Clinical Data Sharing Agreement

CLINICAL DATA SHARING AGREEMENT

THIS CLINICAL DATA SHARING AGREEMENT (this "Agreement") is entered into as of the ___ day of ___________, 2008, by and between Virginia Health Information, Inc., a Virginia nonstock corporation ("VHI") and XXXX), and recites and provides as follows:

WHEREAS, VHI collects, organizes and disseminates administrative data from healthcare providers located in the Commonwealth of Virginia (the "Administrative Data") pursuant to and in accordance with enabling legislation set forth at §§ 32.1-276.2 et seq. of the Code of Virginia of 1950, as amended (the "Code"); and

WHEREAS, XXXX, as a healthcare provider described in § 32.1-276.3 of the Code, currently provides VHI with Administrative Data for inclusion in VHI’s databases and reports; and

WHEREAS, VHI has entered into a contract dated and effective as of September 30, 2007 with the federal Agency for Healthcare Research and Quality (the "AHRQ Contract") for the development of a reproducible approach to linking healthcare facility clinical and administrative data for purposes of quality improvement, quality reporting, research and the promotion of public health, all as more fully set forth in the AHRQ Contract; and

WHEREAS, XXXX wishes to contribute VHI wishes to contribute healthcare facility clinical data to VHI for the purposes set out in the AHRQ Contract and to receive services from VHI set forth in this Agreement;

NOW THEREFORE, in consideration of the foregoing and of the mutual promises of the parties set forth herein, and of other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties hereto mutually agree as follows:

Incorporation of Recitals; "AHRQ Contract" Defined.

The recitals set forth above are hereby incorporated into and made a part of this Agreement as if set forth in their entirety in this Section 1.

For purposes of this Agreement, the parties agree that the AHRQ Contract includes (i) Award/Contract Number HHSA 290 2007 10081 and all attachments thereto, (ii) the forty page document entitled "Technical Proposal" submitted by VHI to AHRQ; (iii) the eight page document entitled "Business Proposal" submitted by VHI to AHRQ; and (iv) the 56 page document entitled "Additions/Revisions 8-30-07" and submitted by VHI to AHRQ. Copies of each are included in the attachedExhibit A.

XXXX Obligations. During the Term of this Agreement (hereinafter defined), XXXX shall perform the following obligations:

Participate in online and/or written surveys to assess XXXX’s ability to provide Clinical Information, which surveys shall be scheduled reasonably by VHI. For purposes of this Agreement, the term "Clinical Information" means, with respect to patients of XXXX, certain laboratory findings, vital signs, a present on admission ("POA") indicator associated with diagnoses reported to VHI by XXXX and other clinical information present on admission;

Attend and participate in a kick-off meeting for the project, to be scheduled reasonably by VHI in Spring, 2008;

On a quarterly basis, provide Clinical Information reasonably requested by VHI in a format consistent with the format in which Administrative Data currently provided by XXXX; and

Provide additional clinical data for purposes consistent with this Agreement, as agreed by the parties.

VHI Obligations. During the Term of this Agreement, VHI shall perform the following obligations:

Provide technical and other assistance to XXXX staff for the provision of Clinical Information and other clinical data in accordance with this Agreement;

Provide XXXX with summaries of Clinical Information and other clinical data and comparative data with other participating providers (subject to the provisions of Section 7 hereof governing the use and disclosure of individually identifiable health information);

Use its good faith best efforts to develop and provide XXXX with risk-adjusted cardiac care mortality information using data sets enhanced with Clinical Information and clinical data provided by XXXX and other providers under this Agreement (subject to the provisions of Section 7 hereof governing the use and disclosure of individually identifiable health information);

Use its good faith best efforts to develop and provide XXXX with risk-adjusted AHRQ patient safety and quality indicators using data sets enhanced with Clinical Information and clinical data provided by XXXX and other providers under this Agreement (subject to the provisions of Section 7 hereof governing the use and disclosure of individually identifiable health information); and

To the extent determined feasible by VHI in its reasonable discretion, develop and provide education and training regarding the use of Clinical Information.

Term and Termination.

The term of this Agreement shall commence on _______, 2008 and expire on ____________, 2019, unless sooner terminated in accordance with the terms of this Section 4.

Notwithstanding anything to the contrary contained in Section A, this Agreement may be terminated:

by either party, upon written notice to the other party, if the other party (the "Defaulting Party") shall materially breach any obligation or covenant of the Defaulting Party hereunder and such breach shall remain uncured for thirty (30) days following notice of such breach given by the non-Defaulting Party to the Defaulting Party;

immediately and automatically upon termination of the AHRQ Contract for any reason, by any party to such agreement; or

by either party, without cause, upon ninety (90) days prior written notice.

Compensation. No party shall be entitled to compensation for services performed hereunder.

Relationship of the Parties. VHI and XXXX are and shall remain independent contractors in every respect, and neither party shall be deemed to be the agent of the other party. This Agreement is not, and shall not be deemed to be, a partnership, joint venture, business association, agency or employment relationship between VHI and XXXX. No employee of either party shall be deemed to be the employee of the other party.

Confidentiality; HIPAA Compliance.

VHI shall be bound by and observe fully all provisions of the Prime Contract governing the use and disclosure of the Clinical Information, including without limitation the provisions of Sections H.1 and H.2 thereof, all of which are hereby expressly incorporated into and made a part of this Agreement as if set forth in their entirety herein.

VHI shall not disclose Clinical Information received from XXXX that contains individually identifiable health information, as hereinafter defined, to any person or entity other than XXXX except as provided in this Section 7.

Notwithstanding the foregoing to the contrary, VHI shall be permitted to disclose Clinical Information to its subcontractors engaged for the purpose of performing its obligations under the AHRQ Contract and this Agreement, which disclosure shall be governed and controlled by the provisions of the Business Associate Agreement attached as Exhibit B hereto.

The parties acknowledge and agree that VHI’s receipt, use and disclosure of Administrative Data (including individually identifiable health information set forth in such Administrative Data) is governed by the provisions of Section 32.1-276.2 of the Code, including without limitation Section 32.1-276.9 of the Code, and that this Agreement shall be of no force or effect with regard to VHI’s receipt, use and/or disclosure of such information.

Notices. All notices and other communications hereunder shall be in writing and, unless otherwise provided herein, shall be deemed to have been given when hand-delivered or sent by certified mail, postage prepaid, return receipt requested to the party to whom such notice is to be given at its address set forth below, or at such other address as shall be specified by notice given pursuant hereto:

If to VHI: Virginia Health Information, Inc.
1108 East Main Street, Suite 1201
Richmond, Virginia 23219
Attn: Michael T. Lundberg

Copy to: Stephen C. McCoy
Williams Mullen P.C.
Two James Center
1021 East Cary Street, 16th Floor
Richmond, Virginia 23219

If to XXXX:
Attn:

Survival. The provisions of Sections 5, 6, 7, 13 and this Section 9 of this Agreement shall survive its expiration or termination for any reason.

Entire Agreement. All understandings and agreements between the parties regarding the subject matter hereof are merged into this Agreement which fully and completely expresses their agreements and supersedes any prior agreement or understanding relating to the subject matter, and no party has made any representations or warranties, express or implied, not herein expressly set forth.

Amendment. This Agreement shall not be changed or terminated except by written amendment signed by the parties hereto.

Assignment. This Agreement shall not be assigned by either party without the prior written consent of the other party.

Governing Law. This Agreement and the agreements contemplated hereby shall be construed in accordance with and governed by the laws of the Commonwealth of Virginia.

Counterparts. This Agreement may be executed in two or more counterparts, all of which taken together shall constitute one instrument.

Severability. If any clause, provision or section of this Agreement shall be held illegal or invalid by any court, the illegality or invalidity of such clause, provision or section shall not affect the remainder of this Agreement which shall be construed and enforced as if such illegal or invalid clause, provision or section had not been contained in this Agreement.

Descriptive Headings. The descriptive headings of the several sections of this Agreement are inserted for convenience only and shall not be deemed to affect the meaning or construction of any of the provisions hereof.

[EXECUTION PAGE FOLLOWS]

IN WITNESS WHEREOF, the parties hereto have executed or caused this Agreement to be executed by their duly authorized representatives as of the date first set forth above.

VIRGINIA HEALTH INFORMATION, INC.,
a Virginia nonstock corporation

By: ________________________
Michael T. Lundberg
Executive Director

XXXX, a Virginia nonstock corporation By: ________________________

EXHIBIT A

AHRQ Contract

EXHIBIT B

BUSINESS ASSOCIATE AGREEMENT

THIS BUSINESS ASSOCIATE AGREEMENT (this "Agreement") is entered into and effective as of the ___ day of _________, 2008, between ____________________________ ("Provider") and Virginia Health Information, Inc. ("Associate").

W I T N E S S E T H:

WHEREAS, Provider is a ______________________________ that provides Associate with individually identifiable health information pursuant to a certain Clinical Data Sharing Agreement dated ____________, 2008 (the "Data Agreement"); and

WHEREAS, in order to perform its obligations under the Data Agreement and the AHRQ Contract referenced therein, Associate may re-disclose Provider’s individually identifiable health information to certain of its subcontractors; and

WHEREAS, Associate’s services to Provider may constitute, in part, services described in the definition of "business associate" set forth in Title 45, Section 164.103 of the Code of Federal Regulations ("CFR"); and

WHEREAS, Provider and Associate desire to enter into this Agreement in order to ensure that Associate’s access to and use or disclosure of individually identifiable health information received from Provider pursuant to the Data Agreement complies fully with the requirements of the Health Insurance Portability and Accountability Act of 1996, as amended, and regulations promulgated thereto by the Department of Health and Human Services ("HHS") and codified at 45 CFR Parts 160 and 164, as amended from time to time, including without limitation (i) the Privacy Standards for the Protection of Health Information set forth at 45 CFR Part 164, Subparts A and E, and (ii) the Security Standards for the Protection of Electronic Protected Health Information set forth at 45 CFR Part 164, Subpart C (the statute and regulations are hereinafter collectively referred to as "HIPAA");

NOW, THEREFORE, in consideration of the mutual covenants and promises more fully set forth herein, and intending to be legally bound hereby, the parties hereto agree as follows:

Definitions.

"Electronic protected health information" shall be defined in accordance with 45 CFR § 160.103, as amended from time to time.

"Individually identifiable health information" shall be defined in accordance with 45 CFR § 160.103, as amended from time to time.

"Privacy Standards" shall mean the Privacy Standards for the Protection of Health Information set forth at 45 CFR Part 164, Subparts A and E, as amended from time to time.

"Security Standards" shall mean the Security Standards for the Protection of Electronic Protected Health Information set forth at 45 CFR Part 164, Subpart C, as amended from time to time.

All other terms used in this Agreement but not defined herein shall have the meanings set forth in the Data Agreement.

Except as otherwise specified in this Agreement, terms used in this Agreement shall be interpreted in a manner consistent with and necessary for Associate and Provider to comply with the Data Agreement and applicable provisions of state and federal law.

Disclosure to Associate. Nothing in this Agreement shall be construed to require Provider to furnish or disclose to Associate any protected health information or other information. The parties acknowledge that Provider may be required to furnish to Associate certain protected health information under the Data Agreement. This Agreement is intended solely to require and ensure that Associate’s use or disclosure of such protected health information complies fully with the Privacy Standards.

Use of Protected Health Information. Associate agrees to use protected health information received by Associate from Provider or created by Associate on behalf of Provider only to the extent necessary: (i) to meet its obligations to Provider; (ii) for the proper management and administration of Associate; and (iii) to carry out Associate’s legal responsibilities. Associate shall not use protected health information for any other purpose, or in any manner that would constitute a violation of the Privacy Standards.

Disclosure of Protected Health Information. Associate may disclose protected health information only in a manner permitted pursuant to this Agreement or as required by law. To the extent Associate discloses protected health information to any third party, the Associate shall, prior to making any such disclosure and in addition to the assurances required by Section 7 of this Agreement, obtain: (i) reasonable assurances from such third party that the protected health information will be held confidential as required by this Agreement and used or further disclosed only as required by law or for the specific purpose for which it was disclosed to such third party; and (ii) the written agreement of such third party to notify Associate immediately of any breach of the confidentiality of such protected health information, to the extent such third party obtains knowledge of such breach. Associate shall not disclose protected health information received from Provider for any other reason, or in any manner that would constitute a violation of the Privacy Standards.

Safeguards. Associate agrees to implement and utilize safeguards to prevent the use or disclosure of protected health information for any purpose other than as expressly provided for in this Agreement. Upon request therefor, Associate will provide Provider with information regarding the nature of such safeguards and the effectiveness of their implementation and maintenance.

Reporting and Mitigation. Associate agrees to (a) report immediately to Provider in writing any use or disclosure of protected health information not provided for in this Agreement of which Associate becomes aware; and (b) take such actions as may reasonably be requested by Provider or as may reasonably be required to mitigate the effects of any use or disclosure of protected health information by Associate or any of its contractors, employees or affiliates in violation of this Agreement.

Third Parties. Associate shall require that any agent, subcontractor or other third party to whom it is permitted or required to provide protected health information pursuant to this Agreement agree in writing to the same restrictions and conditions that apply to Associate with respect to such protected health information. Upon request therefor, Associate shall furnish Provider with documentation regarding such third party agreements.

Access to Protected Health Information.

Associate agrees to make available to Provider access to protected health information promptly following a request by Provider therefor in accordance with 45 CFR § 164.524, as amended. In the event that any individual who is the subject of protected health information requests access to protected health information directly from Associate, the Associate shall immediately forward such request to Provider, and Provider shall notify Associate if there is any basis on which to deny such access to protected health information. In all cases, Associate shall abide by the determination of Provider regarding any full or partial denial of access to such protected health information to any individual.

Upon request by Provider for access to protected health information about any individual, Associate will make such protected health information available to Provider for the amendment thereof. Associate shall provide such information to the Provider for amendment and shall incorporate any such amendments in the protected health information used and disclosed by Associate in accordance with this Agreement, as required by 45 CFR § 164.526, as amended.

During the term of this Agreement, Associate shall maintain, and furnish to Provider upon request, such information as is required to assist Provider in making an accounting of disclosures of protected health information relating to any person who is the subject of such information in Associate’s possession pursuant to 45 CFR § 164.528, as amended. In the event that any such request for an accounting is made directly to Associate, Associate shall immediately notify Provider in writing of such request, and Provider shall be responsible for the preparation and delivery of any such accounting. In order to permit Provider to undertake such an accounting, Associate shall, upon request, furnish Provider with the following information: (i) the date of all disclosures of protected health information by Associate to any third party; (ii) the name of the third party receiving such protected health information, and the address of such third party, if known; (iii) a brief description of the protected health information disclosed; (iv) a brief statement of the basis and purpose of such disclosure; and (v) such other information as reasonably requested by Provider regarding such protected health information.

Security Provisions. Notwithstanding any other provision of this Agreement or the Data Agreement to the contrary,

Security Safeguards. Associate shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits on behalf of Provider, as required by the Security Standards.

Agents. Associate shall ensure that any agent, including a subcontractor, to whom it provides electronic protected health information that Associate creates, receives, maintains, or transmits on behalf of Provider agrees in writing to implement reasonable and appropriate safeguards to protect such information.

Security Incidents. Associate shall report to Provider any security incident of which it becomes aware. For purposes of this Agreement, the term "security incident" means the attempted or successful access, use, disclosure, modification or destruction of electronic protected health information to which this Agreement applies or interference with system operations in any information system of Provider, Associate or any subcontractor or agent of Associate.

Disclosure of Books and Records. Associate agrees to make its internal practices, books and records relating to the use and disclosure of protected health information received from, or created or received by Associate on behalf of, Provider available to the Secretary of the Department of Health and Human Services for purposes of determining Provider’s compliance with the Privacy Standards.

Termination of this Agreement. In the event that Provider determines that Associate has violated a material term of this Agreement, Provider may, upon written notice, terminate this Agreement and the Data Agreement. Notwithstanding any termination of this Agreement as permitted hereunder, the obligation of Associate to comply with Privacy Standards with respect to any current or former patient of Provider shall survive such termination.

Responsibilities upon Termination. Upon the termination of this Agreement and/or the Data Agreement, Associate shall, if feasible, return or destroy all protected health information received from, or created or received by Associate on behalf of, Provider that Associate or any contractor, agent or associate of Associate still maintains in any form and retain (and permit any such contractor, agent or associate to retain) no copies of such information or, if such return or destruction is not feasible, extend (and cause any such contractor, agent or associate to extend) the protections of this Agreement to such protected health information and limit further uses and disclosures thereof to those purposes that make the return or destruction of the information infeasible.

Modification of Agreement. This Agreement shall remain in full force and effect throughout the term hereof, and may not be modified except in a writing executed by both parties hereto. Notwithstanding the foregoing, however, in the event of any amendment or modification of the Privacy Standards or Security Standards, this Agreement shall be deemed modified to the extent required to ensure continued compliance with such amended or modified Privacy Standards or Security Standards.

[EXECUTION PAGE FOLLOWS]

IN WITNESS WHEREOF, the parties hereto have entered into this Agreement as of the date first set forth above by executing the Agreement in the space provided below.

BUSINESS ASSOCIATE

VIRGINIA HEALTH INFORMATION, INC.,
a Virginia nonstock corporation

By: ________________________________
Its: Executive Director

PROVIDER
XXXX a Virginia nonstock corporation
By:_________________________
Its:

User Support

Clinical Data Sharing Agreement