Loading...
HomeMy WebLinkAboutCity of Tamarac Resolution R-2015-078TR12687 September 2, 2015 Page 1 1 CITY OF TAMARAC, FLORIDA RESOLUTION NO. R-2015--Yy A RESOLUTION OF THE CITY COMMISSION OF THE CITY OF TAMARAC, FLORIDA, TO APPROVE A FIVE (5) YEAR AGREEMENT BETWEEN THE CITY OF TAMARAC AND EMERGENCY EDUCATIONAL INSTITUTE, INC. (EEI) AND AUTHORIZING APPROPRIATE CITY OFFICIALS TO EXECUTE AN AGREEMENT FOR EMERGENCY MEDICAL SERVICES INTERNSHIP PROGRAM AND A HIPAA BUSINESS ASSOCIATE AGREEMENT TO ALLOW EMERGENCY MEDICAL SERVICES (EMS) STUDENTS AN OPPORTUNITY TO RECEIVE EDUCATION AND TRAINING FROM TAMARAC FIRE RESCUE PERSONNEL IN AN EMS STUDENT INTERNSHIP RIDE ALONG PROGRAM BEGINNING UPON EXECUTION OF THE AGREEMENT THROUGH AUGUST 31, 2020; PROVIDING FOR CONFLICTS; PROVIDING FOR SEVERABILITY; AND PROVIDING FOR AN EFFECTIVE DATE. WHEREAS, the City of Tamarac through the Fire Department provides Emergency Medical Services (EMS) and Advanced Life Support (ALS) transport; and WHEREAS, Emergency Educational Institute, Inc. (EEI) has requested that the City of Tamarac allow Emergency Medical Services (EMS) students to ride along on the City's fire rescue units in order to gain the required experience needed to become a State of Florida Certified EMT and/or Paramedic; and WHEREAS, the Agreement for Emergency Medical Services Internship Program (Agreement) will allow EMS students to receive education and training as part of an EMS student internship program; and TR12687 September 2, 2015 Page 2 WHEREAS, Tamarac Fire Rescue is requesting a five (5) year Agreement with Emergency Educational Institute, Inc. beginning upon execution of the Agreement through August 31, 2020 attached hereto as Exhibit 1; and WHEREAS, the Agreement will maintain consistency throughout other student rider agreements the City currently has with other educational institutions; and WHERAS, the City of Tamarac Fire Rescue Department will require each student to sign a Hold Harmless Agreement before participating in the program attached hereto as Exhibit A; and WHEREAS, the HIPAA Business Associate Agreement provided by the Emergency Educational Institute, Inc. is attached hereto as Exhibit B; and WHEREAS, the Fire Chief recommends the approval and execution of the Agreement with Emergency Educational Institute, Inc. and HIPAA Business Associate Agreement; and WHEREAS, the City Commission of the City of Tamarac, Florida deems it to be in the best interest of the citizens and residents of the City of Tamarac to approve and execute the Agreement for Emergency Medical Services Internship Program with Emergency Educational Institute, Inc. and the HIPAA Business Associate Agreement to allow EMS students to ride on Tamarac Fire Rescue vehicles. NOW, THEREFORE, BE IT RESOLVED BY THE CITY COMMISSION OF THE CITY OF TAMARAC, FLORIDA THAT: TR12687 September 2, 2015 Page 3 SECTION 1: The foregoing "WHEREAS" clauses are hereby ratified and confirmed as being true and correct and are hereby made a specific part of this Resolution. All Exhibits attached hereto are expressly incorporated herein and made a part thereof. SECTION 2: The appropriate City Officials are hereby authorized to approve and execute the Agreement for Emergency Medical Services Internship Program attached hereto as Exhibit 1 with an effective date upon execution of the Agreements through August 31, 2020 between the City of Tamarac and Emergency Educational Institute, Inc., and the HIPAA Business Associate Agreement attached hereto as Exhibit B to allow EMS students to ride on City Fire Rescue vehicles. SECTION 3: All Resolutions or parts of Resolutions in conflict herewith are hereby repealed to the extent of such conflict. SECTION 4: If any clause, section, other part or application of this Resolution is held by any court of competent jurisdiction to be unconstitutional or invalid, in part or application, it shall not affect the validity of the remaining portions or applications of this Resolution. SECTION 5: This Resolution shall become effective immediately upon its passage and adoption. The rest of this page is left blank intentionally 1 TR12687 September 2, 2015 Page 4 PASSED, ADOPTED AND APPROVED this !� day of , 2015. I �•Il� ... b. MAYOR ATTEST: ,I CITY CLERK RECORD OF COMMISSION VOTE: MAYOR DRESSLER 1460 DIST 1: VICE MAYOR BUSHNELL DIST 2: COMM. GOMEZ DIST 3: COMM. GLASSER DIST 4: COMM. PLACKO I HEREBY CERTIFY THAT I HAVE APPROVED THIS RESOLUTION AS TO FORM SA LI L S. GO E CITY ATTORNEY L' EMERGENCY EDUCATIONAL INSTITUTE, INC. and CITY OF TAMARAC AGREEMENT FOR EMERGENCY MEDICAL SERVICES INTERNSHIP PROGRAM This is an Agreement between EMERGENCY EDUCATIONAL INSTITUTE, INC., Florida (hereafter referred to as "AGENCY') an accredited educational institution, having a principal address of 3111 North University Drive Suite 403, Coral Springs, Florida 33065 located in Broward County, State of Florida, and City of Tamarac, (hereafter referred to as "CITY'), providing emergency medical services, whose principal address is 7525 NW 88th Avenue, Tamarac, Florida 33321 located in the County of Broward, State of Florida. AGENCY and CITY are each a "party" and together are the "parties." WHEREAS, the CITY agrees to collaborate in the education and training of students in the Emergency Medical Technician (EMT) Program and the Emergency Medical Paramedic Program (EMT-P) of the AGENCY. WHEREAS, the CITY acknowledges the value of this collaboration and agrees to provide optimum facilities, resources and expertise at their disposal for the comprehensive education of the student, and WHEREAS, this Agreement will benefit both parties by providing trained EMTs and Paramedics. NOW, THEREFORE, it is hereby agreed by the parties as follows: 1. RESPONSIBILITIES OF THE AGENCY: A. The AGENCY shall coordinate clinical rotations in consultation with appropriate personnel of the CITY. These rotations will be selected in accordance with the specific learning required and opportunities accessible. B. The AGENCY shall accept administrative responsibility for the program and provide didactic and performance based instruction as required. 1 100068281.2 2704-0501640 } C. The AGENCY shall ensure the quality of course content in accordance with existing accreditation standards. D. The AGENCY shall acknowledge and consult with proper CITY personnel for administrative matters. E. The AGENCY shall comply with existing operational policies and procedures of the CITY. F. The AGENCY shall require each student to secure Professional Liability Insurance coverage of $1,000,000.00/$3,000,000.00 and ensure each student has secured same before participation in the Program. G. The AGENCY shall provide documentation substantiating the certification of each student's medical insurance before participation in the Program. H. The AGENCY shall secure at its expense General Comprehensive Insurance including Bodily Injury Liability and Property Damage Liability, the limits of which must be acceptable to the CITY. The AGENCY's liability policy shall be endorsed to add the City of Tamarac as an additional insured and not as a mere certificate holder. I. The AGENCY shall be responsible for compliance with the Agreement, including but not limited to responsibility to provide all of the AGENCY's allied health students and faculty with (a) information and training about the hazards associated with blood and or other potentially infectious materials, (b) information and training about the protective measures to be taken to minimize the risk of occupational exposure to bloodborn pathogens, (c) training in the appropriate actions to take in an emergency involving exposure to blood and other potentially infectious materials, and (d) information as to the reasons the student and faculty should participate in hepatitis B vaccination and post -exposure evaluation and follow-up. J. The AGENCY shall be responsible to provide training for faculty and students concerning the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and any of its regulations and related laws, any other applicable state and federal medical privacy laws, including the Florida Information Protection Act. K. The AGENCY shall be responsible in accordance with the Agreement for verifying that AGENCY students and faculty are compliant with the Recommended Guidelines for Occupational Exposures to Infectious Diseases and the City's joint EMS protocols. (00068281.2 2704-0501640 ) 2 L. The AGENCY shall be responsible for the maintenance of all faculty and student records. The AGENCY confirms that all its allied health students (a) have had a Diphtheria Tetanus Toxide Booster within the last ten years; (b) can verify either immunity or lack of immunity to varicella, measles, mumps, and rubella through a titer or documented positive history of chicken pox, measles, mumps, and rubella; (c) undergo annual screening for tuberculosis. M. The AGENCY shall and does hereby agree to defend, indemnify, and hold harmless the CITY, its Administrators, elected and appointed officials, officers, agents, and employees from any and all claims, demands, liabilities, damages, and expenses for illness or injuries to any persons (whether employees of the CITY, third parties or students, or representatives of the AGENCY) or damage to any property, caused directly or indirectly by the negligent acts of, or as a result of the omission of or performance of duties by the AGENCY, its officers, elected and appointed officials, directors, agents, servants, or employees under this Agreement and hold same harmless against any and all claims, liability, loss, cost, damage, or expense of any type or nature whatsoever, including reasonable attorneys fees and court costs, which may arise with regard to any activities associated with this Agreement. N. The AGENCY shall require each student to sign the CITY's Hold Harmless Agreement before participating as set forth in Exhibit "A" attached hereto. O. The AGENCY shall require each student to sign the CITY Acknowledgement of Responsibility to Maintain Confidentiality of Medical Information before participating. (Attachment: Maintain Confidentiality of Medical Information) P. The AGENCY shall provide the CITY with thirty (30) days' written notice prior to cancellation, revocation, and non -renewal or material change of any policy of insurance. Should the AGENCY fail to maintain any policy of insurance enumerated under this Agreement, after written notice of cancellation, revocation, or renewal or material change to any existing policy, fail to replace same under like terms within seven (7) days, written notice demanding same by the CITY, said cancellation, revocation, or non -renewal material change of any policy of insurance contained hereunder shall be deemed a material breach by the AGENCY, and the CITY shall have the right to terminate this Agreement at once. {00068281.2 2704-0501640 1 3 2. RESPONSIBILITIES OF THE CITY: A. The CITY will provide information and training to the AGENCY's allied health students and faculty on any City of Tamarac Policies and Procedures related to the Agreement. B. The CITY will provide the clinical facilities necessary for the students to obtain experience with patients representing a broad range of out -of -hospital medical care problems. C. The CITY will provide students with opportunities for observations and participation in patient evaluation, treatment and transportation in the out -of -hospital environment. D. The CITY will provide clinical supervision of students and complete student evaluation forms. E. The CITY will communicate pertinent information related to the student clinical performance to the AGENCY. F. The CITY shall be responsible for providing the AGENCY's allied health students and faculty with personal protective equipment, which is necessary to comply with the Agreement. 3. HIPAA/HITECH Act/Florida Information Protection Act. To the extent that the students provided by AGENCY are considered employees, servants, agents, or volunteers of AGENCY, and to the extent that students are privy to Protected Health Information or Personal Information as defined in the Health Insurance Portability and Accountability Act (45 C.F.R. §§ 160 and 164), the Health Information Technology for Economic and Clinical Health (HITECH) Act (Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (ARRA), Pub. L. No. 111-5, 123 Stat. 226 (Feb. 17, 2009), codified at 42 U.S.C. §§300jj et seq.; §§17901 et seq.), or the Florida Information Protection Act, AGENCY shall execute a HIPAA Business Associate Agreement (section 501.171, Florida Statutes), attached hereto as Exhibit "B" of this Agreement. 4. This Agreement will be in effect for five (5) years from the date of execution by all parties. However, either party may terminate this Agreement upon thirty (30) day written notice, with or without cause, unless otherwise specified in section 1P. 5. This document incorporates and includes all prior negotiations, agreements, or understandings applicable to the matters contained herein, and the parties agree that there are no commitments, agreements, or understandings concerning the subject matter of this Agreement that are not contained in this document. Accordingly, it is agreed that no deviation from the terms hereof shall be predicated upon any prior representations or agreements whether oral or written. {00068281.2 2704-0501640 } It is further agreed that no modification, amendment, or alteration in the terms or conditions contained herein shall be effective unless contained in a written document executed with the same formality and of equal propriety herewith. 6. This Agreement may be executed in two (2) or more counterparts, each of which together shall be deemed an original, but all of which together shall constitute one and the same instrument. In the event that any signature is delivered by facsimile transmission or by e-mail delivery of a .PDF format data file, such signature shall create a valid and binding obligation of the party executing (or on whose behalf such signature is executed) with the same force and effect as if such facsimile or .PDF signature page were an original thereof. 7. If any provision of this Agreement or application thereof to any person or situation shall to any extent, be held invalid or unenforceable, the remainder of this Agreement, and the application of such provisions to persons or situations other than those as to which it shall have been held invalid or unenforceable shall not be affected thereby, and shall continue in full force and effect, and be enforced to the fullest extent permitted by law. 8. AGENCY represents and agrees that it is familiar with all laws, ordinances, and regulations applicable to the supplies, products, equipment, software or services to be furnished under the Agreement. Venue for any action arising from or related to the Agreement shall be brought in a court of competent jurisdiction in Broward County, Florida. 9. Failure of the CITY to insist upon strict performance of any provision or condition of this Agreement, or to execute any right therein contained, shall not be construed as a waiver or relinquishment for the future of any such provision, condition, or right, but the same shall remain in full force and effect. 10. NOTICE. Whenever any party desires to give notice unto any other party, it must be given by written notice, sent by certified United States mail, with return receipt requested, addressed to the Party for whom it is intended and the remaining party, at the places last specified, and the places for giving of notice shall remain such until they shall have been changed by written notice in compliance with the provisions of this section. For the present, the CITY and the AGENCY designate the following as the respective places for giving of notice: To EEI: Todd Soard, President 3111 N. University Drive Coral Springs, Florida 33065 CITY: Michael C. Cernech, City Manager City of Tamarac 7525 NW 88 Ave Tamarac, FL 33321 (00068281.2 2704-0501640 ) 5 With a copy to: Steve Stillwell, Division Chief, Professional Standards Tamarac Fire Rescue 6000 Hiatus Road Tamarac, FL 33321 Samuel S. Goren, City Attorney Goren, Cherof, Doody & Ezrol, P.A. 3099 E. Commercial Blvd., Suite 200 Ft. Lauderdale, FL 33308 IN WITNESS WHEREOF, the parties have hereunto executed this Agreement on the dates indicated, the latter of which shall be controlling. EMERGENCY EDUCATIONAL INSTITUTE, INC..,,>FLORIDA BY: •.�� / oar ° c/r. (Name/Title) DATE: F - I z -I -r— STATE OF FLORIDA COUNTY OF BROWARD BEFORE ME, the undersigned authority, personally appeared who being first duly sworn deposes and says on oath that he/she has read the foregoing Agreement, subscribed to by him/her, and that the matters therein contained are true and correct to the best of his/her knowledge and belief. SWORN TO AND SUBSCRIBED before me this ' day of , 2015. Personally known X My Commission Expires or produced Identification 2 ATTEST: Ao PATRICIA EUF L, `CMS CITY CLERK °° ��;'.y ...'�a-.,`"• (00068281.2 2704-05016401 ,ley l . yi � �„+ o �f o" 6 �°i4jJ4 +1a�'�. (type) DATE: 6 ? vl APPROVED AS TO FORM AND LEGAk SUFFICIE CY: SAAUEL 9 GUk CITY ATTORNE DATE: Z/ DATE: 100068281.2 2704-0501640 1 TR12687 — Exhibit "A" CITY OF TAMARAC FIRE RESCUE DEPARTMENT HOLD HARMLESS AGREEMENT IN CONSIDERATION of the permission I have been granted to accompany one or more agents of the City of Tamarac Fire Rescue Department, Tamarac, Florida, a municipal corporation, in the course of his or her duty I, the undersigned, do by these presents release the City of Tamarac and its Fire Rescue agents, public officials, servants and employees of the City of Tamarac from any and all liability, claims, demands, actions and causes of action resulting from any and all damage to me or my property, injuries, illnesses, or my death, arising out of or relating to any happening or occurrence while I am accompanying any agent of Tamarac Fire Rescue on duty, or incidental thereto, and for the same consideration, I promise to release and forever hold each of them harmless from any such liability, claims, demands, illnesses, actions or causes of action. The terms of this Agreement shall be in full force and effect on the date hereof and on any other occasion hereafter when I accompany City of Tamarac agents. I have read and understand the conditions of this program as stated above, and hereby voluntarily assume all risks of loss, damage, injury or illnesses to me or my property, including death, which may be sustained while a passenger of the City vehicle or incidental to accompanying one or more City of Tamarac Fire Rescue agents while on duty. This Release and Agreement shall be binding upon me and my heirs, executors, administrators, personal representatives and assigns, and shall inure to the benefit of the said City, agents, public officials and any person herein designated, and their heirs, executors, administrators, personal representatives, assigns and successors in office. Dated this day of 20 Print Name Signature FOR DEPARTMENTAL USE Citizen Assigned To: Date Civilian Rode: Shift: Shift Supervisor's Signature: Hold Harmless.doc Revised 4/19/04 EXHIBIT HIPAA BUSINESS ASSOCIATE AGREEMENT ("BA AGREEMENT") To the extent that the City of Tamarac ("Covered Entity") discloses Protected Health Information to the Emergency Educational Institute, INC., of Broward County, its employees, servants, agents, or volunteers while providing "ride time" services for Covered Entity, ("Business Associate") (Covered Entity and Business Associate are each a "party" and together are the "parties) in connection with services or products provided to Covered Entity, or as otherwise required by the Health Insurance Portability and Accountability Act of 1996, as amended, ("HIPAA"), Covered Entity and Business Associate agree to the following terms and conditions, which are intended to comply with HIPAA, the Health Information Technology for Economic and Clinical Health Act of 2009 (the "HITECH Act"), and the Florida Information Protection Act (section 501.171, Florida Statutes): 1. Definitions (a) Business Associate. "Business Associate" shall have the same meaning as the term "business associate" at 45 CFR 160.103, and in reference to this BA Agreement shall mean the individual or entity identified above as the Business Associate. (b) Covered Entity. "Covered Entity" shall generally have the same meaning as the term "covered entity" at 45 CFR Part 160.103, and in reference to the party to this BA Agreement, shall mean City of Tamarac, Florida ("City"). (c) HIPAA Rules. "HIPAA Rules" shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164. (d) The following terms used in this BA Agreement shall have the same meaning as those terms defined in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use. All other capitalized terms used but not otherwise defined in this BA Agreement shall have the same meaning as those terms in the Privacy Rule and Security Rule, including 45 CFR Part 160.103 and 164.501. (e) The following terms used in this BA Agreement shall have the same meaning as those terms defined in the Florida Information Protection Act, section 501.171, Florida Statutes: "customer records," "personal information," and "third -party agent." All terms that may be defined in multiple laws, i.e. HIPAA and the Florida Information Protection Act, shall be given such meaning as to provide the more strict interpretation or form of compliance with applicable state or federal laws. (f) A citation in this Agreement to the Code of Federal Regulations, federal law, or state law shall mean the cited section as that section may be amended from time to time. {00063850.1 2704-0501640 } 2. Obligations and Activities of Business Associate (a) Business Associate agrees to not Use or disclose Protected Health Information other than as permitted or required by this BA Agreement or as Required by Law. (b) Business Associate agrees to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information, to prevent Use or Disclosure of the Protected Health Information other than as provided for by this BA Agreement. (c) Business Associate agrees to report to Covered Entity's Privacy Official, within five (5) business days, any Use or Disclosure of the Protected Health Information not provided for by this BA Agreement, of which it becomes aware, including breaches of Unsecured Protected Health Information as required by 45 CFR Part 164.410. Such report shall include, without limitation, the identification of each Individual whose Unsecured Protected Health Information has been, or is reasonably believed by the Business Associate to have been, accessed, acquired, or disclosed during such Breach. This includes, but is not limited to, a Breach of the security of any data covered by section 501.171, Florida Statutes. ' (d) In accordance with 45 CFR Part 164.502(e)(1)(ii) and Part 164.308(b)(2), if applicable, Business Associate agrees to ensure that any agent or Subcontractor that create, receive, maintain, or transmit Protected Health Information on behalf of Business Associate agrees in writing to the same restrictions, conditions and requirements that apply to Business Associate with respect to such information. Upon Covered Entity's request, Business Associate shall make such written agreements between Business Associate and its agents or Subcontrators available to Covered Entity for its review. (e) To the extent Business Associate has Protected Health Information in a Designated Record Set that is not maintained by Covered Entity, Business Associate agrees to provide access, at the request of Covered Entity (which may also be on behalf of an Individual), to Protected Health Information in a Designated Record Set, to Covered Entity in order to meet the requirements under 45 CFR Part 164.524, including provision of records in electronic form (including those requests made by Covered Entity on behalf of an Individual), to the extent required by the HITECH Act. (f) Business Associate agrees to make any amendment(s) to Protected Health Information in its possession contained in a Designated Record Set that Covered Entity directs or agrees to pursuant to 45 CFR Part 164.526, at the request of Covered Entity, or take other measures as necessary to satisfy Covered Entity's obligations under 45 CFR Part 164.526. (g) To the extent that Business Associate is to carry out one or more of Covered Entity's obligation(s) under Subpart E of 45 CFR Part 164, Business Associate shall comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligation(s). (h) Business Associate agrees to make its internal practices, books, and records relating to the Use and Disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity, available to the Secretary, in a time (00063850.1 2704-0501640 1 and manner designated by the Secretary, for purposes of the Secretary determining Covered Entity's compliance with the HIPAA Rules. (i) Business Associate agrees to document and maintain a record of all Disclosures of Protected Health Information in its possession and information related to such Disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of Disclosures of Protected Health Information in accordance with 45 CFR Part 164.528, the HITECH Act, and Florida law. 0) Business Associate agrees to provide to Covered Entity information collected in accordance with Section 2(i) of this BA Agreement, to permit Covered Entity to respond to a request by an Individual for an accounting of Disclosures of Protected Health Information in accordance with 45 CFR Part 164.528, the HITECH Act, and Florida law. Such accounting must be provided without cost to the individual or Covered Entity if it is the first accounting requested by an individual within any twelve (12) month period; however, a reasonable, cost -based fee may be charged for subsequent accountings if Business Associate informs the individual in advance of the fee and is afforded an opportunity to withdraw or modify the request. Such accounting is limited to disclosures that were made in the six (6) years prior to the request (not including disclosures prior to the compliance date of the Privacy Rule) and shall be provided for as long as Business Associate maintains the PHI. (k) Business Associate agrees to, subject to subsection 4(c) below, return to the Covered Entity or destroy, within fifteen (15) days of the termination of this BA Agreement, the Protected Health Information in its possession and retain no copies. (1) Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to either party, of a use or Disclosure of Protected Health Information in violation of this BA Agreement. (m) Business Associate agrees to indemnify, insure, defend, and hold harmless Covered Entity and Covered Entity's employees, directors, officers, subcontractors, agents, or members of its workforce, each of the foregoing hereinafter referred to as an "indemnified party," against all actual and direct losses suffered by the indemnified party and all liability to third parties arising from or in connection with any Breach of this BA Agreement or of any warranty hereunder or from any negligence, wrongful acts, or omissions, including the failure to perform its obligations under HIPAA, as well as the additional obligations under the HITECH Act, by Business Associate or its employees, directors, officers, subcontractors, agents, or members of its workforce. This includes, but is not limited to, expenses associated with notification to Individuals and/or the media in the event of a Breach of Protected Health Information held by Business Associate. Accordingly, on demand, Business Associate shall reimburse any indemnified party for any and all actual and direct losses, liabilities, lost profits, fines, penalties, costs or expenses (including reasonable attorneys' fees) which may for any reason be imposed upon any indemnified party by reason of any suit, claim, action, proceeding or demand by any third party which results from the indemnifying party's Breach hereunder. The provisions of this paragraph shall survive the expiration or termination of this BA Agreement for any reason. {00063550.1 2704-0501640 } (n) In addition to its overall obligations with respect to Protected Health Information, to the extent required by the Security Rule, Business Associate will: (1) implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic Protected Health Information (EPHI) that it creates, receives, maintains, or transmits on behalf of Covered Entity as required by HIPAA; (2) ensure that any agent or Subcontractor to whom it provides such EPHI agrees to implement reasonable and appropriate safeguards to protect the EPHI; and (3) that all PHI or EPHI be secured when accessed by Business Associate's employees, agents, or subcontractors, limited to the legitimate business needs while working with the PHI or EPHI; and (4) that any personnel changes by Business Associate, eliminating the legitimate business needs for employees, agents or contractors access to PHI — either by revision of duties or termination — shall be immediately reported to Covered Entity, or no later than the third business day after the personnel change becomes effective; and (5) report to Covered Entity any Security Incident of which it becomes aware in accordance with section 2(c) of this BA Agreement. (6) periodically conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by Business Associate and implement security measures sufficient to reduce risks and vulnerabilities in accordance with 45 CFR § 164.306(a). (o) Except as otherwise allowed in this BA Agreement, HIPAA, and the HITECH Act, Business Associate shall not directly or indirectly receive remuneration in exchange for any Protected Health Information of an Individual unless the Individual has provided a valid, HIPAA-compliant authorization. (p) Business Associate shall use and disclose only the Minimum Necessary Protected Health Information to accomplish the intended purpose of such Use, Disclosure or request. Prior to any Use or Disclosure, Business Associate shall determine whether a Limited Data Set would be sufficient for these purposes. (q) Covered Entity, in its sole and absolute discretion, may elect to delegate to Business Associate the requirement under HIPAA and the HITECH Act to notify affected Individuals of a Breach of Unsecured Protected Health Information if such Breach results from, or is related to, an act or omission of Business Associate or the agents or representatives of Business Associate. If Covered Entity elects to make such delegation, Business Associate shall perform such notifications and any other reasonable remediation services (1) at Business Associate's sole cost and expense, and (2) in compliance with all applicable laws including (00063850.1 2704-0501640 ) HIPAA, the HITECH Act, and the Florida Information Protection Act (section 501.171, Florida Statutes), as these laws may be amended from time to time. Business Associate shall also provide Covered Entity with the opportunity, in advance, to review and approve of the form and content of any Breach notification that Business Associate provides to Individuals. (r) Business Associate agrees to comply with the following: (1) Sections 164.308 (administrative safeguards), 164.310 (physical safeguards), 164.312 (technical safeguards) and 164.316 (policies and procedures and documentation requirements) of the Security Rule shall apply to Business Associate in the same manner that such sections apply to Covered Entity. The additional requirements of the HITECH Act that relate to security and that are made applicable with respect to covered entities shall also be applicable to Business Associate and shall be and by this reference hereby are incorporated into this BA Agreement. (2) Unless Covered Entity agrees, in writing, that this requirement is infeasible with respect to particular data, Business Associate shall secure all Protected Health Information by a technology standard that renders Protected Health Information unusable, unreadable, or indecipherable to unauthorized individuals and is developed or endorsed by a standards developing organization that is accredited by the American National Standards Institute and is consistent with guidance issued by the Secretary specifying the technologies and methodologies that render Protected Health Information unusable, unreadable, or indecipherable to unauthorized individuals, including the use of standards developed under Section 3002(b)(2)(B)(vi) of the Public Health Service Act, as added by the HITECH Act. (3) Business Associate may Use and Disclose Protected Health Information that Business Associate obtains or creates only if such Use or Disclosure, respectively, is in compliance with each applicable requirement of Section 164.504(e) of the Privacy Rule, relating to business associate contracts. The additional requirements of Subtitle D of the HITECH Act that relate to privacy and that are made applicable with respect to Covered Entity shall also be applicable to Business Associate and shall be and by this reference hereby are incorporated into this BA Agreement. (4) In accordance with Section 164.504(e)(1)(ii) of the Privacy Rule, each party agrees that, if it knows of a pattern of activity or practice of the other party that constitutes a material Breach or violation of the other party's obligation under the BA Agreement, the non - breaching party will take reasonable steps to cure the Breach or end the violation, as applicable, and, if such steps are unsuccessful, terminate the contract or arrangement, if feasible, or if termination is not feasible, report the problem to the Secretary. (s) Business Associate shall abide by the limitations of Covered Entity's Notice of Privacy Practices, which it has knowledge (a copy may be provided upon request by the Business Associate). Any use or disclosure permitted by this BA Agreement may be amended by changes to Covered Entity's Notice; provided, however, that the amended Notice shall not affect permitted uses and disclosures on which Business Associate relied prior to receiving notice of such amended Notice. (00063850.1 2704-0501640 ) (t) Business Associate agrees to review and understand the HIPAA Rules as it applies to Business Associate, and to comply with the applicable requirements of the HIPAA Rule, as well as any applicable amendments. 3. Permitted Uses and Disclosures of Protected Health Information by Business Associate (a) General Use and Disclosure Provisions Except as otherwise limited in this BA Agreement, Business Associate may Use or Disclose Protected Health Information obtained from or on behalf of Covered Entity to perform functions, activities, or services for, or on behalf of, Covered Entity as specified in this BA Agreement, provided that such Use or Disclosure complies with HIPAA. Business Associate acknowledges and agrees that it acquires no title or rights to the Protected Health Information, including any de -identified information, as a result of this BA Agreement. (b) Specific Use and Disclosure Provisions (1) Business Associate may only Use or Disclose Protected Health Information as necessary to perform functions, activities, or services for, or on behalf of, Covered Entity to fulfill its obligations under any consulting agreement, service agreement or any other agreement with Covered Entity (collectively "Underlying Agreement"), provided that such Use or Disclosure would not violate the Privacy Rule or Security Rule if done by the Covered Entity. (2) Business Associate agrees to make Uses and Disclosures and requests for Protected Health Information consistent with Covered Entity's Minimum Necessary policies and procedures. (3) Business Associate may Use and disclose Protected Health Information for the proper and necessary management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided that, as to any such Disclosure, the following requirements are met: (i) the Disclosure is required by law; or (ii) Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached. (4) Except as otherwise limited in this BA Agreement, Business Associate may Use Protected Health Information to provide Data Aggregation services to Covered Entity, relating to the Health Care Operations of Covered Entity. (00063850.1 2704-0501640 1 (5) If the Underlying Agreement permits or requires Business Associate to Use de -identified Protected Health Information, the Protected Health Information must be de -identified in accordance with 45 CFR 164.514 (a)-(c). (c) Withdrawal of Authorization. If the use or disclosure of PHI in this Agreement is based upon an Individual's specific authorization for the use or disclosure of his or her PHI, and the Individual revokes such authorization, the effective date of such authorization has expired, or such authorization is found to be defective in any manner that renders it invalid, Business Associate shall, if it has notice of such revocation, expiration, or invalidity, cease the use and disclosure of the Individual's PHI except to the extent it has relied on such use or disclosure, or if an exception under the Privacy Rule expressly applies. 4. Term, Survival and Termination (a) Term The term of this BA Agreement shall be effective upon the date of execution by Covered Entity and Business Associate and shall terminate when Business Associate no longer possesses Protected Health Information from Covered Entity or on the date Covered Entity terminates for cause set forth herein, whichever is sooner. (b) Termination for Cause Upon Covered Entity's knowledge of a material Breach by Business Associate, Covered Entity shall provide written notice to Business Associate and may terminate this BA Agreement and any Underlying Agreement with Business Associate if Business Associate does not cure the Breach or end the violation within 30 days. (c) Effect of Termination (1) Except as provided below in section 4(c)(2) of this BA Agreement, upon termination of this Agreement, for any reason, Business Associate shall return to Covered Entity or destroy all Protected Health Information received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity, that the Business Associate still maintains in any form. This provision shall apply to Protected Health Information that is in the possession of Subcontractors or agents of Business Associate. Business Associate shall retain no copies of the Protected Health Information. (2) In the event that Business Associate determines that returning or destroying the Protected Health Information is infeasible, Business Associate shall provide to Covered Entity written notification of the conditions that make return or destruction infeasible, and, if Covered Entity determines that return or destruction is infeasible, Business Associate shall extend the protections of this BA Agreement to such Protected Health Information and limit further Uses and Disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such Protected Health Information. {00063850.1 2704-0501640 } (3) If the Underlying Agreement authorizes Business Associate to Use or disclose Protected Health Information for its own management and administration or to carry out its legal responsibilities and Business Associate needs to retain Protected Health Information for such purposes after termination of the Underlying Agreement, Business Associate shall: (i) retain only that Protected Health Information which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities; (ii) return to Covered Entity or, if agreed to by Covered Entity, destroy the remaining protected health information that the business associate still maintains in any form; (iii) continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information to prevent Use or Disclosure of the Protected Health Information, other than as provided for in this section, for as long as Business Associate retains the Protected Health Information; (iv) not Use or disclose the protected health information retained by Business Associate other than for the purposes for which such Protected Health Information was retained and subject to the same conditions set out at section 3 of this BA Agreement, which applied prior to termination; and (v) return to Covered Entity or, if agreed to by Covered Entity, destroy the Protected Health Information retained by Business Associate when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities. (d) Survival Business Associate's obligations under this BA Agreement shall survive the termination of this BA Agreement and shall end when all of the Protected Health Information provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity. 5. Interpretation and Amendment of this BA Agreement To the degree the terms of this BA Agreement conflict with the terms of any underlying contract, the terms of this BA Agreement shall control. A reference in this BA Agreement to a section of the Privacy Rule means the section as in effect or as amended. Any ambiguity or inconsistency in this BA Agreement shall be resolved in favor of a meaning that permits Covered Entity to comply with the Privacy Rule, the Security Rule, and the HITECH Act. The parties hereto agree to negotiate in good faith to amend this BA Agreement from time to time as is necessary for Covered Entity to comply with the requirements of the Privacy Rule and HIPAA and for Business Associate to provide services to Covered Entity. However, no change, amendment, or modification of this BA Agreement shall be valid unless it is set forth in writing and agreed to by both parties. (00063850.1 2704-0501640 ) 6. No Third Party Rights/Independent Contractors The parties to this BA Agreement do not intend to create any rights in any third parties. The parties agree that they are independent contractors and not agents of each other. 7. Notices Any notice required or permitted by this BA Agreement to be given or delivered shall be in writing and shall be deemed given or delivered if delivered in person, or sent by courier or expedited delivery service, or sent by registered or certified mail, postage prepaid, return receipt requested, or sent by facsimile (if confirmed), to the address set forth below. Each party may change its address for purposes of this BA agreement by written notice to the other party. To Business Associate: Todd Soard, President 3111 N. University Drive Coral Springs, Florida 33065 To Covered Entity: Michael C. Cernech, City Manager 7525 NW 88 Avenue Tamarac, FL 33321 With a Copy to: Steve Stillwell, Division Chief, Professional Standard Tamarac Fire Rescue 6000 Hiatus Road Tamarac, FL 33321 And a Copy to: Samuel S. Goren, City Attorney Goren, Cherof, Doody & Ezrol, P.A. 3099 East Commercial Boulevard, Suite 200 Ft. Lauderdale, Florida 33308 8. Florida Information Protection Act: Business Associate agrees and understands that the services and/or goods provided under the BA consist, at least in part, of "customer records" that contain "personal information," as defined in the Florida Information Protection Act, section 501.171, Florida Statutes (the "Act"). Accordingly, as required by the Act, Business Associate agrees to implement safeguards to protect customer records containing personal information, in whatever form retained and stored, from a breach of security. If customer records in Business Associate's possession are breached in the manner set forth in the Act, Business Associate shall immediately notify City as indicated herein, and Business Associate shall work with City as required by the Act to assist in any of the following actions: a. Investigate the alleged breach and determine if an actual breach has occurred, which may include the use of law enforcement officials as needed and as determined by City; b. breached; (00063850.1 2704-0501640 1 Provide notice to any and all consumers whose personal information has been (00063850.1 2704-0501640 1 C. Provide any and all other notices to governmental agencies that may be applicable under the Act, if a breach has reached a particular threshold, as defined in the Act, which may include but is not limited to: credit reporting agencies and the Florida Department of Legal Affairs; d. Ensure that Business Associate's third -party agents are made aware of the Act and any requirements to comply with the Act, and require that those third -party agents that store customer records of City who experience a breach notify City immediately, and work with Business Associate and City as outlined in this section of the Addendum. The procedures specified herein shall not supersede any requirements specified by the Act. The provisions of the Act, as may be amended from time to time, shall prevail in the event of any conflict. 9. Miscellaneous (a) Rights of Proprietary Information. Covered Entity retains any and all rights to the proprietary information, confidential information, and PHI/EPHI it releases to Business Associate. (b) Assignment of Rights and Delegation of Duties. This BA Agreement is binding upon and inures to the benefit of the Parties hereto and their respective successors and permitted assigns. However, neither party may assign any of its rights or delegate any of its obligations under this BA Agreement without the prior written consent of the other party, which consent shall not be unreasonably withheld or delayed. Notwithstanding any provisions to the contrary, however, Covered Entity retains the right to assign or delegate any of its rights or obligations hereunder to any of its wholly owned subsidiaries, affiliates, or successor companies. Assignments made in violation of this provision are null and void. (c) Nature of Agreement. Nothing in this BA Agreement shall be construed to create (i) a partnership, joint venture or other joint business relationship between the parties or any of their affiliates, (ii) any fiduciary duty owed by one party to another party or any of its affiliates, or (iii) a relationship of employer and employee between the parties. (d) No Waiver. Failure or delay on the part of either party to exercise any right, power, privilege, or remedy hereunder shall not constitute a waiver thereof. No provision of this BA Agreement may be waived by either party except by a writing signed by an authorized representative of the party making the waiver. (e) Equitable Relief. Any disclosure of misappropriation of PHI or e-PHI by Business Associate in violation of this BA Agreement will cause Covered Entity irreparable harm, the amount of which may be difficult to ascertain. Business Associate therefore agrees that Covered Entity shall have the right to apply to a court of competent jurisdiction for specific performance and/or an order restraining and enjoining Business Associate from any such further disclosure or breach and for such other relief as Covered Entity shall deem appropriate. Such rights are in addition to any other remedies available to Covered Entity at law or in equity. (00063850.1 2704-0501640 ) Business Associate expressly waives the defense that a remedy in damages will be adequate, and further waives any requirement in an action for specific performance or injunction for the posting of a bond by Covered Entity. (f) Severability. The provisions of this BA Agreement shall be severable, and if any provision of this BA Agreement shall be held or declared to be illegal, invalid, or unenforceable, the remainder of this BA Agreement shall continue in full force and effect as though such illegal, invalid, or unenforceable provision had not been contained herein. (g) No Third Party Beneficiaries. Nothing in this BA Agreement shall be considered or construed as conferring any right or benefit on a person not party to this BA Agreement nor imposing any obligations on either party hereto to persons not a party to this BA Agreement. (h) Headings. The descriptive headings of the articles, sections, subsections, exhibits, and schedules of this BA Agreement (if any) are inserted for convenience only, do not constitute a part of this BA Agreement, and shall not affect in any way the meaning or interpretation of this BA Agreement. (i) Entire Agreement. This BA Agreement, together with all exhibits, riders, and amendments, if applicable, which are fully completed and signed by authorized persons on behalf of both parties from time to time while this BA Agreement is in effect, constitutes the entire BA Agreement between the parties hereto with respect to the subject matter hereof and supersedes all previous written or oral understandings, agreements, negotiations, commitments, and any other writing and communication by or between the parties with respect to the subject matter hereof. In the event of any inconsistencies between any provisions of this BA Agreement in any provisions of the exhibits, riders, or amendments, the provisions of this BA Agreement shall control. 0) Interpretation. Any ambiguity in this BA Agreement shall be resolved in favor of a meaning that permits Covered Entity to comply with the HIPAA Rules and any applicable state confidentiality laws. The provisions of this BA Agreement shall prevail over the provisions of any other agreement that exists between the parties that may conflict with, or appear inconsistent with, any provision of this BA Agreement or the HIPAA Rules. IN WITNESS WHEREOF, the parties have executed this BA Agreement, effective as of the last signature date below. Covered Entity: City o c By. 100063850.1 2704-0501640 } Florida Name: %�/ <' A ae/c// Date: U ©g 1-6— Name: —1-2-1 -s-ol-w - Date: f / ? (00063850.1 2704-0501640 )