Attachment 1: VA VHA Broad Agency Announcement Template -for Awareness

BUSINESS ASSOCIATE AGREEMENT BETWEEN THE DEPARTMENT OF

VETERANS AFFAIRS VETERANS HEALTH

ADMINISTRATION,
, AND
Purpose. The purpose of this Business Associate Agreement (Agreement) is to establish requirements for the Department of Veterans Affairs (VA) Veterans Health Administration
(VHA)
and
in accordance with the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH) Act, and the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules (“HIPAA Rules”), 45 C.F.R. Parts 160 and 164, for the Use and Disclosure of Protected Health Information (PHI) under the terms and conditions specified below. Scope. Under this Agreement and other applicable contracts or agreements,
will
provide
vices to, for, or on behalf of
.
In order for
to provide such
services,
will disclose PHI
to
and
use or disclose PHI in accordance with this Agreement.

ser

will

Definitions. Unless otherwise provided, the following terms used in this Agreement have the same meaning as defined by the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information (PHI), Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.
“Business Associate” shall have the same meaning as described at 45 C.F.R. § 160.103. For the purposes of this Agreement, Business Associate shall refer to
, including its employees, officers, or any other
agents that create, receive, maintain, or transmit PHI as described below. “Covered Entity” shall have the same meaning as the term is defined at 45 C.F.R. § 160.103. For the purposes of this Agreement, Covered Entity shall refer to
.
“Protected Health Information” or “PHI” shall have the same meaning as described at 45 C.F.R. § 160.103. “Protected Health Information” and “PHI” as used in this Agreement include “Electronic Protected Health Information” and “EPHI.” For the purposes of this Agreement and unless otherwise provided, the term shall also refer to PHI that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity or receives from Covered Entity or another Business Associate. “Subcontractor” shall have the same meaning as the term is defined at 45 C.F.R. § 160.103. For the purposes of this Agreement, Subcontractor shall refer to a contractor