Access of Individuals to Protected Health Information. Individuals have certain rights regarding inspection and copying of their PHI that is contained in a Designated Record Set held by a Covered Entity. A Covered Entity that is a Business Associate of the AGO may ask the AGO to help it comply with its obligations to make PHI in a Designated Record Set held by the AGO available for inspection and copying. All such requests (“Access Requests”) must be made in writing. The AGO will immediately forward all Access Requests to the AGO’s Privacy Officer. If a Business Associate of the AGO asks the AGO to copy the requested PHI, the AGO’s Privacy Officer will first determine whether the AGO has any requested records in a Designated Record Set. If the AGO has such records, then within 14 days of receiving the Access Request, the AGO will provide the requested PHI available to the Business Associate in accordance with 45 C.F.R. §164.524, unless the PHI is subject to the attorney-client privilege, the work-product doctrine, or state or federal laws that are not preempted by the HIPAA Rules. PHI will be sent to a Business Associate via secure email. If the PHI cannot be sent via secure email, the AGO will consult with its Privacy Officer to determine another appropriate means of delivery. If a Business Associate of the AGO asks the AGO to provide the requested PHI to the individual requestor, the AGO may, in its sole discretion, agree to such a request. If it agrees, then within 20 days of receiving an Access Request, the AGO will provide the requested PHI directly to the individual in accordance with 45 C.F.R. §164.524, unless the PHI is subject to the attorney-client privilege, the work-product doctrine, or state or federal laws that are not preempted by the HIPAA Rules. If it does not agree, the AGO will provide the PHI to the Business Associate as discussed in the immediately preceding paragraph. PHI sent to an individual pursuant to this Policy will be sent via secure email. If the PHI cannot be sent via secure email, the AGO will consult with its Privacy Officer to determine another appropriate means of delivery. The AGO may, in its discretion, charge a Business Associate or an Individual a reasonable, cost-based fee for the production of PHI in accordance with 45 C.F.R. §164.524(c)(4). If an individual or a Covered Entity that is a Business Associate of the AGO asks the AGO to allow an individual access to PHI in a Designated Record Set held by the AGO, the AGO will provide the PHI to the Business Associate and allow the Business Associate to determine how best to provide the individual with access to the PHI.
Appears in 4 contracts
Samples: Agreement, General And, procure.ohio.gov
