AIMS Caseload Tracker – Standard Agreement
Instructions for UW CoMotion Express License
AIMS Caseload Tracker
Software and Data Storage
Standard Agreement
UW CoMotion Express License
This Agreement is for access to the AIMS Caseload Tracker software for Organizations with up to 50 users. If you would like to purchase the AIMS Caseload Tracker for a qualified nonprofit safety net organization, please go back to the licensing page and select the appropriate agreement or contact license@uw.edu for assistance.
Please Note: This agreement is non-negotiable.
To complete the license, please:
1. REVIEW
Scroll down to review the agreement terms.The agreement includes a Business Associate Agreement in Exhibit A to protect patient privacy.2. OPEN AN ACCOUNT & LOG IN
Click the "Register" link in the upper right-hand corner to open a CoMotion account if you don't already have one. Once logged in, you can submit and review your order status at any time by clicking on your account name and selecting the "My Orders" link.3. COMPLETE & SIGN
To complete the agreement, click the "Order Now" button and follow directions provided on each screen. You will be directed to a page where you will need to provide the information below. Please note that responses to these questions are part of the agreement between the parties.- A. Contact information (including name, title, address, email and phone) for your Organization’s:
- 1. AIMS Caseload Tracker Account Manager
- 2. Legal Contact
- 3. Contact for where UW will send invoices to; and
- 4. Designated Privacy Office Contact per the BAA
- Note: Completion of all fields is required. In situations where contacts are the same individual, entering "same as above" or "N/A" is acceptable.
- B. The number of Participating Clinic Locations for Organization; and
- C. A list of Participating Clinic Locations (including location name, street address and phone number.)
Once this information has been provided, the agreement can then be electronically signed and submitted or forwarded to another person at your Organization for review, signature and submission.
4. UW REVIEW AND SIGNING
Once submitted, UW will review the agreement and either finalize by countersigning, or contact you if there are questions.5. PAYMENT
After finalizing, you will receive a confirmation email, which will be followed by an invoice sent from CoMotion Finance to the designated Invoice Contact. Payment can be made by wire transfer, check or Purchase Order (PO). For payments made by wire transfer, there will be an additional fee of $30 dollars USD.6. ACCESS
Upon receipt of payment, a copy of the executed Agreement will be emailed to you, and you will then be contacted by the AIMS Center to set up access to the AIMS Caseload Tracker. Access is typically established within one week of receipt of payment.7. QUESTIONS
Please contact our office if you have any questions about this process:- Express Licensing Program
UW CoMotion
University of Washington
Email: license@uw.edu
AIMS Caseload Tracker
Software and Data Storage
Standard Agreement
UW CoMotion Express License
This AIMS Caseload Tracker Software and Data Storage Standard Agreement (the "Agreement") is between the undersigned organization on its own behalf and on behalf of the entities as provided (“Participating Clinic Locations”) (collectively, the “Organization”), and the University of Washington, a public institution of higher education and an agency of the State of Washington with its principal campus located in Seattle, Washington, on behalf of the UW’s School of Medicine (the "UWSOM"), including the UWSOM’s Department of Psychiatry and Behavioral Sciences (the "Department") (collectively, “UW”). UW and Organization agree as follows effective as of the latest date upon which this Agreement is fully executed (“Effective Date”):
Background
UW has developed a secure web-based registry for managing behavioral health caseloads in integrated care settings (the "Software" as defined below), which includes secondary data storage (“Data Storage Services” as defined below) of health care information relating to patients and clients (“Data” as defined below) and are combined as the AIMS Caseload Tracker (“AIMS Caseload Tracker”).
UW and Organization desire to set forth herein the terms governing Organization’s access to and use of the Software and Data Storage Services. In order to conduct transactions involving the disclosure of Organization protected health information (“PHI”) to UW for the purpose of conducting the activities set forth herein, the parties hereby enter into a Business Associate Agreement ("BAA") between UW (in the role of Business Associate) and the Organization (in the role of Covered Entity), for the Purpose as identified in Section 1.10, as set forth in Exhibit A “Business Associate Agreement” and included herein by reference.
1.0 Definitions
1.1 “Organization Account Manager” means the person listed per Section 9.0 “Notices” as provided by Organization who is designated and authorized by the Organization to receive and provide technical information to the System Administrator under this Agreement and to manage system access by authorized Participating Clinic Locations and users.
1.2 “Authorized User(s)” or “User(s)” means those persons authorized by the Organization for the Purpose of accessing the Server to use the Software and Data Storage Services only as necessary for the Organization’s access to and management of Organization Data. Organizations may purchase a single license to cover all clinics under their umbrella.
1.3 “Covered Entity” means (a) the Organization entering the Agreement which is a HIPAA covered entity per Exhibit A "Business Associate Agreement", and (b) all Participating Clinic Locations.
1.4 “Data” means health care and related information pertaining to Organization patients and clients that is electronically stored on the Server and accessed through the Software. Data remains the property of the Organization. Protected Health Information (PHI) is fully partitioned and will not be shared across health care organizations.
1.5 “Data Storage Services” means storage of Data on Server.
1.6 “Delivery Date” means the date that the System Administrator notifies Organization that it may access Server, use the customized Software, utilize Data Storage Services, and provide an initial username and password to the Organization Account Manager to administer and communicate with Authorized Users, and Participating Clinic Locations.
1.7 “Feedback” means commentary and/or a report to the Department on the nature of the Organization deployment of the Software prior to the expiry of the Agreement. The format of the Feedback shall be at the sole discretion of the Department.
1.8 “HIPAA” means the Health Insurance Portability and Accountability Act of 1996 and any regulations enacted pursuant to its provisions.
1.9 “Participating Clinic Locations” means affiliated clinic locations or sites as provided by Organization, each of which is bound by and is an intended beneficiary of this Agreement. Protected Health Information under this Agreement will only be shared and visible to the Participating Clinic Locations Organization identifies as Participating Clinic Locations.
1.10 “Purpose” means access to the Software and Data Storage Services for the use by the Organization related to its participation in the AIMS Center research and service delivery activities along with the Organization’s provision of services to patients.
1.11 “Server” means a UW operated cloud service or under contract to UW by the Department on which the Software and Data are remotely accessed by the Internet, and through which Data Storage Services are provided.
1.12 “Software” means the AIMS Caseload Tracker software application, which includes any derivatives UW may provide.
1.13 “System Administrator” means a person designated by UW to act as System Administrator under this Agreement.
1.14 “Third Party” means an individual or entity other than the UW, Organization or Participating Clinic Locations.
2.0 Permissions; Acceptable and Unacceptable Uses
2.1 Commencing on Delivery Date and continuing until termination of this Agreement and for so long as the Organization complies with the terms of this Agreement, UW hereby grants to the Organization and the Organization hereby accepts:
- (a) a limited, non-transferable, non-exclusive, and revocable license to use the Software on the Server solely for the Purpose;
- (b) a right to run the Software for the purposes of entering, querying, displaying and manipulating Data (including to transfer, retrieve and store Data through use of the Software), producing reports, and utilizing the features of the Software enabled by the System Administrator at the time the Software is used.
2.2 The Organization agrees that the foregoing permission shall not be interpreted as granting the Organization any proprietary ownership, interest or right in the Software either during this Agreement or upon its termination for any reason. The Organization agrees not to remove or obscure rights management markings, such as copyright notices and patent numbers, from Software or printouts from Software.
2.3 Confidentiality. The Organization agrees that technical specifications and instructions, including data structure and taxonomy related to the Software and Data Storage Services, shall be the confidential intellectual property of UW (“Confidential IP”) and shall not be copied, modified, distributed, performed or displayed by the Organization for internal or external uses and shall not be shared with any Third Party for any reason other than to perform the activities described in this Agreement. Organization shall take reasonable efforts to avoid disclosure and unauthorized access to the Confidential IP but in no case shall Organization take less care to protect the Confidential IP, Software and Data Storage Services than for its own information. The Organization understands that any unauthorized disclosure of the Confidential IP is a material breach of this Agreement and may result in immediate suspension of Server access and termination of this Agreement.
2.4 The Organization shall use the Software, Data Storage Services and access to the Server only for the Purpose and all such uses shall be in compliance with all applicable laws and only for lawful purposes. The Organization shall not use the Software, Data Storage Services and access to the Server for any unlawful purposes or for purposes unrelated to the Purpose.
2.5 The Organization shall use the Software, Data Storage Services and access to the Server for Data that pertains solely to its patients.
2.6 The Organization further agrees not to circumvent any authentication or security requirements established by the System Administrator, nor to engage in any activity that would cause harm to Server or the UW's computer network, including without limitation any form of hacking, interference, probing or scanning. The Organization understands that any such violation is a material breach of this Agreement and may result in immediate suspension of Server access and termination of this Agreement by UW.
2.7 The Organization shall provide a list of Participating Clinic Locations, including contact information for each, that have been designated by the Organization to access the Software and Data Storage Services as the Organization’s Authorized User.
2.8 The Organization shall not sublicense, sell, display, lend, rent, lease or otherwise transfer all or any of its rights under this Agreement, including the permission to access and use the Software, nor shall it copy or duplicate any screens or Organization interfaces in the Software.
3.0 Delivery and Access; Interruptions and System Resources
3.1 On Delivery Date, UW shall provide to the Organization Account Manager an initial username and password to an Internet address by which Authorized Users may gain access to Server at reasonable times and for reasonable periods for the purpose of using the Software and obtaining Data Storage Services. Access to the Software and the Server may be interrupted for maintenance and upgrades to the Software and/or the Server. When possible, interruptions will be announced in advance to the Organization Account Manager. Access to the Server shall be controlled through an individual login and password assigned to each Authorized User.
3.2 The Organization understands and agrees that access to the Server and network to which it is attached is subject to interruptions due to factors beyond the control of Department and that, despite the Department’s best efforts, the Server and network to which it is attached may not be error free or free from viruses, malicious code or other harmful components. The Organization further agrees that System Administrator may establish reasonable limitations on the Organization’s use of Server and Server resources.
4.0 Conditions and Additional Agreements
4.1 The Organization agrees it is solely responsible for providing Authorized Users with information on the Organization’s patient privacy policies and, as needed, with any conditions contained in any agreement with any Third Party for access to the Data. If Organization requests that UW share Data with a Third Party, the Organization is solely responsible for sending written notification requesting this arrangement with a Third Party to the UW Project Management Contact as identified in Section 9.0 "Notices".
4.2 The Organization agrees to maintain current records of its Authorized Users and Third Party relationships and to perform regular audits on current active Authorized Users, and, upon request by UW, to provide audit reports to the System Administrator.
4.3 Access to the Server and Data residing on the Server and use of the Software is strictly limited to Authorized Users. In no event shall the Organization permit Third Parties or any other persons who are not Authorized Users to access the Server or Data residing on the Server or to use the Software. The Organization understands that any such violation is a material breach of this Agreement and may result in immediate suspension of Server access and termination of this Agreement by UW.
4.4 Organization agrees it shall have access solely to its own Data. Organization agrees it shall not have access to data belonging to any Third Party.
4.5 For Data that the Organization downloads from the Server, the Organization accepts the entire risk and responsibility with respect to providing any such Data, whether by means of reports, downloaded files, or otherwise to any other Third Party.
4.6 Organization agrees that it shall have the sole and entire risk and responsibility for maintaining an accurate and current list of Authorized Users, including establishing its internal processes for updating the list of Authorized Users. UW is not responsible for providing passwords, account information, or updating access tracking for Organization’s Authorized Users.
4.7 Organization shall promptly notify the UW System Administrator if the Organization Account Manager’s employment has been terminated or if for any reason the Organization Account Manager is no longer authorized to access the Software/Data Storage Services or is no longer in the role of Organization Account Manager. The Organization must provide the UW System Administrator with name and contact information for the new Organization Account Manager. UW System Administrator will suspend the account of the old Organization Account Manager and provide username and password for new Organization Account Manager.
4.8 The Organization acknowledges that in the event the Organization is terminated from use of the Software or the Data Storage Services by UW, UW shall immediately suspend the accounts of all Authorized Users that are part of the Organization.
4.9 All Data stored on the Server shall at all times remain the property of the Organization, which grants UW and System Administrator permission to view the Data only to the extent necessary to provide the Data Storage Services and to provide other services that may be separately negotiated.
4.10 The Organization agrees that all computers from which the Server is accessed will have currently updated security and anti-virus protection software installed.
5.0 Debugging and Support; Feedback
5.1 During the term of this Agreement, UW shall endeavor to correct program defects in and provide modifications to the Software and Data Storage Services. UW will provide system set-up, support and debugging based on a scope of work and budget mutually agreed upon by UW and the Organization.
5.2 The Organization hereby authorizes UW to contact the Organization Account Manager and Authorized Users, including employees and representatives designated by the Organization at mutually convenient times to request Feedback on use of the Software and Data Storage Services to assist in development of Software.
5.3 The timeliness and scope of the Feedback shall be at the sole discretion of UW. During the Term, the Department will be in contact with the Organization Account Manager about the Feedback in advance of UW's request for Feedback. The Organization agrees that UW is permitted to use the any Organization-provided Feedback at no charge or royalty in making changes to the Software.
6.0 Term and Renewals
6.1 The term of this Agreement (“Term”) shall be twelve (12) months from the Effective Date.
6.2 This Agreement may be renewed annually, provided UW sends Organization an invoice for another twelve (12) month period of service, and Organization’s timely payment of the Fee is received by UW. Prior to the expiration of the term, Organization will be notified by the UW Project Manager if your level of usage has changed. Any change in usage, as reported to this office by the UW Technical Manager, may result in an updated fee at renewal.
7.0 Termination
7.1 Termination by Company. Provided Organization has paid its License Fee, Organization may terminate this Agreement at any time with thirty (30) days written notice to UW. UW shall not refund any portion of the Fee received by UW for early termination.
7.2 Events of Default. Either party may terminate this Agreement upon ten business days' written notice if the other party materially breaches any provision of this Agreement following failure within ten business days' of a written demand by the non-breaching party to cure such breach. System Administrator may at any time suspend access to Server by Organization or any Authorized User if System Administrator determines such suspension is necessary for reasons of Server security or Data protection.
7.3 Effect of Termination. Termination of this Agreement for any reason shall terminate all rights and permissions granted to the Software or Data Storage Services.
7.4 Organization's Data. Upon termination or expiration of the Term, the Organization has sixty (60) days within which it may download all Data. The Organization is solely responsible for downloading all of its Data from the UW server prior to decommissioning of the server. UW will destroy all of the Organization’s Data by the deadline given and no Data will be available to the Organization after the deadline. The Organization is entirely responsible for downloading its Data prior to the deadline set by UW. It is not the responsibility of UW to download the Organization’s Data prior to termination. UW is not liable if Data is lost. Organization shall hold UW harmless from any loss of Data occasioned by the operation of this Section 7.4.
7.5 De-Identified Data. Following termination of this Agreement, University, through the Department and the UW School of Medicine, may optionally request that Organization enter into a separate Data Use Agreement ("DUA") to grant UW permission to continue to store and use a de-identified copy of the Data, as defined by HIPAA, that was collected under the terms of this Agreement (“De-Identified Data”), for the purpose of education, research or any other purpose as deemed appropriate by UW. Entering into this DUA is optional and does not affect the terms and conditions of this Agreement.
8.0 Disclaimers and Limitations
8.1 The Organization agrees that the Software has been developed as part of and for use in research conducted at UW. The Organization further agrees that the Software is developmental in nature and will likely contain errors, bugs and defects.
8.2 The Organization acknowledges and understands that the Software is an information tool and that any analyses, reports and other information contained in or produced by the Software is intended as a supplement to, and not a substitute for, the knowledge, expertise, skill and judgment of health care professionals. In no event shall the Software or any services provided by UW under this Agreement be considered to be any form of medical care, treatment or therapy to the Organization’s patients or clients and Organization shall remain solely responsible for the care, treatment, therapy, or other care, or other services provided to its patients or clients.
8.3 The Organization understands and agrees that any Data stored on the Server shall be considered a secondary source of health and other care information with respect to the Organization’s patients and clients. The Server shall not be considered a repository for any Designated Records Sets as that term is defined by HIPAA. The Organization agrees that it will maintain its own primary source of primary health records for its patients and clients and that in no event will it rely upon the Server or UW for such purposes. The Organization further agrees that it will not store any information on the Server unrelated to health care of its patients or clients.
8.4 Organization shall defend, indemnify, defend and hold harmless UW, and its officers, developers, employees, students, and agents, against any and all claims, suits, losses, damages, costs, fees, and expenses resulting from Organization’s possession and/or use of the Software and Data Storage Services, including but not limited to from and against any and all claims or assertions of legal liability or demands for payment by any Third Party (“Claims”) to the extent that such Claims arise from or relate to any disclosure of Data, PHI, or other patient-related information tor any other Third Party, whether such disclosure was or was not to the Third Party bringing the Claims; and any damages, losses, or liabilities whatsoever with respect to death or injury to any person and damage to any property.
8.5 THE SOFTWARE AND DATA HOSTING SERVICES ARE PROVIDED "AS-IS” AND EXCEPT AS EXPRESSLY SET FORTH HEREIN, UW MAKES NO WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT AND INTERFERENCE IN ORGANIZATION ACCESS AND USE OF THE SOFTWARE AND DATA HOSTING SERVICES AND HEREBY DISCLAIMS ALL SUCH WARRANTIES AS TO ANY MATTER WHATSOEVER INCLUDING, WITHOUT LIMITATION, ALL MATTERS WITH RESPECT TO THE, SOFTWARE, DATA HOSTING SERVICES AND DATA. UW SHALL NOT BE LIABLE FOR ANY DIRECT, CONSEQUENTIAL, LOST PROFITS, OR OTHER DAMAGES SUFFERED BY THE ORGANIZATION OR ANY THIRD PARTIES RESULTING FROMTHE USE OF THE SOFTWARE, DATA STORAGE SERVICES, OR DATA, INCLUDING ANY LOSS OR CORRUPTION OF DATA. IN NO EVENT SHALL UW BE RESPONSIBLE OR LIABLE FOR ANY CLAIM FOR PUNITIVE OR EXEMPLARY DAMAGES OR LOST PROFITS OR ANY OTHER FORM OF CONSEQUENTIAL DAMAGES ARISING FROM ANY ALLEGED BREACH OF THIS AGREEMENT BY UW. ORGANIZATION HEREBY RELEASES UW, UWSOM, DEPARTMENT, THEIR OFFICERS, AGENTS, EMPLOYEES, REPRESENTATIVES, FACULTY, AND STUDENTS FROM ALL CLAIMS RELATING TO THE FOREGOING.
8.6 The Organization acknowledges that UW is an agency of the state of Washington and has obligations to maintain public records under Washington Law. If UW receives a public disclosure request for Data or Organization’s access to the Server or any part thereof, UW shall notify the Organization of the request. UW may in good faith, and at its sole discretion, respond to any such request, and in so doing, any release of information by UW that UW reasonably determines is not exempt from public disclosure shall not be deemed a breach of this Agreement. Organization releases UW from liability for release of any information held by UW pursuant to a public records request.
9.0 Notices
9.1 Notices, requests and other communication required or permitted under this Agreement shall be in writing, shall refer specifically to this Agreement, and shall be deemed delivered upon receipt. If sent by email or facsimile (provided that a transmittal sheet indicates confirmation), or other electronic transmission, a confirmation copy will be forwarded. Any such notices, requests, and other communications shall be addressed as follows:
For the Organization:
- On legal matters:
- To Organization's Legal Counsel as provided
- On AIMS Caseload Tracker and User Account matters:
- To Organization Account Manager Contact as provided
For UW:
- On UW legal matters:
- Director, Innovation Development
UW CoMotion
University of Washington
4545 Roosevelt Way NE, Suite 400
Seattle, WA 98105 - For UW Project Management matters:
- Title: Technical Project Manager
UW Department of Psychiatry and Behavioral Sciences
Email: aimstech@uw.edu
Phone: 206-221-6408 9.2 UW or the Organization, by notice, may change the address to which notice will be sent and unless so notified of a change of address all notices mailed to the Organization or UW at the above stated address will be deemed sufficient.
10.0 Fees
10.1 Use of the AIMS Caseload Tracker requires payment of an annual license fee (“Fee”). The Fee is tiered based on the number of users. Users typically include but are not limited to: behavioral health providers, care managers, psychiatry providers, behavioral health supervisors and other administrators.
10.2 Fees. Organization shall pay to UW license fees ("Fees") as identified in the following fee schedule upon execution of this Agreement or renewal per Article 6.0 "Term and Renewals". Fees below are subject to periodic, market-based increase upon renewal. UW, at its sole discretion, may terminate this Agreement without notice if Fees have not been received within ninety (90) days of Effective Date.
Number of Users
Annual License Fee
1-5 users
$4,600 per year
6-15 users
$6,300 per year
16-30 users
$9,800 per year
31-50 users
$11,500 per year
10.3 Organization understands and agrees that UW is not operating as a vendor in the trade.
10.4 Payment will be requested at the time of signing in US Dollars (USD), and can be made by wire transfer, Check or Purchase Order (PO) per the payment option selected. For payments made by wire transfer, there is an additional fee of $30 dollars USD. If paying by wire transfer, Check or PO, an invoice will be sent to the Invoicing Contact as provided. Payment must be received within 30 days of invoicing to retain access. Make checks payable to: University of Washington.
10.4.1 For payments by Check or Purchase Order (PO), send payment or instructions to:
Attention: Contract Manager, UW CoMotion
4545 Roosevelt Way NE, Suite 400
Seattle, WA 98105-4608
Phone: 206-685-2278
Facsimile: 206-616-3322
Email: ipfin@uw.edu10.4.2 UW will include Organization's Purchase Order (PO) number on the invoice for the Fees if Organization provides such PO number along with the Organization's Invoicing Contact name and email.
11.0 Survival
11.1 Immediately upon the termination or expiration of this Agreement all Organization's rights under this Agreement will terminate; provided, however, Organization's obligations that have accrued prior to the effective date of termination or expiration of this Agreement will survive. The obligations and rights of each party set forth in Article 2.3 "Confidentiality", Article 10.1 "Fees", Article 7.0 "Termination", Article 8.0 "Disclaimers and Limitations", Article 12.0 "General", Exhibit A "Business Associate Agreement" and Exhibit B "Fees" will survive the termination or expiration of this Agreement.
12.0 General
12.1 This Agreement shall be construed in accordance with, and its performance shall be governed by, the laws of the State of Washington, United States. Any suit, action, or proceeding arising out of or relating to this Agreement shall be decided in King County, Washington, U.S.A. Organization accepts the venue and jurisdiction of the Federal District Court of Western Washington, Seattle, or the King County Superior Courts. The application of the United Nations Convention for contracts for the International Sales of Goods is hereby expressly excluded. Notwithstanding the foregoing, if Organization is prohibited by law to agree to Washington law and King County venue, then the parties agree to remain silent.
12.2 No omission or delay of either party hereto in requiring due and punctual fulfillment of the obligations of any other party hereto shall be deemed to constitute a waiver by such party of its rights to require such due and punctual fulfillment, or of any other of its remedies hereunder. Amendments to this Agreement must be in writing, reference this Agreement, and be signed by duly authorized representatives of UW and Organization. Headings are provided for convenience only.
12.3 If any provision of this Agreement shall be held to be invalid, illegal or unenforceable, the validity, legality and enforceability of the remaining provisions shall not be in any way affected or impaired thereby.
12.4 This Agreement and the rights and benefits conferred upon Organization hereunder may not be assigned or otherwise transferred by Organization without the prior written consent of UW. This Agreement may be assigned by UW.
12.5 Failure of UW to perform or delay in the performance of UW’s obligations under this Agreement due to any cause or event not reasonably within UW’s control, including but not limited to casualty, labor disputes, failure of equipment, compliance with government authority or Act of God, shall not constitute a breach of this Agreement, and UW’s performance shall be excused during such delay.
12.6 This Agreement embodies the entire understanding of the parties and supersedes all previous communications, representations, or understandings, either oral or written, between the parties relating to the subject matter hereof. In the event of a conflict between this Agreement and any purchase order terms and conditions, this Agreement shall take precedence and control.
12.7 This Agreement may be executed by facsimile and in identical counterparts, each of which (including signature pages) will be deemed an original, but all of which together will constitute one and the same instrument. A facsimile, scanned, or photocopied signature (and any signature duplicated in another similar manner) identical to the original will be considered an original signature.
EXHIBIT A
Business Associate Agreement
Exhibit A "Business Associate Agreement" (the “BAA”) is incorporated herein by reference to the Agreement and is entered into between the Organization as the "Covered Entity" and the University of Washington, an institution of higher education and an agency of the State of Washington with its principal campus located in Seattle, Washington (the "UW"), on behalf of the UW’s School of Medicine (the "UWSOM"), including the UWSOM’s Department of Psychiatry and Behavioral Sciences (the "Department") (collectively, the “Business Associate”). “Covered Entity” and “Business Associate” shall have the foregoing meanings in reference to the parties to this BAA and otherwise shall have the same general meanings as the terms are defined at 45 CFR §160.103.
Background
A. Covered Entity and Business Associate are parties to that certain AIMS Caseload Tracker Software and Data Storage Agreement to which this BAA is attached (the “Underlying Contract”), under which Covered Entity wishes to disclose PHI to Business Associate for the Purpose, as defined in the Underlying Contract.
B. Some or all of the information to be disclosed pursuant to the Underlying Contract constitutes Protected Health Information (“PHI”) and is required by law to be protected against unauthorized use, disclosure, modification or loss.
C. Covered Entity and Business Associate intend to protect the privacy and provide for the security of PHI and to comply with all applicable legal requirements, including but not limited to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH Act”), and the regulations promulgated thereunder (HIPAA Standards), including the regulations codified under Subpart E of 45 CFR Part 164.
The parties agree as follows:
1. Allowable Uses and Disclosures of PHI
1.1 Uses and Disclosures for the Purpose. Except as otherwise limited in this BAA, Business Associate may use or disclose PHI to perform business services, functions, and activities for, or on behalf of, Covered Entity for the Purpose as agreed to by Covered Entity and Business Associate in the Underlying Contract. Only the minimum necessary PHI to accomplish the intended purpose of this agreement and the Underlying Contract may be used or disclosed.
1.2 Legal Requirements and Administration. Business Associate may use or disclose PHI as required by law, and may use or disclose PHI for the proper management and administration of the Business Associate and to carry out its legal responsibilities.
2.1 Use or Disclosure of Protected Health Information. Business Associate shall not use or disclose PHI in any manner that would constitute a violation of federal or Washington State law, including but not limited to the HIPAA Standards, the HITECH Act, and their implementing regulations. Business Associate shall ensure that any use or disclosure by its directors, officers, employees, contractors, and agents of PHI received from the Covered Entity, or created, received, maintained or transmitted on behalf of the Covered Entity, is in accordance with the provisions of this BAA, the Underlying Contract, and applicable federal and state law. Business Associate shall not use or disclose PHI in any manner other than that permitted or required by the Covered Entity for the purpose of accomplishing services to or on behalf of Covered Entity in accordance with the BAA, or as required by law.
2.2 Safeguards. Business Associate shall use appropriate safeguards and comply, where applicable, with subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent unauthorized use or disclosure of the information other than as provided for by this BAA and the Underlying Contract. Business Associate agrees to (1) implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of Covered Entity’s PHI; and (2) ensure that any third party agent or subcontractor who creates, receives, maintains, or transmits PHI on behalf of the Business Associate agrees to implement equivalent physical and technical safeguards.
2.3 Reporting of Unauthorized Use or Disclosure of PHI. Business Associate shall, within five (5) working days of becoming aware of an unauthorized use or disclosure of PHI not provided for by this BAA, including a breach of unsecured PHI (as defined in 45 CFR §164.402 and as required at 45 CFR §164.410), by Business Associate, its officers, directors, employees, contractors, agents or by a third party to which Business Associate disclosed PHI, report any such security incident of which it becomes aware to Covered Entity. Such notice shall be made to Covered Entity's Designated Privacy Office Contact as provided.
2.4 Agreements by Third Parties. Business Associate shall obtain satisfactory contractual assurances from any agent or subcontractor who will have access to PHI that is created, received, maintained, or transmitted on behalf of the Business Associate, that the agent or subcontractor agrees to be bound by the same restrictions, terms and conditions that apply to Business Associate through this BAA with respect to PHI. Business Associate shall require that any agent or subcontractor notify Business Associate of any instances in which PHI is used or disclosed in an unauthorized manner. Business Associate agrees to notify Covered Entity within five (5) working days of any such unauthorized use or disclosure. Business Associate shall take steps to cure the breach of confidentiality and end the violation, or shall terminate the agency agreement or subcontract.
2.5 Access to Information. Business Associate agrees to make available PHI in accordance with 45 CFR §164.524. If any individual requests access to PHI directly from Business Associate, Business Associate shall forward such request to the Covered Entity. Business Associate may inform the individual requesting the PHI that Business Associate has forwarded the individual’s request to Covered Entity. Business Associate shall not itself provide the requested PHI to the individual, and shall not deny the individual's request for access to the individual's PHI. Any denials of access to PHI requested will be the responsibility of Covered Entity.
2.6 Availability of PHI for Amendment. Within five days of a request from Covered Entity for the amendment of an individual's PHI or a record regarding an individual contained in a Designated Record Set (“DRS”) (for so long as the PHI is maintained in the DRS), Business Associate shall provide such information to Covered Entity for amendment and incorporate any such amendments in the PHI as required by 45 CFR §164.526.
2.7 Accounting of Disclosures. Business Associate agrees to implement an appropriate record keeping process to enable it to provide the following information regarding disclosures of PHI as necessary to satisfy Covered Entity’s obligations under 45 CFR § 164.528: (i) the date of the disclosure, (ii) the name of the entity or person who received the PHI, and if known, the address of such entity or person, and (iii) a brief description of the PHI disclosed. If Business Associate receives a request for an accounting of disclosures, Business Associate shall forward such request to Covered Entity within a reasonable time frame to allow Covered Entity to prepare and deliver any required accounting of disclosures.
2.8 Carrying Out Covered Entity’s Obligations. To the extent the Business Associate is to carry out the Covered Entity’s obligations under Subpart E of 45 CFR Part 164, Business Associate shall comply with the requirements of subpart 164.504 that are applicable to the Covered Entity in the performance of such obligation.
2.9 Availability of Books and Records. Business Associate agrees to make its internal practices, books and records relating to the use and disclosure of PHI received from Covered Entity, or created or received, maintained or transmitted on behalf of Covered Entity, available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining the Covered Entity and Business Associate's compliance with the HIPAA Standards. Business Associate promptly shall provide to Covered Entity a copy of any documentation that Business Associate provides to the Secretary.
2.10 Return or Destruction of Information. At the termination of the Underlying Contract(s), Business Associate shall return or destroy all PHI received from Covered Entity, or created, received, maintained, or transmitted on behalf of Covered Entity, that Business Associate still maintains in any form and retain no copies of PHI. If Business Associate determines that return or destruction of any PHI is not feasible, Business Associate shall notify Covered Entity of the reasons why return or destruction is not feasible. If destruction or return of PHI is not feasible, Business Associate shall not use PHI received from Covered Entity, or created or received on behalf of Covered Entity, in a manner other than those permitted or required by state and federal laws or for the purposes described herein.
3. Miscellaneous
3.1 No Third Party Beneficiaries. Nothing in this Agreement is intended to create any third party beneficiaries.
3.2 Definitions. All terms not otherwise defined herein shall be defined in accordance with 45 CFR Parts 160 and 164.
2. Obligations of Business Associate