36-15 Resolution authorizing Execution of BSA with ImageTrend and Attachment.pdf

BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement (“Agreement”) is effective upon execution of the Agreement between Client's authorized user </nsert Service or Agency Name> Address. City, State Zip referred to as the (“Covered Entity’) and State of New Jersey, Department of the Treasury, Division of Purchase and Property at 33 West State Street, 8 Floor, PO Box 230, Trenton, New Jersey 08625 referred to as the (“Client”) who has established a Business Associate Agreement (‘Agreement’) with ImageTrend, Inc., a Minnesota corporation and Client's Vendor located at 20855 Kensington Blvd., Lakeville, MN 55044, ("ImageTrenc”) or the (“Business Associate”). WHEREAS, Covered Entity and Business Associate have entered into, or are entering into, or may subsequently enter into, agreements or other documented arrangements (collectively, the “Business. Arrangements”) pursuant to which Business Associate may provide products and/or services for Covered Entity that require Business Associate to access, create and use health information that is protected by state and/or federal law; and WHEREAS, pursuant to the Administrative Simplification provisions of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the U.S, Department of Health & Human Services (“HHS”) promulgated the Standards for Privacy of Individually Identifiable Health Information (the “Privacy Standards’), at 45 C.F.R. Parts 160 and 164, requiring certain individuals and entities subject to the Privacy Standards (each a “Covered Entity”, or collectively, “Covered Entities”) to protect the privacy of certain individually identifiable health information (“Protected Health Information’, or PHI"); and WHEREAS, pursuant to HIPAA, HHS has issued the Security Standards (the “Security Standards’), at 45 C.F.R. Parts 160, 162 and 164, for the protection of electronic protected health information (“EPHI"); and WHEREAS, in order to protect the privacy and security of PHI, including EPHI, created or maintained by or on behaif of the Covered Entity, the Privacy Standards and Security Standards require a Covered Entity to enter into a “business associate agreement” with certain individuals and entities providing services for or on behalf of the Covered Entity if such services require the use or disclosure of PHI or EPHI; and WHEREAS, on February 17, 2009, the federal Health

individuals and entities providing services for or on behalf of the Covered Entity if such services require the use or disclosure of PHI or EPHI; and WHEREAS, on February 17, 2009, the federal Health Information Technology for Economic and Clinical Health Act was signed into law (the "HITECH Act’), and the HITECH Act imposes certain privacy and security obligations on Covered Entities in addition to the obligations created by the Privacy Standards and Security Standards; and WHEREAS, the HITECH Act revises many of the requirements of the Privacy Standards and Security Standards concerning the confidentiality of PHI and EPHI, including extending certain HIPAA and HITECH Act requirements directly to business associates; and WHEREAS, Business Associate and Covered Entity desire to enter into this Business Associate Agreement; NOW THEREFORE, in consideration of the mutual promises set forth in this Agreement and the Business Arrangements, and other good and valuable consideration, the sufficiency and receipt of which are hereby severally acknowledged, the parties agree as follows: 1. Business Associate Obligations. Business Associate may receive from Covered Entity, or create or receive on behalf of Covered Entity, health information that is protected under applicable state and/or federal law, including without limitation, PHI and EPHI. All capitalized terms not otherwise Covered Entity Version (10/23/2009) Page 1 of 8