Business Associate agrees to not use or disclose PHI of Covered Entity other than as permitted or required by this Agreement or as required by law.
Business Associate agrees to use appropriate safeguards and to comply with the Security Rule with respect to EPHI to prevent use or disclosure of the PHI other than as provided for by this Agreement.
In the event that Business Associate transmits EPHI on behalf of Covered Entity via electronic mail over the Internet, Business Associate agrees to the extent deemed reasonable and appropriate by Business Associate that such EPHI shall be secured by an encryption technology that renders EPHI unusable, unreadable, or indecipherable to unauthorized individuals in accordance with the guidance of a standards developing organization that is accredited by the American National Standards Institute; unless otherwise required by the Secretary to meet an alternative standard.
Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate, or a Subcontractor of Business Associate, in violation of the requirements of this Agreement.
Business Associate agrees to report to Covered Entity:
Within ten (10) Days, any use or disclosure of PHI by the Business Associate not provided for by this Agreement of which it becomes aware.
Within ten (10) Days, any Security Incident of which it becomes aware that results in an unauthorized access, use modification, destruction or disclosure of EPHI or interference with information systems for EPHI.
Within ten (10) Days of receipt of a written request from Covered Entity, any Security Incident of which it becomes aware that was an unsuccessful attempt to obtain unauthorized access, use modification, destruction or disclosure of EPHI or interference with information systems for EPHI.
If Business Associate makes a Discovery of a Breach of Covered Entity’s Unsecured PHI that is created, received, maintained, transmitted, used or disclosed by Business Associate in any manner arising out of this Agreement, Business Associate shall timely notify Covered Entity as provided in subsection (f) of this Section 2.
Following Discovery of a Breach of Covered Entity’s Unsecured PHI, Business Associate without unreasonable delay, but in no case later than thirty (30) Days, shall provide written notice to Covered Entity setting forth the information described in subsection (g) of this Section 2. In the event that Business Associate discovered what may be considered a “Breach”, Business Associate shall use business care and prudence to satisfy itself based upon reasonable diligence that the acquisition, access, use, or disclosure of PHI was not unintentional or inadvertent and that Business Associate cannot affirmatively demonstrate that there is a low probability that the security or privacy of the PHI has been compromised.
Notwithstanding any other provision of this Agreement, Business Associate agrees within thirty (30) Days of receipt of documentation from Covered Entity to reimburse Covered Entity for any and all reasonable expenses (e.g., cost of mailing, media, credit monitoring, etc.) incurred by Covered Entity in carrying out the obligations of Covered Entity under the HIPAA Regulations to notify individuals affected by a Breach of Business Associate. In the alternative and upon agreement of the Parties, Business Associate may directly undertake such obligations and expenses in lieu of the herein provide reimbursement.
Business Associate’s written notification shall provide the following information:
To the extent possible, the names of each individual whose Unsecured PHI has been, or is reasonably believed to have been accessed, acquired, used or disclosed during the Breach;
A brief description of what happened, including the date of the Breach and the date of the discovery of the Breach, if known;
A description of the types of Unsecured PHI that were involved in the Breach (such as whether full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved);
Any steps individuals should take to protect themselves from potential harm resulting from the Breach;
A brief description of what the Business Associate is doing to investigate the Breach, to mitigate harm to individuals, and to protect against any further Breaches; and
Contact procedures for individuals to ask questions or learn additional information, which shall include a toll free telephone number, an e-mail address, Web site, or postal address.
If Business Associate has been requested orally or in writing by law enforcement officials that notification of affected individuals may impede a criminal investigation, Business Associate shall so inform Covered Entity.
Reporting a Security Incident or a use or disclosure of PHI not provided for in this Agreement shall not discharge Business Associate’s obligations under this Agreement to report a Breach unless such reporting fully and completely satisfies all of the Breach reporting requirements of this Agreement.
In accordance with 45 C.F.R 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. With respect to EPHI, Business Associate will ensure that any Subcontractor of Business Associate that creates, receives, maintains, or transmits EPHI on behalf of Business Associate agrees to use appropriate safeguards and comply with the Security Rule with respect to EPHI to prevent use or disclosure of the PHI other than as provided for by this Agreement.
When Business Associate maintains PHI in a Designated Record Set, including but not limited to an electronic Designated Record Set, Business Associate agrees to provide access to and copies of PHI maintained in any Designated Record Set to Covered Entity or, when requested in writing by Covered Entity, to an Individual in order for Covered Entity to meet the requirements of 45
C.F.R. 164.524. Business Associate shall provide access to and copies of PHI in a reasonable time, not to exceed fifteen (15) Days [unless Business Associate and Covered Entity reasonably agree otherwise in writing]; and, in a reasonable manner.
Business Associate agrees to make its internal practices, books, and records relating to the use and disclosure of PHI receiving from, or created, transmitted or received by Business Associate on behalf of Covered Entity, available to the Secretary, in the time and manner designated by the Secretary, for purposes of the Secretary determining Covered Entity’s compliance with the HIPAA Regulations. Upon receipt of a request from the Secretary, Business Associate shall notify Covered Entity in writing unless such notification would be contrary to law.
Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that Covered Entity determines is required to enable Covered Entity to comply with 45 C.F.R. 164.526. Except for good cause shown in writing to Covered Entity, Business Associate shall act upon Covered Entity’s request for an amendment within fifteen (15) Days of receipt of Covered Entity’s request.
Business Associate agrees to identify, track and document such disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 C.F.R. 164.528.
Business Associate agrees to provide to Covered Entity or to an Individual, in writing and not later than thirty (30) Days after receiving a request under this subsection (o), information collected in accordance with the foregoing subsection (n) of this Section 2 of this Agreement, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. 164.528.
To the extent the Business Associate is to carry out one or more of Covered Entity’s obligation(s) under the Privacy Rule, Business Associate agrees to comply with the requirements of the Privacy Rule that apply to the Covered Entity in the performance of such obligation(s).
Business Associate shall only request, use and disclose the minimum amount of PHI necessary to reasonably accomplish the purpose of the request, use or disclosure in accordance with 45
C.F.R. 164.502(b). Further, Business Associate will restrict PHI to those employees of Business Associate or other workforce members under the control of Business Associate who are actively and directly participating in providing goods and/or services under the Agreement of the Parties and who need to know such information in order to fulfill such responsibilities.
