PULMONARY HYPERTENSION CARE CENTERS INSTRUCTIONS FOR APPLICANTS The purpose of the Pulmonary Hypertension Care Centers (PHCC) initiative is to establish a program of accredited centers with expertise in pulmonary hypertension that aspires to improve overall quality of care and ultimately improve outcomes of patients with pulmonary hypertension, particularly pulmonary arterial hypertension, a rare and life-threatening disease. ACCREDITATION PROCESS Introduction The process of PHCC accreditation by the Pulmonary Hypertension Association (PHA) is designed to reflect the overall goals and objectives of the PHCC program and aims to balance high quality of patient care with appropriate access/availability of care for patients. The accreditation process is designed to give stakeholders (patients, providers and medical institutions/practices) a clear awareness of expectations. Accreditation decisions are at the programmatic level and aims to identify the involved individuals, resources, facilities, and performance. Goals of the PHCC program are to assist in directly or indirectly ensuring that adequate resources are available at each site, to help facilitate quality improvement processes by raising the level of care for PAH patients, to improve access to expert PH care, to foster collaboration between PHCCs, to provide guidance for prospective programs desiring to become a PHCC, and to grow the PH community. A PHCC will be designated as a PHA-accredited “Center of Comprehensive Care” (CCC) or a PHA-Accredited “Regional Clinical Program” (RCP) based on the spectrum of resources available and therapies offered by the program. The PHCC accreditation criteria focus on the evaluation of PH patients, diagnosis of PAH, and appropriate use of therapies for Group I (PAH) patients. The criteria emphasize appropriate staff and facility resources, diagnostic evaluations of PH patients (based upon published consensus guidelines), access to PAH specific therapy, and experience in treating PAH. Participation in clinical research is also a focus area for CCC level PHCCs. All PHA-accredited PHCCs will be expected to uphold the principles of delivering appropriate and effective care to PH patients. Collaboration between the RCPs and CCCs is highly encouraged. Page 1 of 28 PHA STAFF AND PHCC COMMITTEE ROLES AND RESPONSIBILITIES PHA Pulmonary Hypertension Care Centers Staff Reviews accreditation applications to ensure completion, check for inconsistencies, process applications, coordinates scheduling site visits. Communicates with each site on behalf of the Review Committee. For all inquiries, please contact: PHCC Program Staff Email: PHCC@phassociation.org Telephone: (301) 565-3004 extentions:778; 804; 770 PHCC Review Committee (RC) Reviews applications, clarifies ambiguity in application answers, and determines program eligibility for a site visit. Provides direct communication to each program regarding accreditation decisions. Two members of the PHCC RC (one physician and one coordinator) perform a one day site visit to meet key personnel and inspect the facilities, ensure accuracy of the application, perform patient chart review to assess diagnostics and treatment and gauge the overall commitment of the staff and the institution. The site visitors complete evaluation documentation and summary reports for the RC to review. Determines which applicants warrant accreditation as a CCC or a RCP and those with deficiencies that need addressing prior to formal designation as a PHCC. Reviews periodic status reports from each established PHCC, as requested between accreditation cycles. Re-accredits existing Centers based on status reports and site visits. Notifies the PHCC Oversight Committee (OC) about deficiencies and need for potential corrective actions (to be determined by OC). Process appeals from candidate programs and communicate information to OC for adjudication. Page 2 of 28 Oversight Committee (OC) Appoints and governs the Review Committee (RC). Analyzes and updates PHCC criteria and evaluation tools. Modifies accreditation scoring system. Adjudicates candidate Center’s appeals . Notifies Centers about deficiencies and specifies corrective actions. Manages PHCC Finances. Resolves Conflict of Interest (COI) issues within the RC. PHA-ACCREDITED PH CARE CENTER ROLES AND RESPONSIBILITIES The PHA seeks to improve the care of PH patients and help advance the field by accrediting US-based PHCCs. Accreditation ensures that Centers are committed to providing comprehensive and specialized care for PH patients at a high level of proficiency. Centers applying for accreditation must meet specific requirements applicable to the care of PH patients. Centers of Comprehensive Care (CCC): An accredited CCC will: Provide comprehensive PH patient care with well-organized systems, services, facilities, highlytrained and experienced physicians and PH team members, with emphasis on quality. Use evidence-based, guideline-driven, standardized methods of delivering care. Support patient safety, education, and community awareness. Provide coordinated care with treatments tailored to individual needs. Promote the flow of patient information across settings and providers, while protecting patient’s rights, security, and privacy. Participate in research efforts to further the pulmonary vascular field. Page 3 of 28 Regional Clinical Programs (RCP): An accredited RCP will: Provide PH patient care with well-organized systems, services, facilities, experienced physicians and staff, with emphasis on quality and close follow up. Use evidence-based, guideline-driven, standardized methods of delivering care. Consult with regional PHCC Program for complex cases. Appropriately transfer patients needing advanced PAH therapies to regional CCC Program, if advanced therapy not available at the RCP. Support patient safety, education, and community awareness. Provide coordinated care with treatments tailored to individual needs. Promote the flow of patient information across settings and providers while protecting patient’s rights, security, and privacy. Promote access to pulmonary vascular clinical research to appropriate patients. PHCC Applicants All PHCC Applicants will: Complete Application (see instructions below). Provide Letters of Support from ancillary program services as noted within the application (PHA will provide templates; see appendix for document checklist). Complete a Business Letter of Agreement and/or data Security Agreement between your hospital and PHA which will allow RC access to patient records (PHA will provide a template if needed; see appendix). Help coordinate a one-day site visit with the PHA PHCC Staff. Provide copies of the additional supporting documentation regarding your program as noted in the application to the site visitors to review. Provide a roster of updated NICE classification group 1 (PAH) and group 4 (CTEPH) patients (see page 8) to the site reviewers for a limited chart review (with Director and Coordinator present) to occur on the day of the site visit. Maintain their PAH/CTEPH Patient Roster for annual updates to the PHCC. Agree to participate in a future PHCC Patient Registry (currently under development) for quality improvement purposes. Once open, the Registry will enroll ALL PAH and CTEPH patients at the PHCC who consent to participate. Page 4 of 28 Application Fees Application Site Review Accreditation Notification Annual Fee for CCC Annual Fee for RCP Re-accreditation Fee $500 $6500 $4000 $2000 $1000 $10,000 Due with Application, non-refundable Due prior to site review Due at Accreditation Notification Due in years 2 and 3 of a cycle Due in years 2 and 3 of a cycle Due prior to site review and towards the end of the previous cycle If you would like to pay with credit card, please call: 240-485-0778. Payments by check or money order can be made to: Pulmonary Hypertension Association Attn: Olivia Onyeador, PHCC Program Manager 801 Roeder Road, Suite 1000 Silver Spring, MD 20910 Page 5 of 28 PHCC APPLICATION INSTRUCTIONS COMPLETING YOUR APPLICATION (Estimated time to complete: 2-6 hours per each 100 patients in the roster; 2-4 hours for application) For linked programs seeking single Accreditation, (e.g. adult & pediatric and/or more than 2 hospitals): each program will be reviewed independently; if either program fails to meet criteria, the whole program will not be accredited. Each site for a linked program should complete a separate online application with a notation to the PHA that they should be evaluated as a single linked site. While there may be overlap between these applications, it will best enable the Review Committee to review all components of the program at each site. Prior to application submission, a site should consider whether one component should apply independently as a Regional Clinical Program (RCP). Please also refer to the flowchart below for multi-site scenarios. All questions and communications should be directed to the PHA PHCC staff during the accreditation process. The PHA PHCC staff will contact you to process your materials, clarify any ambiguities, and facilitate scheduling a site visit as appropriate. Page 6 of 28 The PAH/CTEPH Patient Roster (see page 8) should be completed FIRST as this will facilitate answering the application questions and will provide the basis for the randomly –selected chart review during your site visit. It should ONLY include patients who predominantly fit into WHO Diagnostic Groups 1 or 4 PH. PH patients from WHO Diagnostic Groups 2, 3 and 5 should be excluded from the roster. If a patient who does not meet the traditional hemodynamic definition of PAH (i.e. mean PAP ≥ 25 mmHg and PAWP or LVEDP ≤ 15 mmHg) is included in the roster and selected during the chart review, the site must provide a rationale for inclusion as PAH/CTEPH patient. The PAH/CTEPH Patient Roster should NOT be sent with your application but should be retained by your program as it contains protected health information (PHI). It will be reviewed during your site visit as part of the chart review process. The PH Care Centers Reviewers will not remove any PHI or identifiable patient information from the applicant site. Extensive knowledge of the patient cohort and local EMR enhances the chart review process therefore the Director and Coordinator are requested to be present and participate in the on site chart review process. In general, each potential Adult PHCC CCC should actively be managing at least 75-100 PAH and CTEPH patients. Additionally, a potential CCC must also show proficiency and experience with all PAH therapies (oral, inhaled, and parenteral). Adult programs should have managed at least 20 PAH patients on parenteral (IV and SC) prostanoids during the preceding 3 years. It is recognized that some programs will have numbers below this range and pertinent influential factors will be considered such as the duration of program’s existence and experience of the director, the number and proximity of other nearby PH programs, and your regional population and patient catchment area. Each potential Adult PHCC RCP should actively be managing a minimum of 25 PAH and CTEPH patients and demonstrate proficiency and experience with all non-parenteral PAH therapies. Experience with administering parenteral therapies is NOT required of an RCP. Potential RCP directors should demonstrate collaboration and co-management of PAH and CTEPH patients with a CCC, particularly when the need arises for more advanced care that cannot be provided at the RCP (for example parenteral prostanoids, transplantation, thromboendarterectomy, or need for a more experienced facility). RCPs are also encouraged to work with CCCs to evaluate patients for investigational protocols not available at the RCP. Each accreditation decision will be based on the comprehensive overall application. If your program's patient care volume or experience falls outside these ranges, or if you are applying for Pediatric PHCC status, please contact the PHA PHCC staff to discuss your application in greater detail. Page 7 of 28 PAH/CTEPH PATIENT ROSTER Please complete the following roster with all PAH (Group 1) & CTEPH (Group 4) patients seen and managed within the prior 3 calendar years. Patients who are included but don’t meet traditional hemodynamic definition of PAH [Hoeper MM, et al. JACC. 2013; 62: D45-50] may need justification to site reviewers for inclusion in the roster. Do NOT submit with your application. Please make copies of the template as needed. ID # Initials SEX DOB (DD/MM /YY) DATE OF 1ST Encounter (MM/YY) DIAGNOSIS IPAH NonIPAH PAH CTEPH MEDICATIONS Current PAH medications (may be multiple) PO __1 __2 __3 __4 __5 __6 __7 __8 __9 __0 __1 __2 __3 __4 __5 __6 __7 __8 __9 __0 Page 8 of 28 IH IV SQ Date of parenteral drug initiation, if applicable (MM/YY) PAST TREATMENTS Been on IV/SQ therapy within last 3 years VITAL STATUS (may be multiple) A = Alive T= Transplanted P = PTE D = Dead L = Lost to follow up Please complete the Application as directed and attach all requested Letters of Support (LOS) and other documents as noted (see Appendix for LOS templates and the document checklist). A program site visit will generally be scheduled in advance with enough time to allow for site visit preparation (see below under “Preparing for Your Site Visit”). A. Contact Information Please complete the contact information regarding the name and affiliation of your program as well as the principal contact individual for correspondence with the PHA PHCC staff. B. Pulmonary Hypertension Program Narrative Report The Program Director should complete this narrative to give the PHCC Review Committee an overview of your program. Please add any additional relevant information you feel is important for the PHA site reviewers to understand about your program to aide in the review or accreditation process. C. Center Director Q1-4: Please provide contact information, medical license and specialty board certification status. Q5: Please provide estimate of years of PAH clinical experience since completion of fellowship training. Q6: Please complete regarding PH clinical and scientific meeting participation. Please provide supporting documents at the site visit as available (participation with organizing/steering committee, lectures, poster presentations, CME, etc.) Q7: Please provide supporting documents regarding PH educational activities at the site visit as available. Q9: CME hours may include any regional, national, or international meeting where PH-related subjects are discussed (cardiology, pulmonary, transplantation, PAH specific, etc). Q10: Please upload a copy of the Director’s CV with the application as noted. D. Center Coordinator Q1-2: Please provide contact information, professional credentials, medical license and FTE dedicated to the PH program. Although only one individual may serve as a designated Coordinator, multiple individuals may contribute FTE to the Coordinator functions for the total time calculation. Q3: Please note the financial support for the PH Coordinator. Q4: Coordinator Roles: Please have supporting documents regarding Coordinator PH educational activities (educational materials) and safety monitoring methods for review at the site visit as available. Page 9 of 28 Q5: Please complete regarding Coordinator PH clinical and scientific meeting participation. Please provide supporting documents at the site visit as available (participation with organizing/steering committee, lectures, poster presentations, CME, etc.) Q6: Please provide supporting documents at the site visit as available. Q8: CEU/CME hours may include any regional, national, or international meeting where PH-related subjects are discussed (cardiology, pulmonary, transplantation, PAH specific, etc). Q9: Please upload a copy of the Coordinator’s CV. Q10: Please upload a copy of the Coordinator’s Professional License. E. Program Staff and Support Services Q1: Please note the name and title of your PH program physician staff. Provide an approximate PH-related FTE (> 5%) for each physician and total FTE for your program. Q2: Please provide the number of PAH patients being actively managed by your program from your completed PAH/CTEPH Patient Roster (see Appendix). Information in the Roster should be for PAH and CTEPH patients managed within the prior 3 years only. Please have your PAH/CTEPH Patient Roster available at the site visit. Q3: Please estimate the percent (%) for each question. Q4: Please note PAH therapies provided at your site and the of number of PAH patients on each therapy from your completed PAH/CTEPH Patient Roster (see Appendix). Information in the Roster should be for PAH and CTEPH patients managed within the prior 3 years only. Please have your PAH/CTEPH Patient Roster available at the site visit. Q5: Please note the name and title/role of your PH program non-physician support staff. Provide an approximate PH-related FTE (> 5%) for each individual. Q6: Please upload a copy of recent call schedule with the application as noted. Q7-10: Please upload letters of support with the application as noted. Q16-17: Please upload letters of support with the application as noted. F. Facilities Q1: Please provide supporting documents regarding hospital staff training and management protocols at the site visit as available. Q2: Please upload a Cardiac Catheterization Laboratory letter of support with the application as noted. Please provide supporting documents regarding cardiac catheterization laboratory PH related protocols at the site visit as available. Q3: Please upload the Echocardiography Laboratory letter of support, IAC accreditation letter, and exercise study report form with the application as noted. Q4: Please upload the PFT Laboratory letter of support and Exercise Study Report Form with the application as noted. Please provide supporting documents regarding PFT laboratory PH related procedural manuals and protocols at the site visit as available. Page 10 of 28 Q5: Please provide supporting documents regarding pharmacy PH medication protocols at the site visit as available. Q10: Please upload the institutional letter of support with your application. G. Research Q1: Please note the name and title of your PH program clinical research staff. Q2: Please complete the table regarding your IRB-approved studies performed within the past 3 years. Include only your 5 most recent studies with the sponsor name and current or final enrollment information as appropriate. Do not include any registry studies. Please upload copies of IRB approval or renewal letters for the above listed studies Please upload copies of the Curriculum Vitae for all associated Clinical Research Coordinators (CRCs). Please upload copies of current documentation regarding completion of education on the protection of human subjects (e.g., NIH, Collaborative IRB Training Initiative “CITI” or equivalent) for all listed CRCs and Principal Investigators. Q5: Please upload a bibliography list of peer-reviewed publications from the program staff (limit to prior 5 years only), if not already listed on Director or Coordinator CVs. Page 11 of 28 PREPARING FOR YOUR SITE VISIT The Business Associate Agreement (see Appendix) must be completed between your program institution and the Pulmonary Hypertension Association before a visit can be scheduled. This will allow the PHCC reviewers to perform the site review and access patient protected health information (PHI). The PHA PHCC staff will assist you in this agreement process. Please maintain your PAH/CTEPH Patient Roster (see Instructions and page 8). In addition, compile a list of your infusion patients from the preceding three years; this should be a subset of your Patient Roster. The information should include prescribed infusion, current dose of infused drug, and duration on infusion therapy. This information will be retained by your site after the site visit. You should collect and collate copies of the remaining Supporting Documents which will be reviewed during your site visit (see Appendix - Document List 2). These will be kept at the PHA as part of your completed application. Finally, the schedule of Interviews will need to be finalized prior to the site visit day (see Appendix). DAY OF SITE VISIT - WHAT TO EXPECT The template for the site review interviews is attached in the Appendix. The order and time allocated for each of these meetings should be scheduled according to the attached template as much as feasible. Changes to the schedule should not be made without prior discussion and approval from the PHA PHCC staff. Please arrange for all interviews to be held in a quiet, private meeting space appropriate to the size of the group. Interviews with program support, ancillary and research staff are to be held with the site visitors alone (Program Leadership not needed). Please adjust schedule to allow for adequate travel time between locations as required. The chart review will take approximately 1 hour. The Director and Coordinator should be present during the chart review to access charts and assist the site reviewers in finding clinical information. At the end of the day, site reviewers will provide feedback to the program leadership and answer any questions. AFTER YOUR SITE VISIT The PHA PHCC Review Committee meets to discuss all completed applications and all final accreditation decisions are made by the PHCC Review Committee. Letters of PHA PHCC accreditation status will be sent out by the PHCC Review Committee twice annually. Your site reviewers will be able to provide you with a general timeframe for your accreditation determination and notification. If your program is accredited, You will need to continue maintaining a roster of new PAH and CTEPH patients evaluated at your Center. You will need to submit annual updates about your program and report any major programmatic changes to the PHCC. Page 12 of 28 Your Center is expected to participate in the PHCC patient registry, currently under development. Your Center will need to pay annual fees and apply for reaccreditation in approximately 3 years, in order to maintain your accreditation. For further information, please contact the PHA PHCC staff office. Page 13 of 28 APPENDIX: APPLICATION DOCUMENT CHECKLISTS Document List 1: To submit electronically with application: □ PHCC Director CV □ PHCC Coordinator CV □ PHCC Coordinator License □ Cardiology and/or PCCM Call Schedule □ Rheumatology Service LOS □ Cardiac Anesthesia Service LOS □ Transplantation Program LOS □ Congenital Heart Disease Service LOS □ Palliative Care Service LOS □ Rehabilitation Service LOS □ Institutional LOS □ Cardiac Catheterization Laboratory Director LOS □ Pulmonary Function Laboratory Director LOS □ Exercise Testing Report Document □ Echocardiography Laboratory Director LOS □ Copy of Echocardiograph Laboratory Accreditation □ IRB Approval or Renewal letters demonstrating the program's PH investigations (prior 3 years only) □ Copy of Investigator and Clinical Research Coordinator's completion of Human Investigation Training (e.g. Clinical Investigator Training Initiative "CITI" or equivalent). Page 14 of 28 Document List 2: Provide the following supporting documents to the reviewers at the site visit only: □ PAH/CTEPH Patient Roster (see instruction and appendix) Please show the following supporting documents to the reviewers at the site (and email PDF electronic copies to the PHA after your site visit): □ PH clinical and scientific meeting participation by Program Director (organizing/steering committee assignments, lectures, poster presentations, CME certificates, etc.) if not on CV. □ PH educational activities by Program Director (Educating Center and Hospital Staff, Mentoring/Teaching Trainees, Community Outreach, PH-related committee work, etc.) if not on CV. □ PH clinical and scientific meeting participation by Coordinator (participation with organizing/steering committee, lectures, poster presentations, CME, etc.) if not on CV. □ PH educational activities by Coordinator (Educating Center and Hospital Staff, Mentoring/Teaching Trainees, Community Outreach, PH-related committee work, etc.) if not on CV. □ PH patient related safety activities by Coordinator (safety monitoring methods and materials such as labtrack or other methods) □ PH related hospital RN and RT staff training materials, competencies, and inpatient management protocols □ Cardiac Catheterization Laboratory PH related protocols □ PFT laboratory PH related procedural manuals and protocols (e.g. 6 MWD and CPET testing) □ Inpatient Pharmacy PH staff training materials, competencies, and inpatient medication protocols □ Program Publications (please list peer reviewed publications only within the prior 5 years only), if not on CV. Page 15 of 28 APPENDIX: LETTERS OF SUPPORT TEMPLATES GENERAL LETTER OF SUPPORT TEMPLATE Date To the Pulmonary Hypertension Association (PHA) Pulmonary Hypertension Care Centers (PHCC) Review Committee: I am pleased to acknowledge my role as (note role) in support of the (name of institution) PH program in their current application to become a PHA-accredited PHCC. In conclusion, I confirm my support to the efforts of this program as it seeks accreditation through the Pulmonary Hypertension Association Pulmonary Hypertension Care Centers initiative. Respectfully, Name Title Department/Division, Institution INSTITUTIONAL LETTER OF SUPPORT TEMPLATE Date To the Pulmonary Hypertension Association (PHA) Pulmonary Hypertension Care Center (PHCC) Review Committee: This letter is to acknowledge that I am aware of the current PHA PHCC application from our local program, including the financial obligations of the program. I additionally confirm that (name of institution) supports the application for accreditation and provides ongoing financial support for this clinical program. This support specifically includes but is not limited to (list examples of financial support provided). Please contact me if you have any questions or require additional information. Sincerely, Name Title Institution Page 16 of 28 APPENDIX: BUSINESS ASSOCIATE AGREEMENT TEMPLATE This HIPAA Business Associate Agreement ("Agreement") is entered into by and between Corporation Name (format example: "Pulmonary Hypertension Association, Inc."), a Corporation Type (format example: Maryland 501(c)(3) Public Charity) ("Covered Entity") and Business Associate, Pulmonary Hypertension Association, a 501(c)(3) non-profit corporation ("Associate"). This Agreement shall supplement and is made a part of the contracted date this _____ day of _______, 2015 (“Contract”) between the parties. This Agreement shall be effective as of the effective date shown below (“Effective Date”). RECITALS A. Covered Entity wishes to disclose certain information to Associate pursuant to the terms of the Contract, some of which may constitute Protected Health Information ("PHI") (defined below). B. Covered Entity and Associate intend to protect the privacy and provide for the security of PHI disclosed to Associate pursuant to the Contract in compliance with the applicable provisions of the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act, Public Law 111-005 ("the HITECH Act"), and regulations promulgated thereunder by the U.S. Department of Health and Human Services (the "HIPAA Regulations") and other applicable laws. C. As part of the HIPAA Regulations, the Privacy Rule and the Security Rule (defined below) require Covered Entity to enter into a contract containing specific requirements with Associate prior to the disclosure of PHI, as set forth in, but not limited to, Title 45, Sections 164.314(a), 164.502(a) and (e) and 164.504(e) of the Code of Federal Regulations ("CFR") and contained in this Agreement. In consideration of the mutual promises below and the exchange of information pursuant to this Agreement, the parties agree as follows: 1 Definitions. 1.1 Breach shall have the meaning given to such term under the HITECH Act and HIPAA Regulations [42 U.S.C. Section 17921 and 45 C.F.R. Section 164.402]. 1.2 Breach Notification Rule shall mean the HIPAA Regulation that is codified at 45 C.F.R. Parts 160 and 164, Subparts A and D. 1.3 Business Associate shall have the meaning given to such term under the Privacy Rule, including, the Security Rule, and the HITECH Act, including but not limited to, 42 U. S.C. Section 17938 and 45 CFR Section 160.103. 1.4 Covered Entity shall have the meaning given to such term under the Privacy Rule, and the Security Rule, including, but not limited to, 45 CFR Section 160.103. 1.5 Data Aggregation shall have the meaning given to such term under the Privacy Rule, including, but not limited to, 45 CFR Section 164.501. 1.6 Designated Record Set shall have the meaning given to such term under the Privacy Rule, including, but not limited to, 45 CFR Section 164.501. 1.7 Electronic Protected Health Information means Protected Health Information that is Page 17 of 28 maintained in or transmitted by electronic media. 1.8 Electronic Health Record shall have the meaning given to such term in the HITECH Act, including, but not limited to, 42 U.S.C. Section 17921. 1.9 Health Care Operations shall have the meaning given to such term under the Privacy Rule, including, but not limited to, 45 CFR Section 164.501. 1.10 Privacy Rule shall mean the HIPAA Regulation that is codified at 45 CFR Parts 160 and 164 Subparts A & E. 1.11 Protected Health Information or PHI means any information, whether oral or recorded in any form or medium: (i) that relates to the past, present or future physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and (ii) that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual, and shall have the meaning given to such term under the Privacy Rule, including, but not limited to, 45 CFR Section 164.501. Protected Health Information includes Electronic Protected Health Information [45 C.F.R. Sections 160.103, 164.304]. 1.12 Protected Information shall mean PHI provided by Covered Entity to Associate or created, maintained, received, or transmitted by Associate on Covered Entity's behalf. 1.13 Security Incident shall have the meaning given to such term under the Security Rule, including, but not limited to, 45 C.F.R. Section 164.304. 1.14 Security Rule shall mean the HIPAA Regulation that is codified at 45 C.F.R. Parts 160 and 164, Subparts A and C. 1.15 Unsecured PHI shall have the meaning given to such term under the HITECH Act and any guidance issued pursuant to such Act including, but not limited to, 42 U.S.C. Section 17932(h) and 45 C.F.R. Section 164.402. 2 Obligations of Associate. 2.1 Permitted Uses. Associate shall use Protected Information only for the purpose of performing Associate's obligations under the Contract and as permitted or required under the Contract and Agreement, or as required by law. Further, Associate shall not use Protected Information in any manner that would constitute a violation of the Privacy Rule or the HITECH Act if so used by Covered Entity, except that Associate may use Protected Information (i) for the proper management and administration of Associate, (ii) to carry out the legal responsibilities of Associate, (iii) as required by law, or (iv) for Data Aggregation purposes relating to the Health Care Operations of Covered Entity [45 C.F.R. Sections 164.504(e)(2), and 164.504(e)(4)(0] 2.2 Permitted Disclosures. Associate shall disclose Protected Information only for the purpose of performing Associate's obligations under the Contract and as permitted or required under the Contract and Agreement, or as required by law. Associate shall not disclose Protected Health Information in any manner that would constitute a violation of the Privacy Rule or the HITECH Act if so disclosed by Covered Entity. However, Associate may disclose Protected Information as necessary (i) for the proper management and administration of Page 18 of 28 Associate; (ii) to carry out the legal responsibilities of Associate, (iii) as required by law, or (iv) for Data Aggregation purposes relating to the Health Care Operations of Covered Entity. To the extent that Associate discloses Protected Information to a third party for purposes set forth above in 2.2(i), 2.2(ii), and 2.2(iii), Associate must obtain, prior to making any such disclosure, (i) reasonable written assurances from such third party that such Protected Information will be held confidential as provided pursuant to this Agreement and used or disclosed only as required by law or for the purposes for which it was disclosed to such third party, and (ii) a written agreement from such third party to immediately notify Associate of any breaches, suspected breaches, security incidents, or unauthorized uses or disclosures of the Protected Information in accordance with paragraph 2.m of the Agreement, to the extent it has obtained knowledge of such occurrences. [42 U.S.C. Section 17932; 45 C.F.R. Sections 164.504(e)(2)(i), 164.504(e)(2)(i)(B), 164.504(e)(2)(ii)(A) and 164.504(e)(4)(ii)] 2.3 Prohibited Uses and Disclosures. Associate shall not use or disclose PHI to any person, entity or organization outside the United States. Specifically, Associate shall not outsource any PHI to any person or organization outside the continental United States. Associate shall indemnify, defend, and hold harmless Covered Entity, and its officers, directors, employees, agents, and representatives (collectively "Covered Entity"), against all liability, demands, claims, costs, losses, damages, recoveries, settlements, and expenses (including interest, penalties, attorney fees, accounting fees, and expert witness fees) incurred by Covered Entity ("Losses"), known or unknown, contingent or otherwise, directly or indirectly arising from or related to the disclosure of PHI to any person, entity or organization outside the United States. Associate shall not use or disclose PHI other than as permitted or required by the Contract and Agreement, or as required by law. Associate shall not use or disclose Protected Information for fundraising or marketing purposes. Associate shall not disclose Protected Information to a health plan for payment or health care operations purposes if the patient has requested this special restriction, and has paid out of pocket in full for the health care item or services to which the PHI solely relates [42 U.S.C. Section 17935(a) and 45 C.F.R. Section 164.522(a)(vi)]. Associate shall not directly or indirectly receive remuneration in exchange for Protected Information, except with the prior written consent of Covered Entity and as permitted by the HITECH Act, 42 U.S.C. Section 17935(d)(2), and the HIPAA regulations, 45 C.F.R. Section 164.502(a)(5)(ii); however, this prohibition shall not affect payment by Covered Entity to Associate for services provided pursuant to the Contract. Covered Entity shall notify business associate of any restriction on the use or disclosure of protected health information that Covered Entity has agreed to or is required to abide by under 45 C.F.R. 164.522, to the extent that such restriction may affect business associate's use or disclosure of protected health information. 2.4 Appropriate Safeguards. Associate shall implement appropriate safeguards as are necessary to prevent the use or disclosure of Protected Information other than as permitted by this Agreement, including, but not limited to, administrative, physical and technical safeguards in accordance with the Security Rule, including, but not limited to, 45 Section 164.308, 164.310, and 164.312. [45 C.F.R. Section 164.504(e)(2)(ii)(B); 45 Section 164.308(b)]. Associate shall comply with the policies and procedures and documentation requirements Page 19 of 28 of the Security Rule, including, but not limited to, 45 C.F.R. Section 164.316. [42 U.S.C. Section 17931] Associate shall maintain a comprehensive written information privacy and security program that includes administrative, technical and physical safeguards appropriate to the size and complexity of the Associate's operations and the nature and scope of its activities. 2.5 Business Associate's Subcontractors and Agents. Associate shall ensure that any agents and subcontractors that create, receive, maintain or transmit Protected Information on behalf of Covered Entity, agree in writing to the same restrictions and conditions that apply to Associate with respect to such Protected Information and implement the safeguards required by paragraph 2.4 above with respect to Electronic PHI [45 C.F.R. Sections 164.504(e)(2)(ii)(D); 45 C.F.R. Section 164.308(b)]. Associate shall implement and maintain sanctions against agents and subcontractors that violate such restrictions and conditions and shall mitigate the effects of any such violation (see 45 C.F.R. Sections 164.530(f) and 164.530(e)(1)). 2.6 Access to Protected Information. This provision will be effective only when Associate maintains a Designated Record Set on behalf of Covered Entity. Associate shall make Protected Information maintained by Associate or its agents or subcontractors in Designated Record Sets available to Covered Entity for inspection and copying within five (5) Business days of a request by Covered Entity to enable Covered Entity to fulfill its obligations under state law [Health and Safety Code Section 123110] and the Privacy Rule, including, but not limited to, 45 CFR Section 164.524 [45 C.F.R. Section 164.504(e)(2)(ii)(E)]. If Associate maintains Protected Information in electronic format, Associate shall provide such information in electronic format as necessary to enable Covered Entity to fulfill its obligations under the HITECH Act and HIPAA Regulations, including, but not limited to, 42 U.S.C. Section 17935(e) and 45 C.F.R. Section 164.524. 2.7 Amendment of PHI. This provision will be effective only when Associate maintains a Designated Record Set on behalf of Covered Entity. Within ten (10) business days of receipt of a request from Covered Entity for an amendment of Protected Information or a record about an individual contained in a Designated Record Set, Associate and its agents and subcontractors shall make such Protected Information available to Covered Entity for amendment and incorporate any such amendment or other documentation to enable Covered Entity to fulfill its obligations under the Privacy Rule, including, but not limited to, 45 CFR Section 164.526. If any individual requests an amendment of Protected Information directly from Associate or its agents or subcontractors, Associate must notify Covered Entity in writing within five (5) business days of the request and of any approval or denial of amendment of Protected Information maintained by Associate or its agents or subcontractors [45 C.F.R. Sections 164.504(e)(2)(ii)(F)]. 2.8 Accounting Rights. Within ten (10) business days of notice by Covered Entity to Associate of a request for an accounting of disclosures of Protected Information for which Covered Entity is required to account to an individual, Associate and its agents and subcontractors shall make available to Covered Entity the information required to provide an accounting of disclosures to enable Covered Entity to fulfill its obligations under the Privacy Rule, including, but not limited to, 45 CFR Section 164.528 and the HITECH Act, including, but not limited to 42 U.S.C. Section 17935©, as determined by Covered Entity. Associate agrees to implement a process that allows for an accounting to be collected and maintained by Page 20 of 28 Associate and its agents and subcontractors for at least six (6) years prior to the request. However, accounting of disclosures from an Electronic Health Record for treatment, payment or health care operations purposes are required to be collected and maintained for only three (3) years prior to the request, and only to the extent that Associate maintains an Electronic Health Record. At a minimum, the information collected and maintained shall include: (i) the date of disclosure; (ii) the name of the entity or person who received Protected Information and, if known, the address of the entity or person; (iii) a brief description of Protected Information disclosed; and (iv) a brief statement of purpose of the disclosure that reasonably informs the individual of the basis for the disclosure, or a copy of the individual's authorization, or a copy of the written request for disclosure. In the event that the request for an accounting is delivered directly to Associate or its agents or subcontractors, Associate shall within five (5) business days of a request forward it to Covered Entity in writing. It shall be Covered Entity's responsibility to prepare and deliver any such accounting requested. Associate shall not disclose any Protected Information except as set forth in Sections 2.2 of this Agreement [45 C.F.R. Sections 164.504(e)(2)(ii)(G), 164.414(a), 164.528(a)(3), 165.528, and 164.530(j)(2)]. The provisions of this subparagraph shall survive the termination of this Agreement. 2.9 Governmental Access to Records. Associate shall make its internal practices, books and records relating to the use and disclosure of Protected Information available to Covered Entity (with reasonable notice) and to the Secretary of the U.S. Department of Health and Human Services (the "Secretary") for purposes of determining Associate's compliance with the HIPAA [45 C.F.R. Sections 164.504(e)(2)(ii)(I)]. To the extent permitted by law, Associate shall provide to Covered Entity a copy of any Protected Information and other documents and records that Associate provides to the Secretary concurrently with providing such Protected Information to the Secretary. 2.10 Disclosure of Minimum Necessary PHI. Associate, its agents and subcontractors shall request, use and disclose only the minimum amount of Protected Information necessary to accomplish the purpose of the request, use or disclosure. [42 U.S.C. Section 17935(b); 45 C.F.R. Sections 164.514(d)] Associate understands and agrees that the definition of "minimum necessary" is in flux and shall keep itself informed of guidance issued by the Secretary with respect to what constitutes "minimum necessary." 2.11 Data Ownership. Associate acknowledges that Associate has no ownership rights with respect to the Protected information. 2.12 Retention of Protected Information. Notwithstanding Section 3.3 of this Agreement, Associate and its agents and subcontractors shall retain all Protected Information throughout the term of the Contract and shall continue to maintain the information required under Section 2.8 of this Agreement for a period of six (6) years after termination of the Contract 45 C.F.R. 164.414(a); 45 C.F.R. 164.528(a)(3); and 45 C.F.R. 164.530(j)(2). 2.13 Notification of Breach. Associate shall notify Covered Entity within two (2) business day of any breach of protected Information; any use or disclosure of Protected Information not permitted by the Agreement; any security incident (i.e., any successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system) related to Protected Information, and any use or disclosure of data in violation of any applicable federal or state laws by Associate or its Page 21 of 28 agents or subcontractors. The notification shall include, to the extent possible, the identification of each individual whose unsecured Protected Information has been, or is reasonably believed by the business associate to have been, accessed, acquired, used, or disclosed, as well as any other available information that Covered Entity is required to include in notification to the individual, the media, the Secretary, and any other entity under the Breach Notification Rule and any other applicable state or federal laws, including, but not limited, to 45 C.F.R. Section 164.404 through 45 C.F.R. Section 164.408, at the time of the notification required by this paragraph or promptly thereafter as information becomes available. Associate shall take (i) prompt corrective action to cure any deficiencies and (ii) any action pertaining to unauthorized uses or disclosures required by applicable federal and state laws. [42 U.S.C. Section 17921; 45 C.F.R. Section 164.504(e)(2)(ii)(C); 45 C.F.R. Section 164.308(b)] 2.14 Breach Pattern or Practice by Business Associate's Subcontractors and Agents. Pursuant to 42 U.S.C. Section 17934(b) and 45 C.F.R. Section 164.504(e)(1)(ii), if Associate knows of a pattern of activity or practice of a subcontractor or agent that constitutes a material breach or violation of the subcontractor or agent's obligations under the Agreement or other arrangement, the Associate must take reasonable steps to cure the breach or end the violation. If the steps are unsuccessful, the Associate must terminate the Agreement or other arrangement if feasible. Associate shall provide written notice to Covered Entity of any pattern of activity or practice of a subcontractor or agent that Associate believes constitutes a material breach or violation of the subcontractor or agent's obligations under the Agreement or other arrangement within five (5) business days of discovery and shall meet with Covered Entity to discuss and attempt to resolve the problem as one of the reasonable steps to cure the breach or end the violation. 2.15 Audits, Inspection and Enforcement. Within ten (10) business days of a written request by Covered Entity, Associate and its agents and subcontractors shall allow Covered Entity or its agents or subcontractors to conduct a reasonable inspection of the facilities, systems, books, records, agreements, policies and procedures relating to the use or disclosure of Protected Information pursuant to this Agreement for the purpose of determining whether Associate has complied with this Agreement or maintains adequate security safeguards; provided, however, that (i) Associate and Covered Entity shall mutually agree in advance upon the scope, timing and location of such an inspection, (ii) Covered Entity shall protect the confidentiality of all confidential and proprietary information of Associate to which Covered Entity has access during the course of such inspection; and (iii) Covered Entity shall execute a nondisclosure agreement, upon terms mutually agreed upon by the parties, if requested by Associate. The fact that Covered Entity inspects, or fails to inspect, or has the right to inspect, Associate's facilities, systems books, records, agreements, policies and procedures does not relieve Associate of its responsibility to comply with this Agreement, nor does Covered Entity's (i) failure to detect or (ii) detection, but failure to notify Associate or require Associate's remediation of any unsatisfactory practices, constitute acceptance of such practice or a waiver of Covered Entity's enforcement rights under this Agreement. Associate shall notify Covered Entity within five (5) business days of learning that Associate has become the subject of an audit, compliance review, or complaint investigation by the Office for Civil Rights or other state or federal government entity. Page 22 of 28 2.16 Obligations Under Subpart E. To the extent Associate is to carry out one or more of covered entity's obligations(s) under Subpart E of 45 C.F.R. Part 164, comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such obligation(s) 2.17 Indemnification. Associate shall indemnify, defend, and hold harmless Covered Entity, and its officers, directors, employees, agents, and representatives (collectively "Covered Entity"), against all liability, demands, claims, costs, losses, damages, recoveries, settlements, and expenses (including interest, penalties, attorney fees, accounting fees, and expert witness fees) incurred by Covered Entity ("Losses"), known or unknown, contingent or otherwise, directly or indirectly, arising out of or in connection with any (a) unauthorized use or disclosure of PHI, (b) failure in security measures affecting PHI; or (c) other material breach of the terms of this Agreement by Associate or any person or entity under Associate's control. Indemnification is conditioned upon Covered Entity notifying Associate in writing promptly upon learning of any claim for which indemnification may be sought hereunder, and tendering the defense of such claim to Associate. Associate will not be required to indemnify Covered Entity if any claim is settled without Associate's written consent. 3 Termination. 3.1 Material Breach. A breach by Associate of any material provision of this Agreement, as determined by Covered Entity, shall constitute a material breach of the Contract. Associate will have 10 business days to cure such breach. In the event Associate does not cure the breach, Covered Entity retains the right to immediately terminate the contract. [45 C.F.R. Section 164.504(e)(2)(iii)] 3.2 Judicial or Administrative Proceedings. Covered Entity may terminate this Contract, effective immediately, if (i) Associate is named as a defendant in a criminal proceeding for a violation of HIPAA, the HITECH Act, the HIPAA Regulations or other security or privacy laws or (ii) a finding or stipulation that the Associate has violated any standard or requirement of HIPAA, the HITECH Act, the HIPAA Regulations or other security or privacy laws is made in any administrative or civil proceeding in which the party has been joined. 3.3 Effect of Termination. Upon termination of this Contract for any reason, Associate shall, at the option of Covered Entity, return or destroy all Protected Information that Associate or its agents and subcontractors still maintain in any form, and shall retain no copies of such Protected Information. If return or destruction is not feasible, as determined by Covered Entity, Associate shall continue to extend the protections of Section 2 of this Agreement to such information, and limit further use of such PHI to those purposes that make the return or destruction of such PHI infeasible. [45 C.F.R. Section 164.504(e)(ii)(2)(J)]. If Covered Entity elects destruction of the PHI, Associate shall certify in writing to Covered Entity that such PHI has been destroyed in accordance with the Secretary's guidance regarding proper destruction of PHI. 3.4 Limitation of Liability. Any limitation of liability in the Contract shall not apply to damages related to a breach of Associates privacy or security obligations under the Agreement. 3.5 Disclaimer. Covered Entity makes no warranty or representation that compliance by Associate with this Agreement, HIPAA, the HITECH Act, or the HIPAA Regulations will be adequate or satisfactory for Associate's own purposes. Associate is solely responsible for all decisions made by Associate regarding the safeguarding of PHI. Page 23 of 28 4 4.5 Amendment. 4.1 Amendment to Comply with Law. The parties acknowledge that state and federal laws relating to data security and privacy are rapidly evolving and that amendment of this Agreement may be required to provide for procedures to ensure compliance with such developments. The parties specifically agree to take such action as is necessary to implement the standards and requirements of HIPAA, the HITECH Act, the HIPAA regulations and other applicable state or federal laws relating to the security or confidentiality of PHI. The parties understand and agree that Covered Entity must receive satisfactory written assurance from Associate that Associate will adequately safeguard all Protected Information. Upon the request of either party, the other party agrees to promptly enter into negotiations concerning the terms of an amendment to this Agreement embodying written assurances consistent with the standards and requirements of HIPAA, the HITECH Act, the HIPAA regulations or other applicable laws. Covered Entity may terminate this Contract upon thirty (30) days written notice in the event (i) Associate does not promptly enter into negotiations to amend this Agreement when requested by Covered Entity pursuant to this Section or (ii) Associate does not enter into an amendment to this Agreement providing assurances regarding the safeguarding of PHI that Covered Entity, in its sole discretion, deems sufficient to satisfy the standards and requirements of applicable laws. 4.2 Litigation or Administrative Proceedings. Associate shall notify Covered Entity within five (5) business days of any litigation or administrative proceedings commenced against Associate or its agents or subcontractors related to violations of HIPAA, the HITECH Act, the HIPAA regulations, or other state or federal laws relating to the security and privacy of health information. In addition, Associate shall make itself and any subcontractors, employees and agents assisting Associate in the performance of its obligations under this Agreement, available to Covered Entity, at no cost to Covered Entity, to testify as witnesses, or otherwise, in the event of litigation or administrative proceedings being commenced against Covered Entity, its directors, officers or employees based upon a claimed violation of HIPAA, the HITECH Act, the HIPAA regulations, or other state or federal laws relating to security and privacy, as a result of a breach of this Agreement by Associate or its subcontractors, employees or agents, except where Associate or its subcontractors, employees or agents are a named adverse party. 4.3 No Third Party Beneficiaries. Nothing express or implied in this Contract or any addendum thereto is intended to confer, nor shall anything herein confer, upon any person other than Covered Entity, Associate and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever. 4.4 Interpretation. The provisions of this Agreement shall prevail over any provisions in the Contract that may conflict or appear inconsistent with any provision in this Agreement. This Agreement and the Contract shall be interpreted as broadly as necessary to implement and comply with HIPAA, the HITECH Act, the HIPAA regulations, and other state and federal laws related to security and privacy. The parties agree that any ambiguity in this Agreement shall be resolved in favor of a meaning that complies and is consistent with HIPAA, the HITECH Act, the HIPAA regulations, and other state and federal laws related to security and privacy. Notices/Supplying Information. Any notices to be given to a Party must be made Page 24 of 28 via U.S. Mail or express courier to such Party's address given below, and/or via facsimile to the facsimile telephone numbers listed below. Each Party may change its address and that of its representative for notice in the manner herein provided: 4.6 Jurisdiction/Venue. This Agreement shall be interpreted under the laws of the State of Maryland and any applicable US federal law. The parties agree that venue for any and all disputes arising under this Agreement shall be in Montgomery County, Maryland. IF TO COVERED ENTITY Corporation Name Corporate Address City, State Zip Attention: Name Facsimile: Number Email: Email Address (Not to constitute notice) Phone: Phone Number (Not to constitute notice) IF TO ASSOCIATE: Pulmonary Hypertension Association 801 Roeder Road, Suite 1000 Silver Spring, MD 20910 Attention: PHCC Program Manager Facsimile: 301-565-3994 Email: Medical@PHAssociation.org (Not to constitute notice) Phone: 301-565-3004 x770 (Not to constitute notice) Page 25 of 28 IN WITNESS WHEREOF, the parties hereto have duly executed this Agreement and the Effective Date shall be as of the ____ day of _____, 2015. COVERED ENTITY Corporation Name A Corporation Type By: ________________________________ Print Name: _________________________ Title: ______________________________ Date: ______________________________ BUSINESS ASSOCIATE Pulmonary Hypertension Association, A 501(c)(3) Non-Profit Corporation By: ____________________________________ Print Name: _____________________________ Title: __________________________________ Date: ________________________________ Page 26 of 28 APPENDIX: PHCC SITE VISIT SCHEDULE OF EVENTS Please arrange for all interviews to be held in a quiet, private meeting space appropriate to the size of the group. Interviews with program support, ancillary and research staff are to be held with the site visitors alone (Program Leadership not needed). Changes to the schedule order should not be made without prior discussion and approval from the PHA PHCC staff. You may adjust the travel schedule/times to allow for adequate time between locations if needed. Appointments 1 2 3 4 5 6 7 8 9 10 11 12 Introductory meeting with Program Leadership Team Introductions, Review Agenda, Program Overview presentation by Program Leadership (10-15 min maximum) Team members: A. PHCC Physician interview with Director(s) Team member: B. PHCC AHCP interview with Coordinator(s) (Please schedule in separate locations) Team member: Identification of charts by site visitors for later review – Program Leadership Team to supply copy of patient roster Team members: Visit to Outpatient Clinic and Interview with Program Outpatient support team (PH support staff, Respiratory Therapy/Pulmonary Rehabilitation) Team members: Site visitor Supporting Document review Interview with Patient Name: Interview with Catheterization Laboratory Director Team member: Break/Travel time Visit to Inpatient Ward and Interview with Program Inpatient support team (PAH Clinical Specialist, Nursing staff, Inpatient Pharmacist) Team members: Lunch with Site Team Team members: Chart Review (12-15 records – see patient roster form) Interview with Clinical Research Support Staff Team members: Length Time 45 min 8:00-8:45AM 30 min 8:45-9:15AM 15 min 9:15-9:30AM 30 min 9:30-10:00AM 30 min 10:00-10:30AM 15 min 10:30-10:45AM 15 min 10:45-11:00AM 15 min 11:00-11:15AM 30 min 11:15-12:15PM 45 min 12:15-1:00PM 60 min 1:00-2:00 PM 15 min 2:00-2:15PM 27 Location 14 Interview with Hospital Administrator Team member: Break/Travel time 15 Site visitors' private review and program discussion 30min 2:45-3:15PM 16 Wrap up meeting with the Program Medical Director and Coordinator to give immediate feedback Team members: 30 min 3:15-3:45PM 13 15 min 2:15-2:30PM 15 min 2:30-2:45PM 28