WHEREAS, Nemours has an electronic health record system (EHRS) containing clinical information (including progress notes, specialty consults, laboratory and imaging results), demographics, and other information; and,
WHEREAS, Nemours has an interest in improving the quality, delivery and coordination of care to Patients of Nemours by freely sharing HHCA, as appropriate, detailed clinical level data pertaining to Patients of Nemours and HHCA in instances wherein each entity neither has or had a relationship with the Patient and the information shared pertains to such relationship.
WHEREAS, Nemours has the ability to provide HHCA secure electronic access to its Patients' EHRs contained in its EHRs via an Internet connection to its Service; and
WHEREAS, HHCA desiers to obtain secure electronic access to its Patients' EHRs using the Service;
NOW THEREFORE, in consideration of the promises and covenants contained in this Agreement, and for good and valuable consideration, Nemours and Practice agree as follows:
1. Access to Nemours' Data: Upon execution of this Agreement and any other required documents, and approval of all access sites and Users as required herein, Nemours will provide HHCA secure access to its Patients¿ EHRs via its Service and will provide limited training on the Service.
2.1 Authorized Agent or Representative means an individual who has the legal authority to legally obligate the HHCA under this Agreement.
2.2 Business Associate means business associate of the HHCA as defined at 45 CFR § 160.103.
2.3 Health Care Operations means health care operations as defined int he HIPAA privacy regulations at 45 CFR § 164.501 and the disclosure is for a purpsoe liste din paragraph (1) or (2) of said definition.
2.4 HIPAA means Health Insurance Portability and Accountability Act of 1996 as amneded. HIPPA, which contains the federal privacy regulations codified at 45 CFR §160 and §164 (Subparts A & E) and the federal security regulations codified at 45 CFR §160 and §164 (Subparts A & C).
2.5 Nemours' Data includes the PHI contained within Nemours' EHRS and Nemours' Proprietary Information.
2.6 Patient means an Individual as defined at 45 C.F.R. § 160.103 ("the person who is the subject of protected health information") with whom the HHCA either has or had a relationship pertaining to the PHI being requested via the Service.
2.7 Permitted Use means uses of the Service described in Section 6 below.
2.8 HHCA is a home health care agency, organized as a legaal entity, consisting of either one or several physicians or allied health care providers providing care to pediatric Patients who have also been treated by Memours providers. The legal entity is considered the HHCA.
2.9 Privacy Officer refers to a Nemours employee who is responsible for the development and implementation of Nemours privacy policies and procedures, and who can be contacted at email@example.com or (904) 697-4287.
2.10 Protected Health Information (PHI) means individually identifiable health information as defined at 45 CFR §160.103. This information is protected by various state and federal privacy laws and regulations.
2.11 Proprietary Information refers to information relating to Nemours¿ internal business affairs, including information regarding Nemours¿ products,
pricing, personnel data, vendor information, financial data and other competitively sensitive information that Nemours maintains as confidential. It also includes nonpublicly available information regarding the Service, EHRS vendors and EHRS enhancements. If such information is already made available in the public domain, then such information is not Proprietary Information. All Proprietary Information is confidential and may not be used for any purpose without the advanced written consent of Nemours. Proprietary Information includes the NemoursLink Manual, this
Agreement and the User Agreement, and any NemoursLink forms or documents.
2.12 Service means the NemoursLink software and other Nemours and EHRS Vendor-supplied services, software, databases, content, documentation, works of authorship and other materials and intellectual property used to provide a secure method of communication enabling a User to view the EHR of an HHCA¿s Patient who has received health care services at Nemours.
2.13 Technical Liaison means the department or individual employed by Nemours who should be contacted by a User or HHCA to report certain events or problems as required by this Agreement. The contact information for the Technical Liaison is contained in paragraph 16 below.
2.14 Treatment means treatment as defined in the HIPAA privacy regulations at 45 C.F.R. § 164.501.
2.15 User means an employee or Business Associate of the HHCA who is authorized by the HHCA to access its Patients¿ EHRs, who has signed a User Agreement, and whose access to EHRS via the Service has been approved by Nemours.
3. Term and Termination. This Agreement is effective on the Effective Date and will continue until either Party notifies the other in writing of its intent to terminate. Nemours will consider any unauthorized use of the Service as a material breach of this Agreement and grounds for immediate termination of this Agreement. Nemours retains the right to unilaterally terminate access, in its sole discretion, without advance notice to HHCA.
4. Nemours Data. No rights or legal interest in Nemours¿ Data is transferred to the HHCA under this Agreement. HHCA will not copy or use Nemours¿ Data for any purpose other than for the Permitted Uses described in Section 6 below, unless Nemours consents in writing or such use or disclosure is required by law. If HHCA receives a request or demand for disclosure of the Nemours' Data, including a subpoena, order or other legal mandate, HHCA will immediately notify Nemours, and to the extent feasible consistent with the legal mandate, withhold response to permit Nemours to seek a protective order.
5. Service. Subject to the terms and conditions of this Agreement, Nemours will make the Service available to HHCA and its Users at reasonable times, provided that the Service may be unavailable when maintenance is being performed and at other times in Nemours¿ reasonable discretion. USERS HAVE NO RIGHT OF PRIVACY WHEN USING THE SERVICE. Nemours may, directly or through a third party designee, inspect, test and/or audit HHCA¿s and its Users¿ compliance with the terms and conditions of this Agreement. Nemours may also permit any regulator with jurisdiction over Nemours, HHCA and/or any User, to perform such inspections, tests and/or audits if requested by such regulators. Also, Nemours may permit its EHRS Vendors to inspect, test or audit the use of the EHRS components pursuant to the terms of their agreements with Nemours. HHCA hereby consents to the inspections, tests and audits described in this Section and shall cooperate and cause its Users to cooperate therewith.
6. Permitted Use of Service. HHCA and its Users are permitted access and use of the Service solely for purposes of Treatment and Health Care Operations. HHCA agrees that it (including its employees and business associates) will comply with all applicable laws and regulations, and the terms of this Agreement, in its access and use of the Service. HHCA hereby represents, warrants and covenants that it has obtained all necessary consents, authorizations and permissions for such uses.7. Prohibited Use of Service. HHCA and its Users may not:
(a) Access or use the Service for any purpose other than the Permitted Uses listed in Section 6 above;
(b) Disclose to any third party, transfer to any third party, sell to any third party, or otherwise permit or facilitate third party access to Nemours' Data;
(c) Use any Nemours' Data with the intent to negatively impact the competitive advantage of Nemours in the marketplace;
(d)Use or disclose Nemours' Data other than as permitted by this Agreement.
8. Privacy and Confidentiality Obligations. HHCA acknowledges it is a Covered Entity subject to the HIPAA privacy and security rules, and various other federal and state laws and regulations on privacy and security. HHCA understands that the Service provides secure access to Nemours' Data, including PHI, and agrees to comply, and cause its authorized Users to comply, with HIPAA in its use of the Service, and to take all reasonable and necessary precautions required by HIPAA to maintain the security and privacy of the PHI it accesses through the Service. Specifically, HHCA agrees to:
(a) Report to the Nemours Privacy Officer any unauthorized access, use or disclosure of Nemours' Data of which HHCA becomes aware;
(b) Take appropriate precautions to ensure that Patients, visitors, or other unauthorized personnel will not be able to see computer screens during access to Nemours' Data;
(c) Advise Patients requesting amendment of their PHI contained in the Nemours' EHRS that the HHCA does not have the authority to amend their PHI and that any amendments or corrections to it must be accomplished by contacting the Nemours Privacy Officer directly;
(d) Have in place a written agreement with any Business Associate or subcontractor authorized by HHCA as a User to access its Patients' EHRs via the Service.
(e) Make its internal HHCAs, books and records relating to the use and disclosure of PHI received from, or created or received by Plan on behalf of Nemours, available to the Secretary of Health and Human Services for the purposes of determining Nemours¿ compliance with privacy regulations.
9. Obligations of HHCA.
(a) Equipment and Supplies. HHCA is solely responsible for the costs of the equipment, maintenance and supplies required for access to and use of the Service. Such costs include, but are not limited to, cost of acquisition, installation, operation and maintenance of personal computers and printers; costs related to wiring, hardware, software, phone charges, and Internet access services; and costs of ongoing equipment and supply upgrades.
(b) User Access. The Technical Liaison must be notified in writing of the names of Users authorized by HHCA to access the Service. Users will not be granted access to the Service until the User signs a User Agreement, at which time Nemours will assign each User a unique login and password to access the Service. Completion of the User Agreement requires the User to acknowledge he or she has read this Agreement. Therefore, it is the obligation of the HHCA to give a copy of this Agreement to each of its authorized Users to read before the User signs the User Agreement.
(c) Access to Service. The selection of Users and the implementation and maintenance of security related to access to the Service by Users will be the sole responsibility of HHCA. HHCA will and will ensure each User maintains the security and confidentiality of its individual login and password and does not share or disclose the User¿s assigned login or password to others. HHCA WILL BE RESPONSIBLE FOR ENSURING ALL USERS COMPLY WITH THE TERMS AND CONDITIONS OF THIS AGREEMENT, AND WILL ASSUME ALL RESPONSIBILITY AND LIABILTY BETWEEN NEMOURS AND HHCA WITH RESPECT TO USE OF THE SERVICE BY HHCA, ITS USERS OR ANY OTHER PERSONS WHO MAY ACCESS THE SERVICE USING LOGINS AND/OR PASSWORDS PROVIDED TO USERS. Nemours reserves the right to suspend or terminate a User's access to the Server for any reason.
(d) Termination of Access. In the event that a User is no longer authorized by HHCA to access the Service, HHCA agrees that it will take immediate steps to notify the Technical Liaison both orally at (877) MYNEMOURS and in writing so that the User¿s access to the Service may be terminated (see Section 16). HHCA remains responsible for the User¿s actions until written notice to terminate access is provided to the Technical Liaison.
(e) Ensure Appropriate Use of Service. It is the HHCA's obligation to make sure the Nemours Privacy Officer is immediately notified in instances where there is reasonable suspicion that there may have been password compromise, unauthorized access, use or disclosure of Nemours¿ Data, alteration of Service software or Nemours' Data, or other violations of this Agreement, the User Agreement, or state or federal law. Notification should be made orally and in writing to the Privacy Officer at (904) 697-4287 and firstname.lastname@example.org.
(f) Representations and Warranties. HHCA represents that it is in compliance with all applicable state and federal laws and regulations, and that neither it nor any of its Users, officers, employees or agents has been debarred, penalized by, convicted, sanctioned, suspended, excluded or otherwise deemed ineligible to participate in any state or federal reimbursement program, including Medicaid or Medicare. In the event that HHCA or any of its Users, officers, employees or agents are sanctioned or excluded from participation in any state or federal reimbursement program as described above, HHCA will immediately notify the Technical Liaison and Nemours may, in its sole discretion, terminate this Agreement and provide written notice to HHCA.
(g) Licensed Use of Service and EHRS. Subject to the terms and conditions of this Agreement, Nemours grants to HHCA a nonexclusive, nontransferable, limited license for HHCA and HHCA¿s authorized Users to access and use the Service and EHRS solely for the Permitted Use in Section 6 above. The foregoing license is only a permission to use the Service and EHRS subject to all terms and conditions herein and neither HHCA nor any authorized User is entitled to a copy of any software or any other Service component used to provide access to the EHRS. Without in any way limiting the prohibitions or limitations stated elsewhere in this Agreement, HHCA shall not and shall not permit its authorized Users or any other person to reproduce, publicly display, reverse engineer, disassemble, decompile, translate, port, adapt, modify or make derivative works of the Service or the EHRS; or sublicense, lease, lend, loan, re-distribute, re-transmit or time-share the Service or EHRS or make them available otherwise for access or use by any person or entity other than HHCA and its authorized Users in accordance with this Agreement.
(h) Copyright. The Service and EHRS include materials that are protected by law, including United States copyright, trade secret law and other intellectual property laws and by international treaty provisions. All rights not granted under this Agreement are expressly reserved to Nemours and/or as applicable, Nemours' third party suppliers or agents. HHCA shall not, and shall cause its authorized Users to not, remove any copyright, trademark, or other intellectual property or proprietary rights notices of Nemours or its third party suppliers or agents from the Service or EHRS or any copies, reports or other materials or data generated therefrom.
(i) Return of Proprietary Information. On Nemours' written request or upon the expiration or termination of this Agreement for any reason, HHCA will promptly: (a) return or destroy, at Nemours¿ option, all originals and copies of all documents and materials it has received containing Nemours¿ Proprietary Information; and (b) deliver or destroy, at Nemours¿ option, all originals and copies of all summaries, records, descriptions, modifications, negatives, drawings, adoptions and other documents or materials, whether in writing or in machine-readable form, prepared by HHCA, prepared under its direction, or at its request from the documents and materials referred to in subparagraph (a), and provide a notarized written statement to Nemours certifying that all documents and materials referred to in subparagraphs (a) and (b) have been delivered to Nemours or destroyed, as requested by Nemours.
10. Assignment. Neither this Agreement nor any of the rights herein may be assigned by HHCA without the express, prior written approval of Nemours. Nemours may, without the consent of HHCA, assign the rights and obligations herein.
11. Relationship of the Parties.It is expressly understood and agreed that this Agreement is not intended to, and does not, create a joint venture, partnership, association, or other affiliation or business relationship between the parties. Nemours and HHCA shall at all times be separate legal entities and are not liable for the debts or obligations of the other party.
12. Indemnification. HHCA shall indemnify and hold harmless Nemours, its affiliates and subsidiaries, and its and their directors, officers, employees, agents and suppliers from and against any and all third party claims, demands, actions, proceedings and all resulting liabilities, losses, damages, costs and/or expenses, including reasonable attorney's fees and legal expenses, of whatsoever kind and nature, arising out of or relating to any access to or use of the Service or EHRS by or through HHCA, including by its authorized Users or any other persons who may access the Service using logins and/or passwords provided to its authorized Users. Additionally, HHCA shall indemnify and reimburse Nemours, its affiliates and subsidiaries for actual costs of notification and associated mitigation, including credit monitoring and identity theft insurance, incurred by Nemours or a Nemours¿ affiliate as a result of a Breach of Unsecured PHI arising out of or relating to any access to or use of the Service or EHRS by or through HHCA, including by its authorized Users or any other persons who may access the Service using logins and/or passwords provided to its authorized Users.
13. Limitation of Liability. UNDER NO CIRCUMSTANCES SHALL NEMOURS, ITS PARTNET OR AFFILIATED ENTITIES, OR ITS OR THEIR DIRECTORS, OFFICERS, EMPLOYEES, AGENTS, SUPPLIERS OR INSURERS BE LIABLE TO HHCA FOR ANY LOSS OF PROFITS, LOSS OF BUSINESS OR ANY INDIRECT, INCIDENTAL, SPECIAL OR CONSEQUENTIAL LOSSES OR DAMAGES OF ANY NATURE OR KIND WHATSOEVER OR FOR ANY EXEMPLARY, PUNITIVE OR SPECIAL DAMAGES, AND NOTWITHSANTING THE FORM (e.g., CONTRACT, NEGLICENCE, STRICT LIABILITY, OR OTHERWISE) IN WHICH ANY LEGAL OR EQUITABLE ACTION MAY BE BROUGHT. 14. Applicable Law and Disputes. This Agreement shall be construed, and the rights and liabilities of the parties determined, in accordance with the laws of the state of Florida, except with regard to the conflicts of law principles of the state of Florida to the extent they would apply the laws of another state to this Agreement. Venue shall lie in Duval County, Florida, for any dispute arising out of this Agreement. If any dispute arises under this Agreement and results in litigation, the losing party shall pay the prevailing party all costs of litigation, including reasonable attorney¿s fees.
15. Survival of Certain Provisions. The obligations of the parties to this Agreement pertaining to the indemnification, confidentiality and compliance with the Privacy Regulations, and permitted and prohibited uses of Nemours' Data set forth in paragraphs 4,5, 6, 7, 8, 9, 11, 12, 13 and 14 and shall survive and continue beyond the termination of this Agreement.
16. Notices. Any notices required to be given under this Agreement to the Tehnical Liaison shall be in writing and may be delievered personally, sent by registred or certified mail, by a nationally recognized overnight delivery service, or sent by facsimile or electronic mail with confirmation, addressed as follows (or at any address the parties may specify in writing later:
If to NEMOURS:
Nemours Children's Clinic - Orlando
9161 Narcoossee Road, Suite 206
Orlando, FL 32827
Attention: Nemours Health Informatics
With copy to:
The Nemours Foundation
Office of Contracts Administration
10140 Centruion Parkway North
Jacksonville, FL 32256
Fax: (904) 697-4070
| || |
17. Entire Agreement and Waiver. This Agreement constitutes the entire agreement between the parties and supersedes all other written or oral agreementswith respect to the subject matter hereof. This Agreement may not be altered, amended or modified except as agreed in writing by the parties. No consent waiver, express or implied, by either party in the performance by the other party of its obligations under this Agreement shall be deemed or construed to be a consent to or waiver of any other breach or default by the other party.
18. Counterparts and Electronic Signature: This Agreement may be executed in two or more counterparts, each of which will be deemed an original, but all of which together will constitute one and the same instrument. Delivery of an executed signature page by facsimile transmission or PDF will be as effective as delivery of a manually signed counterpart.
IN WITNESS HEREOF, the parties have executed this Agreement as of the day and year first written above.