ADDENDUM A

BUSINESS ASSOCIATE PRIVACY AND SECURITY AGREEMENT

"Adding Clinical Data to Administrative Data"

Minnesota Hospital Association with Michael Pine & Associates

AHRQ Contract with MHA HHSA290 2007 10080

This document is an addendum to the Business Associate and Security Agreement made between the Minnesota hospital listed on page 2 (hereinafter called Hospital) and the Minnesota Hospital Association, located at 2550 University Avenue West, Suite 350 S, Saint Paul, Minnesota (hereinafter called MHA).

The MHA is under a two-year contract (10/1/07 – 9/30/09) with the federal Agency for Healthcare Research and Quality (AHRQ) to facilitate the “Adding Clinical Data to Administrative Databases Project” (hereinafter called Project). Hospital desires to participate in the Project by providing its clinical data in addition to the administrative data that is already submitted and is governed by the parent agreement. This addendum to the agreement is entered into for the purpose of protecting the confidentiality of patient information in the resulting new data bases and for complying with the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) regulations on patient privacy and confidentiality, 45 C.F.R. Parts 160 and 164.

The following additions to the original agreement are outlined by section:

I. Definitions.

F. Administrative Data. Administrative Data refers to the data currently collected in the Data Bases.

G. Clinical Data. Clinical Data refers to data from laboratory or other clinical information systems

H. Hybrid Data Base. Hybrid Data Base refers to the resulting Data Base when Administrative and clinical data are merged.

II. Use and Disclosure of Data

E. MHA will provide Administrative and Clinical Data to subcontractors for purposes of creating a Hybrid Data Base. Any such release will be pursuant to a data agreement between MHA and the subcontractors. The subcontractors will not be allowed to use or share data other than for the purposes of the Project.

III. Responsibilities of MHA as a business associate:

No changes.

IV. Responsibilities of MHA as recipient of Limited Data Sets

B. 6. Any reports that MHA generates from the Hybrid Data Base will not identify hospitals by name. MHA will give hospitals the ability to identify their own data, however.

V. Duties of Hospital.

No Changes.

VI. Term.

The term of this addendum to the original agreement shall continue in force until September 30, 2009, which is the completion of MHA’s contract with AHRQ.

VII. Termination

No changes.

VIII. Miscellaneous

No changes.

The MHA and Hospital have executed this Agreement in their respective names by their duly authorized officers.

hospital

Signature line

Name

Title

Date

Minnesota Hospital Association

Signature line

Name

Title

Date