associate took or will take to investigate the breach, to mitigate harm to individuals, and to protect against any further breach; (2) For any other Security Incident that does not result in unauthorized access, use, disclosure, modification, or destruction of PHI (including but not limited to, pings on Business Associate's firewall, port scans, attempts to log onto a system or enter a database with an invalid password or username, denial-of-service attacks that do not result in the system being taken off - line, or malware such as worms or I i EAGLE COUNTY, COLORADO Medical Care Advocacy Services Agreement Pap 14 viruses), Business Associate shall aggregate the data and, upon its written request, • provide Covered Entity a report that identifies the categories of unsuccessful Security Incidents as described in this Section. (iv) Termination. (I) Covered Entity and Business Associate each will have the right to terminate this Addendum if the other party has engaged in a pattern of activity or practice that constitutes a material breach or violation of ,Business Associate's or the Covered Entity's respective obligations regarding PHI under this Addendum and, on notice of such material breach or violation from the Covered Entity or Business Associate, fails to take reasonable steps to cure the material breach or end the violation. (2) If Business Associate or the Covered Entity fail to cure the material breach or end the violation after the other party's notice, the Covered Entity or Business Associate (as applicable) may terminate this Addendum by providing Business Associate or the Covered Entity written notice of termination, stating the uncured material breach or violation that provides the basis for the termination and specifying the effective date of the termination. Such termination shall be effective 60 days from this termination notice. (v) Return or Destruction of PHI and Continuing Privacy and Security Obligations. (1) Upon the termination or expiration of the services agreement or this Addendum, Business Associate agrees to return the PHI to Covered Entity, destroy the PHI (and retain no copies), or further protect the PHI if Business Associate determines that return or destruction is not feasible. (2) Business Associate's and the Covered Entity's obligation to protect the privacy and security of the PHI it created, received, maintained, or transmitted in connection with services to be provided under the services agreement and this Addendum will be continuous and survive termination, cancellation, expiration, or other conclusion of this Addendum or the services agreement. Business Associate's other obligations and rights, and the Covered Entity's obligations and rights upon termination, cancellation, expiration, or other conclusion of this Addendum, are those set forth in this Addendum and /or the services agreement. (g) BAA I-IIPAA Updates Addendum. Upon the effective date of any final regulation or amendment to the HIPAA Regulations, this BAA shall be deemed automatically amended so that the obligations it imposes on the parties remain in compliance with such regulations. Following amendment of the BAA in this manner, the parties shall, as necessary, work together to clarify their respective obligations with respect to any new requirements under the modified HIPAA regulations. EAGLE COUNTY, COLORADO Medical Care Advocacy Services Agreement Page 15 5. OBLIGATIONS OF COVERED ENTITY (a) Notice of Privacy Practices. Covered Entity shall notify Business Associate of any limitation(s) or change(s) in Covered Entity's notice of privacy practices in accordance with 45 C.F.R. § 164.520, to the extent that such limitation(s) or change(s) may affect Business Associate's use or disclosure of PHI (b) Authorization by Individual. Covered Entity shall notify Business Associate of any change(s) in, or revocation of, an authorization by individual to use or disclose PHI, if such change(s) affect Business Associate's permitted or required uses and discloses. (c) Restriction to Use or Disclosure. Covered Entity shall notify Business Associate of any restriction(s) to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 C.F.R. § 164.522, to the extent that such restriction(s) may affect Business Associate's use or disclosure of PHI. 6. BUSINESS ASSOCIATE expressly agrees to comply with IIIPAA, as may be amended, and applicable regulations pertaining to Business Associates and shall be legally bound by this Addendum. Should Covered Entity not agree to this Addendum, in part or in whole, Covered Entity must communicate those objections in writing to Business Associate within thirty (30) days of receipt of this Addendum. 7. INDEPENDENT CONTRACTOR. Business Associate and Covered Entity are and shall remain independent contractors throughout the term. Nothing in this Addendum or otherwise in the Agreement shall be construed to constitute Business Associate and Covered Entity as partners, joint venturers, agents or anything other than independent contractors. EA LE COUNTY, COLORADO Me ical Care Advocacy Services Agreement Pa 16 MEECOM CARE ADVOCACY, LLC. EAGLE COUNTY COLORADO Business Associate i By and through its Best -eFery mty Ce.miffissiefiers i U v -.:- E_12.__. By: 144 " a9149 , � ' Print Name: Jon Stavacy 3)TH Mi» • di. Print Name: SI P_Lampard Y 'Title: 0OU J J lk Mll) -� ,, Title: Chief Administrative Officer Dat Date: / 7