USVI Public Records

Document text

OPCMR 1 DUA / MOU Initials: DATA USE AGREEMENT BETWEEN THE ASSOCIATION OF PUBLIC HEALTH LABORATORIES, INC. AND GOVERNMENT OF THE U.S. VIRGIN ISLANDS THE DEPARTMENT OF HEALTH THROUGH THE DEPARTMENT OF PROPERTY AND PROCUREMENT This Data Use Agreement (the “DUA”), dated as of the Effective Date, is entered into between the Association of Public Health Laboratories, Inc. (“APHL”), a nonprofit corporation organized under the laws of the District of Columbia, and the Virgin Islands Department of Health , the Territory of the U. S. Virgin Islands (the “Participating IIS Jurisdiction”), an executive agency of the Government of the U.S. Virgin Islands located at 1303 Hospital Ground, Suite 10, St. Thomas, USVI 00802. APHL and the Participating IIS Jurisdiction are collectively referred to in this DUA as the “Parties” or, individually, each a “Party”. BACKGROUND I. The Participating IIS Jurisdiction is a governmental agency created under law and a public health authority under 45 CFR §164.501. Among its authorized public health activities is the receipt of information and reports concerning immunization, vaccination, disease, injury and vital events for purposes including public health surveillance, investigations, and interventions. II. APHL is the national organization representing state and local governmental health laboratories in the United States and works to strengthen laboratories serving the public’s health in the US and globally. Its members include every state and territorial public health laboratory in the nation and they monitor and detect health threats to protect the health and safety of Americans. Founded over 50 years ago as a forum for state public health laboratory directors, APHL has expanded to encompass governmental health laboratories and staff from multiple disciplines, including public health, environmental, agricultural and food safety laboratories. III. As part of its work on behalf of the nation’s public health laboratories, APHL has led the development of data exchange capacity for public health laboratory informatics systems. APHL, through Cooperative Agreement Number U60HM000803 (CFDA# 93.065) and Cooperative Agreement Number 1U60OE000103 (CFDA# 93.322) with the Centers for Disease Control and Prevention (“CDC”), established and maintained the APHL Informatics Messaging Services Platform (the “AIMS Platform”) that DocuSign Envelope ID: 25C84D1F-E819-4B2A-A448-0F50A1DA3FFE JEE G057DOHT22 OPCMR 2 DUA / MOU Initials: created reliable laboratory data exchange capability between state public health laboratories and CDC. IV. The AIMS Platform has the capacity to be utilized to assist public health agencies in their efforts to exchange data using a fast and more streamlined process. As a result, APHL has received a Task Order Subcontract (the “Subcontract”) from JBS International, Inc. (“JBS”) to utilize the AIMS Platform, and to provide services related to this utilization, in support of JBS’ work under a Task Order Award received from the Department of Health and Human Services (“DHHS”), formerly entitled “Public Health Immunization Data Exchange (PHIZ) Project” and now known as the Immunization Gateway Project (“IZ Gateway Project”). DHHS may be referred to as the “Funding Agency” in this DUA. V. The Participating IIS Jurisdiction has elected to participate in the IZ Gateway Project and any successor Project(s). The Participating IIS Jurisdiction has determined that, in order to participate in the IZ Gateway Project in a manner consistent with its statutory and regulatory obligations and public health authority practices, the following rights and responsibilities of the Parties must be established with respect to data submitted by the Participating IIS Jurisdiction. AGREEMENT The Parties agree that each of their respective rights, responsibilities and remedies with respect to any data transmitted by the Participating IIS Jurisdiction as part of the IZ Gateway Project are as follows: 1. Effective Date and Term of DUA. The “Effective Date” of this DUA will be the first date on which both Parties have signed this agreement. This DUA will remain in effect for the duration of the IZ Gateway Project and any successor Project(s), or until earlier terminated by (i) one of the Parties pursuant to a written notice delivered to the other Party no less than thirty (30) days prior to the desired termination date or (ii) both Parties pursuant to a mutual written termination, release or other document. 2. Security of the Hosting Environment. The AIMS Platform operates in a highly secure environment in compliance with governmental requirements and industry recognized security best practices, including the Federal Information Security Management Act (FISMA), Title III of the E-Government Act of 2002, as amended (Pub. L. 107-347), the Federal Risk and Authorization Management Program (FedRAMP), and the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”). In addition, the AIMS Platform includes a “Modular Certified Technology” to support meaningful use transaction for Electronic Laboratory Reporting, Immunization Reporting and Syndromic Surveillance Report. 3. IZ Gateway Project Portfolio Description. This DUA enables the Participating IIS Jurisdiction to identify which (if any) of the following IZ Gateway components – Share, Provider- DocuSign Envelope ID: 25C84D1F-E819-4B2A-A448-0F50A1DA3FFE JEE G057DOHT22 OPCMR 3 DUA / MOU Initials: initiated Multi-jurisdictional Data Exchange, Access and Access: Consumer-initiated Multi- jurisdictional Data Exchange – that the Participating IIS Jurisdiction is electing to enable. The Participating IIS Jurisdiction will automatically participate in Connect with ratification of this DUA. Each of the IZ Gateway components is summarized below. A. Connect enables large national and non-traditional vaccinators to report and query immunization data with multiple IIS using the IZ Gateway. It also provides a centralized data exchange connection so multi-jurisdictional provider organizations have one connection instead of multiple, individual, point-to-point IIS connections. B. The Participating IIS Jurisdiction may also elect to participate in Share, Provider- initiated Multi-jurisdictional Data Exchange, Access and Access: Consumer-initiated Multi- jurisdictional Data Exchange by completing a Task Order (the form of which is attached to this DUA as Appendix A) that is signed by both Parties: i. Share allows exchange of immunization information across IIS jurisdictions. It automates messages to an IIS for patients immunized outside of its jurisdiction. ii. Provider-initiated Multi-jurisdictional Data Exchange allows providers to initiate a query for vaccine information from multiple jurisdictions and receive a consolidated record. iii. Access enables consumers to access, download, print and share online immunization records stored by the Participating IIS Jurisdiction and forecasts through easy-to-use digital tools. iv. Access: Consumer-initiated Multi-jurisdictional Data Exchange allows consumers to access, download, print and share their online immunization records, stored by both the Participating IIS Jurisdiction, as well as other Participating IIS Jurisdictions that have executed the Public Health IIS Interjurisdictional Memorandum of Understanding. It will also provide access to forecasts through easy-to-use digital tools. 4. Responsibilities of the Parties. A. Responsibilities of APHL. i. APHL will, either directly or indirectly through one or more subcontractors, develop and provide an environment in the AIMS Platform for hosting the IZ Gateway Project (which Project will be developed, maintained and operated by a third party not affiliated with APHL or the AIMS Platform) in compliance with security requirements listed in section 2. ii. APHL will also, either directly or indirectly: a. Accept encrypted IZ Gateway messages and route to the IZ Gateway for processing and outgoing message addressing. b. Route outgoing encrypted messages to appropriate recipients based on addresses received from the IZ Gateway. DocuSign Envelope ID: 25C84D1F-E819-4B2A-A448-0F50A1DA3FFE JEE G057DOHT22 OPCMR 4 DUA / MOU Initials: c. Create appropriate system users and provide appropriate user access to the IZ Gateway environment; d. Offer reasonable user support during the IZ Gateway Project either via telephone or over email; e. Implement cyber security continuous monitoring and notification plan for system issues; f. Implement ‘self-healing’ measures within information leakage (“IA”) components to address zero-day protection for new threats; and g. Institute, scan for, and remediate any IA and promptly notify the Participating IIS Jurisdiction in the event of such IA. iii. APHL will not use, disclose or decrypt data submitted by the Participating IIS Jurisdiction for purposes of conducting the IZ Gateway Project. APHL neither will have direct access to the Participating IIS Jurisdiction message content for the IZ Gateway Project nor will it have sufficient security rights to decrypt the Participating IIS Jurisdiction data. APHL will take all reasonable measures to ensure that the Participating IIS Jurisdiction data will not be persisted by the AIMS Platform to the maximum extent possible. APHL will not, without the prior written authorization from the Participating IIS Jurisdiction, further use, disclose or transmit the data. a. APHL may provide transmission logs showing message quantity, date, time and transaction identifiers in the event that disclosure or transmission of the Participating IIS Jurisdiction’s data is required by (1) the Funding Agency, (2) another federal agency or (3) a court order or judicial subpoena from a court of competent jurisdiction. In such event, APHL will promptly advise the Participating IIS Jurisdiction in writing of the required release. b. APHL understands that the Participating IIS Jurisdiction will enter into separate data use agreements or memorandums of understanding regarding the rights and responsibilities with each of the counterpart jurisdictions with which the Participating IIS Jurisdiction will share data. The “Public Health IIS Interjurisdictional Memorandum of Understanding”, which binds parties to certain obligations regarding the secure, electronic exchange of immunization information among governmental entities that operate a population-based immunization information system, meets these requirements and is incorporated by reference and available at https://repository.immregistries.org/resource/public-health-iis- interjurisdictional-memorandum-of-understanding-mou/. iv. APHL will promptly notify the Participating IIS Jurisdiction of any data breach. Such notification will be made in accordance with the requirements of the AIMS Platform SSP, HIPAA regulation or any other applicable law or regulation in effect at the time of such DocuSign Envelope ID: 25C84D1F-E819-4B2A-A448-0F50A1DA3FFE JEE G057DOHT22 OPCMR 5 DUA / MOU Initials: data breach. v. APHL will ensure that all subcontractors agree to be bound by substantially the same terms and conditions with respect to the Participating IIS Jurisdiction data as those agreed to by APHL under this DUA. B. Responsibilities of the Participating IIS Jurisdiction. i. The Participating IIS Jurisdiction will make appropriate staff available during normal business hours upon reasonable request from APHL for purposes of creating and maintaining the environment on the AIMS Platform for the IZ Gateway Project or of establishing or verifying data flow and data and alert or other system message transmission. ii. The Participating IIS Jurisdiction will ensure that all the necessary consents are obtained prior to the transmission of data through the AIMS Platform. 5. No HIPAA Business Associate Relationship. The Parties acknowledge that the Participating IIS Jurisdiction is a hybrid entity for purposes of HIPAA. The Participating IIS Jurisdiction’s single healthcare component is neither involved nor implicated in this DUA. The Participating IIS Jurisdiction is a public health authority under 45 CFR §164.512 and is neither a Covered Entity nor a Business Associate, as defined under 45 CFR §160.103, for purposes of this DUA. The Parties expressly do not intend to create a HIPAA Business Associate relationship, and nothing in this DUA may be construed to make the Participating IIS Jurisdiction a Covered Entity or Business Associate for purposes of this agreement. 6. Effect of Termination on Potential Protected Health Information. Upon termination of the DUA for any reason, APHL will verify that no Participating IIS Jurisdiction data was persisted by the AIMS Platform and will provide reasonable written assurance of the verification to the Participating IIS Jurisdiction. 7. Responsibility for Own Actions. Each Party will be responsible for its own acts or omissions and those acts or omissions of its officers, direct employees, contractors and agents in the performance of this DUA. Neither Party to this DUA will be responsible for the acts and omissions of those entities or individuals not a party to this agreement. 8. Independent Contractors. The relationship between the Parties is that of independent contractors. This DUA is not intended to create any association, partnership, joint venture, or agency relationship between the Parties. 9. Assignability. Neither Party may assign this DUA, or any interest in this DUA, without the prior written consent of the other Party. 10. Sole Agreement. This DUA, together with all Task Orders described in Section 3.B. above and all amendments to either this DUA or any Task Order signed by both Parties, contain the entire agreement between the Parties concerning the subject matter of this DUA. They supersede DocuSign Envelope ID: 25C84D1F-E819-4B2A-A448-0F50A1DA3FFE JEE G057DOHT22 OPCMR 6 DUA / MOU Initials: all prior and contemporaneous oral and written understandings. 11. Amendment. No amendment of this DUA will be valid unless in writing and signed by both Parties. 12. APHL acting as a public health authority. APHL will be providing services to the IIS, which are described in this DUA. To the extent that APHL is providing these services, in accordance with the terms of this DUA, APHL is acting as a “public health authority” as defined in 45 C.F.R. § 164.501 of the regulations promulgated under HIPAA, as applicable. 13. Notices. All notices and other communications between the Parties must be in writing. Each Party may give notice (i) by delivery in person (ii) by a nationally recognized next day courier service, (iii) by first class, registered or certified mail, postage prepaid, (iv) by facsimile or (v) by electronic mail to the address of the other Party specified below, or to such other address as the other Party may specify in writing from time to time. All notices shall be effective upon the earlier of (x) receipt by the party to which notice is given or (y) on the fifth day following mailing. If to the Participating IIS Jurisdiction: Government of the U.S. Virgin Islands Anthony D. Thomas, MBA Commissioner Department of Property and Procurement 8201 Sub Base, Suite 4 St. Thomas, Virgin Islands 00802 anthony.thomas@dpp.vi.gov Justa E. Encarnacion, RN, BSN, MBA/HCM Commissioner Department of Health 1303 Hospital Ground – Suite 10 St. Thomas, Virgin Islands 00802 justa.encarnacion@doh.vi.gov If to APHL: Scott J. Becker, MS, Chief Executive Officer Association of Public Health Laboratories 8515 Georgia Avenue, Suite 700 Silver Spring, MD 20910 T: 240.485.2745 F: 240.485.2700 E: scott.becker@aphl.org DocuSign Envelope ID: 25C84D1F-E819-4B2A-A448-0F50A1DA3FFE JEE G057DOHT22 OPCMR 7 DUA / MOU Initials: With a copy to: Troy Willitt, General Counsel Association of Public Health Laboratories 8515 Georgia Avenue, Suite 700 Silver Spring, MD 20910 T: 240.485.2716 F: 240.485.2700 E: troy.willitt@aphl.org 14. Severability. If any provision of this DUA is held to be invalid, the remaining provisions of this DUA are not to be affected and will continue in effect. The invalid provision is to be deemed modified to the least degree necessary to remedy the invalidity. 15. Section Headings. The captions or headings in this DUA are made for convenience and general reference only and should not be construed to describe or limit the scope or the intent of the provisions of this DUA. 16. Counterparts. The Parties may execute this DUA in counterparts, each of which is deemed an original and all of which taken together constitute one original. THE ASSOCIATION OF PUBLIC HEALTH LABORATORIES, INC. By: _________________ Scott J. Becker Date Chief Executive Officer WITNESSES: GOVERNMENT OF THE U.S. VIRGIN ISLANDS Justa E. Encarnacion, Commissioner Date Department of Health Anthony D. Thomas, Commissioner Date Department of Property and Procurement APPROVED AS TO LEGAL SUFFICIENCY DEPARTMENT OF JUSTICE BY: Date DocuSign Envelope ID: 25C84D1F-E819-4B2A-A448-0F50A1DA3FFE 3/11/2022 3/17/2022 JEE Assistant Attorney General 7/7/2022 7/7/2022 G057DOHT22 06/30/2022 07/01/2022