Heron Language Services

International Translation & Interpretation For Global Markets  All Languages

Heron Language HIPPA Agreement

HIPPA Agreement

1. OBLIGATIONS OF VENDOR

Section 1. Use of Protected Health Information.
Vendor shall not and shall ensure that its directors, officers, employees, contractors and agents, do not use Protected Health Information received from Heron Language Services in any manner that would constitute a violation of the Privacy Standards if used by Heron Language Services, except that Vendor may use Protected Health Information (i) for Vendor’s proper management and administrative services, or (ii) to carry out the legal responsibilities of Vendor.

Section 2. Disclosure of Protected Health Information.
Vendor shall not and shall ensure that its directors, officers, employees, contractors and agents do not disclose Protected Health Information received from Heron Language Services in any manner that would constitute a violation of the Privacy Standards if disclosed by Heron Language Services, except that Vendor may disclose Protected Health Information in a manner permitted pursuant to this Agreement or as required by law. To the extent Vendor discloses Protected Health Information to a third party; Vendor must obtain, prior to making any such disclosure,
a) reasonable assurances from such third party that such Protected Health Information will be held confidential as provided pursuant to this Agreement and only disclosed as required by law or for the purposes for which it was disclosed to such third party, and
b) (b) an agreement from such third party to immediately notify Vendor of any breaches of the confidentiality of the Protected Health Information, to the extent it has obtained knowledge of such breach.

Section 3. Safeguards Against Misuse of Information.
Vendor agrees that it will implement all appropriate safeguards to prevent the use or disclosure of Protected Health Information other than pursuant to the terms and conditions of this Agreement.

Section 4. Reporting of Disclosures of Protected Health Information.
Vendor shall, within five (5) days of becoming aware of a disclosure of Protected Health Information in violation of this Agreement by Vendor, its officers, directors, employees, contractors or agents or by a third party to which Vendor disclosed Protected Health Information pursuant to Section 2 of this Addendum, report any such disclosure to Heron Language Services.

Section 5. Agreements by Third Parties.
Vendor shall enter into an agreement with any agent or subcontractor that will have access to Protected Health Information that is received from, or created or received by Vendor on behalf of Heron Language Services pursuant to which such agent or subcontractor agrees to be bound by the same restrictions, terms and conditions that apply to Vendor pursuant to this Agreement with respect to such Protected Health Information.

Section 6. Access to Information.
Within five (5) days of a request by Heron Language Services for access to Protected Health Information about an individual contained in a Designated Record Set, Vendor shall make available to Heron Language Services such Protected Health Information for so long as such information is maintained in the Designated Record Set. In the event any individual requests access to Protected Health Information directly from Vendor, Vendor shall within two (2) days forward such request to Heron Language Services. Any denials of access to the Protected Health Information requested shall be the responsibility of Heron Language Services.

Section 7. Availability of Protected Health Information for Amendment.
Within ten (10) days of receipt of a request from Heron Language Services for the amendment of an individual’s Protected Health Information or a record regarding an individual contained in a Designated Record Set (for so long as the Protected Health Information is maintained in the Designated Record Set), Vendor shall provide such information to Heron Language Services for amendment and incorporate any such amendments in the Protected Health Information as required by 45 C.F.R. §164.526.

Section 8. Accounting of Disclosures.
Within ten (10) days of notice by Heron Language Services to Vendor that it has received a request for an accounting of disclosures of Protected Health Information regarding an individual during the six (6) years prior to the date on which the accounting was requested, Vendor shall make available to Heron Language Services such information as is in Vendor’s possession and is required for Heron Language Services to make the accounting required by 45 C.F.R. §164.528. At a minimum, Vendor shall provide Heron Language Services the following information:
(i) the date of the disclosure,
(ii) the name of the entity or person who received the Protected Health Information, and if known, the address of such entity or person,
(iii) a brief description of the Protected Health Information disclosed, and
(iv) a brief statement of the purpose of such disclose which includes an explanation of the basis for such disclosure. In the event the request for an accounting is delivered directly to Vendor, Vendor shall within two (2) days forward such request to Heron Language Services. It shall be Heron Language Service Professional’s responsibility to prepare and deliver any such accounting requested. Vendor herby agrees to implement an appropriate record-keeping process to enable it to comply with the requirements of this Section.

Section 9. Availability of Books and Records.
Vendor hereby agrees to make its internal practices, books and records relating to the use and disclosure of Protected Health Information received from, or created or received by Vendor on behalf of, Heron Language Services available to the Secretary for purposes of determining Heron Language Services and Vendor’s compliance with the Privacy Standards.

Section 10. Disposition of PHI Upon Termination.
Vendor will, at termination or expiration of the Services Agreement, if feasible, return or destroy all PHI received from, or created or received by the Contractor on behalf of Heron Language Services which the Vendor and/or its subcontractors or agents still maintain in any form, and will not retain any copies of such information. If such return or destruction is not feasible, the Vendor will notify Heron Language Services of such event in writing, and will thereupon extent the protections of the Agreement to the PHI and limit further uses and disclosures to those purposes that make the return or destruction of the PHI infeasible.

II. DEFINITIONS FOR USE IN THIS ADDENDUM

“Data Aggregation” shall mean, with respect to Protected Health Information created or received by Vendor in its capacity as the business associate of Heron Language Services, the combining of such Protected Health Information by Vendor in its capacity as a business associate of another Heron Language Service, to permit data analyses that relate to the health care operations of the respective covered entities.
“Designated Record Set” shall mean a group of records maintained by or for the Heron Language Service that is
(i) the medical records and billing records about individuals maintained by or for Heron Language Services,
(ii) the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or
(iii) used, in whole or in part, by or for Heron Language Services to make decisions about individuals. As used herein the term “Record” means any item, collection, or grouping of information that includes Protected Health Information and is maintained, collected, used or disseminated by or for Heron Language Services.

“Electronic Media” shall mean the mode of electronic transmissions. It includes the Internet, extranet (using Internet technology to link a business with information only accessible to collaborating parties), leased lines, dial-up lines, private networks, and those transmissions that are physically moved from one location to another using magnetic tape, disk, or compact disk media.
“Individually Identifiable Health Information” shall mean information that is a subset of health information, including demographic information collected from an individual, and
(i) is created or received by a health care provider, health plan, employer, or health care clearinghouse; and

(ii) relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and
(a) identifies the individual, or (b) with respect to which there is a reasonable basis to believes the information can be used to identify the individual

“Privacy Standards” shall mean mean the Standard for Privacy of Individually Identifiable Health Information, 45 C.F.R. Parts 160 and 164.
“Protected Health Information” shall mean individually Identifiable Health Information that is (i) transmitted by electronic media, (ii) maintained in any medium constituting Electronic Media; or (iii) transmitted or maintained in any other form or medium.
“Protected Health Information” shall not include (i) education records covered by the Family Educational Right and Privacy Act, as amended, 20 U.S.C. §1232g and (ii) records described in 20 U.S.C. §1232g(a)(4)(B)(iv).
“Secretary” shall mean the Secretary of the Department of Health and Human Services.

IN WITNESS WHEREOF, the parties hereto have duly executed this Addendum on the dates appearing below to be effective as of Addendum Effective Date.

Covered Entity
Business Associate