Loading...
HomeMy WebLinkAboutGREAT WEST - CONTRACT - CONTRACT - GREAT WEST PRIVACY AGREEMENTPrivacy Agreement THIS CONTRACT is entered into on this 14th day of April, 2003, between Great -West Life & Annuity Insurance Company ("Company"), 8515 E. Orchard Road, Greenwood Village, Colorado 80111 and The City of Fort Collins ("Contractor"), PO Box 580, Fort Collins, Colorado on behalf of the City of Fort Collins Group Health Plan WHEREAS, COMPANY and CONTRACTOR each may make available and/or transfer or cause to be transferred to the other certain Protected Information; and WHEREAS, COMPANY and CONTRACTOR may obtain access to, through, or receive from, or at the direction of.. or on behalf of, the other's customer or contractor, certain Protected Information; NOW, THEREFORE, COMPANY and CONTRACTOR agree as follows: 1. Defmitions. The following terms shall have the meaning ascribed to them in this Section. A. "Applicable Law" shall mean any such item listed below in this sub -section A as it may apply to any particular Protected Information, including any amendments to any such item as such may become effective; (i) the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), (ii) the federal regulations regarding privacy and promulgated with respect to HIPAA, found at Title 45 CFR Parts 160 and 164, and (iii) any state statute or regulation or other bulletin or document that has the force of law that has been issued by a state in furtherance of that state's protection of the privacy of an individual's health information to the extent that such statute or regulation or other bulletin or document that has the force of law is not otherwise pre-empted by any federal law; and (iv) any statute or regulation or other bulletin or document that has the force of law that has been issued in furtherance of a governmental entity's ability to obtain health information for health oversight purposes, investigatory, administrative, judicial or law enforcement proceedings or other lawful purpose. B. "Contract" shall refer to this document. C. "Great -West Life" shall include those affiliates of Great -West that control, or are controlled by, or are under common control with Great -West, and shall also include any party for which Great -West has the authority to administer or direct the business of that entity whether through a reinsurance, administration or other agreement. D. "Individual" shall mean the person who is the subject of the Protected Information or a person who qualifies as the personal representative of the individual. E. "Protected Information" shall mean any information that relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present or future payment for the provision of health care to an individual, including demographic information collected from an individual, that is created by a health care provider, health plan, employer or health care clearing house, or by a Party and NonBA09162002 that identifies the individual, or with respect to which there is a reasonable basis to believe that the information can be used to identify the individual, and that is related to goods or services provided by a party on behalf of the other Party, or is related to goods or services provided by a Party on behalf of or at the direction of a customer of the other Party. Protected Information shall not include records that the Contractor holds for employment purposes, in accordance with 45 C.F.R. 164.501(2)(iii). F. "Party" or "Parties" shall mean CONTRACTOR and COMPANY. G. "Secretary" shall mean the Secretary of the Department of Health and Human Services ("HHS") and any other officer or employee of HHS to whom the authority involved has been delegated. 2. Term and Termination. The term of this Contract shall commence as of April 14, 2003, and shall terminate when all of the Protected Information made available and/or transferred or caused to be transferred to a Party, or obtained, accessed by, or received by a Party from or at the direction of or on behalf of the other Party or a customer of either Party is destroyed, rendered inaccessible, or returned to the appropriate Party. 3. Limits on Use and Disclosure Established by Terms of Contract. The Parties shall be prohibited from using or disclosing the Protected Information for any purpose other than as expressly permitted or required by this Contract. 4. Permitted and Required Uses and Disclosures. Except as otherwise set forth in this Contract, the Parties shall be permitted to use and/or disclose Protected Information only for the purpose of conducting the transactions contemplated under this Contract and only for purposes within the scope of that Party's representation of, or work conducted on behalf of the other Party or a customer of the other Party. 5. Use of Protected Information for Management. Administration and Legal Responsibilities. The Parties are permitted to use Protected Information if necessary for the proper management and administration of their respective businesses and to carry out their respective legal responsibilities. 6. Disclosure of Protected Information for Management Administration and Legal Responsibilities. The Parties are permitted to disclose Protected Information for the proper management and administration of their respective businesses and to carry out their respective legal responsibilities, provided: A. The disclosure is required by Applicable Law; or B. The disclosing Parry obtains reasonable assurances from the person to whom the Protected Information is disclosed that it will be held confidentially and used or further disclosed only as required by Applicable Law or for the purposes for which it was disclosed to the person, the person will use appropriate safeguards to prevent use or disclosure of the Protected Information, and the person will immediately notify the disclosing Party of any instance of which it is aware in which the confidentiality of the Protected Information has been breached. 7. Data Aggregation Services. Each Party is permitted to use or disclose Protected Information to provide data aggregation services, as that term is defined by 45 C.F.R. 164.501, relating to the health care operations of that Party. 8. Obligations of Partv Receiving Protected Information: A. Limits on Use and Further Disclosure Established by Contract and Law. The Parties hereby agree that the Protected Information shall not be further used or disclosed other than as permitted or required by this Contract or as required by Applicable Law. BA10212002 B. Appropriate Safeguards. The Parties will establish and maintain appropriate safeguards to prevent any use or disclosure of the Protected Information other than as provided for by this Contract. C. Reports of Disclosures. The Parties shall maintain information related to its disclosures of Protected Information sufficient to provide each other with any necessary accounting of such disclosures and shall promptly notify the other of any such disclosures in a manner acceptable to the Parties. D. Reports of Improper Use or Disclosure. The Parties hereby agree that they shall promptly report to each other any use or disclosure of Protected Information not provided for or allowed by this Contract. E. Subcontractors and Agents. The Parties hereby agree that anytime Protected Information is provided or made available to any subcontractors or agents, the disclosing Party must enter into a subcontract with the subcontractor or agent that contains the same terms, conditions and restrictions on the use and disclosure of Protected Information as contained in this Contract. Right of Access to Protected Information. To the extent required by the federal regulations regarding privacy and promulgated with respect to HIPAA, found at Title 45 CFR Parts 160 and 164, the Parties hereby agree to make available and provide a right of access to Protected Information by an Individual. This right of access shall conform with and meet all of the requirements of 45 C.F.R. 164.524 to the same extent as if the Party were directly subject to 45 C.F.R.164.524. G. Amendment and Incorporation of Amendments. To the extent required by the federal regulations regarding privacy and promulgated with respect to HIPAA, found at Title 45 CFR Parts 160 and 164, the Parties agree to make Protected Information available for amendment and to incorporate any amendments to Protected Information in accordance with 45 C.F.R.164.526 to the same extent as if the Party were directly subject to 45 C.F.R. 164.526. H. Provide Accounting. To the extent required by the federal regulations regarding privacy and promulgated with respect to HIPAA, found at Title 45 CFR Parts 160 and 164, the Parties agree to make Protected Information available as required to provide an accounting of disclosures in accordance with 45 C.F.R. 164.528 to the same extent as if the Party were directly subject to 45 C.F.R.164.528. I. Access to Books and Records. The Parties hereby agree to make their respective internal practices, books, and records relating to the use or disclosure of Protected Information available to the Secretary or the Secretary's designee for purposes of determining compliance with the HHS Privacy Regulations. The Parties hereby agree to make their internal practices, books, and records relating to the use or disclosure of Protected Information reasonably available to each other. Return or Destruction of Protected Information. At termination of this Contract each Party hereby agrees to return or destroy all Protected Information received from, or created or received by the other, and not to retain any copies of the Protected Information after termination of this Contract, if reasonably feasible. If return or destruction of the Protected Information is not feasible, the Parties agree to extend the protections of this Contract for as long as necessary to safeguard the Protected Information and to limit any further use or disclosure consistently with the intent of this Contract. If a Parry elects to destroy the Protected Information, it shall certify to the other Party that the Protected Information has been destroyed. K. Mitigation Procedures. The Parties agree to have procedures in place, and to implement those procedures as necessary, for mitigating, to the extent practicable, any deleterious effect from the use or disclosure of Protected Information in a manner not consistent with this Contract. BA10212002 L. Minimum Necessary. When using or disclosing Protected Information under this Contract, or when requesting Protected Information from another parry for purposes related to this Contract, a Party shall make reasonable efforts to limit Protected Information to the minimum necessary to accomplish the intended purpose of the use, disclosure or request. 9. Termination of Contract. The Parties agree that each party has the right to terminate this Contract and seek relief under section 12 of this Contract if it determines that the other Party has violated a material term of this Contract. 10. Choice of Law. This Contract shall be governed by the law of the State of Colorado except that for purposes of privacy rights of individuals, the law of the state in which the individual resided during the event(s) giving rise to the need to determine the individual's rights related to disclosures under this Contract shall apply, except to the extent that HHS Privacy Regulations may supersede such state law.. 11. Injunctive Relief. Notwithstanding any rights or remedies provided for in this Contract, each Party retains all rights to seek injunctive relief to prevent or stop the unauthorized use or disclosure of Protected Information by the other Party or any agent, contractor or third party that received Protected Information. 12. Indemnification. To the extent allowed by law, each party hereby agrees to hold the other Party harmless and to indemnify the other Party against any claim, assertion, or allegation brought against the indemnified Party, and related damages, awards, expense, court costs, reasonable attorney's fees, and fines or penalties, arising from the indemnifying Parry's wrongful use or disclosure of Protected Information and against the indemnifying Party's failure to maintain adequate safeguards for Protected Information or other breach of this Contract. 13. Miscellaneous: A. Binding Nature and Assignment. This Contract shall be binding on the Parties hereto and their successors and assigns, but neither Party may assign this Agreement without the prior written consent of the other, which consent shall not be unreasonably withheld. B. Notices. Whenever under this Contract one Party is required to give notice to the other, such notice shall be deemed given if mailed by First Class United States mail, postage prepaid, and addressed as follows: Great -West Life & Annuity Insurance Company 8515 E. Orchard Road Greenwood Village, Colorado 80111 James B. O'Neill II, CPPO Director of Purchasing and Risk Management City of Fort Collins PO Box 580 Fort Collins, CO 80522-0580 Either Parry may at any time change its address for notification purposes by mailing a notice stating the change and setting forth the new address. C. Good Faith. The Parties agree to exercise good faith in the performance of this Contract. D. Article Headings. The article headings used are for reference and convenience only, and shall not enter into the interpretation of this Contract. E. Force Majeure. A Party shall be excused from performance under this Contract for any period that Party is prevented from performing any services pursuant hereto, in whole or in part, as a BA10212002 result of an Act of God, war, civil disturbance, court order, labor dispute or other cause beyond its reasonable control, and such nonperformance shall not be grounds for termination. F. Attorney's fees. Except as otherwise specified in this Contract, if any legal action or other proceeding is brought for the enforcement of this Contract, or because of an alleged dispute, breach, default, misrepresentation, or injunctive action, in connection with any of the provisions of this Contract, each Parry shall bear its own legal expenses and the other cost incurred in that action or proceeding. G. Entire Agreement. This Contract consists of this document, and constitutes the entire agreement between the Parties for HIPAA privacy issues only. There are no understandings or agreements relating to this Agreement which are not fully expressed in this Contract and no change, waiver or discharge of obligations arising under this Contract shall be valid unless in writing and executed by the Party against whom such change, waiver or discharge is sought to be enforced. IN WITNESS WHEREOF, the Parties have caused this Contract to be signed and delivered by their duly authorized representatives, as of the date set forth above. CONTRACTOR B - i�v"� P ' t N me: James B. O'Neill II, CPPO Title: Director of Purchasing and Risk Mgt. Contractholder Name: City of Fort Collins Contractholder Address: PO Box 580 BA10212002 COMPANY By. Print Name: el Title: c'ia uM fb Fort Collins, CO 80522-0580