BA Obligations. The parties agree that BA shall:
2.1. Not use or disclose PHI other than as permitted by this Addendum, the Underlying Agreement, the Privacy Rule, or as Required By Law;
2.2. Use appropriate safeguards to prevent the use or disclosure of PHI other than as provided for by this Addendum. BA shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of Electronic PHI that it creates, receives, maintains, or transmits on behalf of Covered Entity. BA shall comply with the applicable requirements of Subpart C of Part 164 of the Security Rule;
2.3. Limit any uses, disclosures, and requests for PHI to the minimum amount necessary to perform or fulfill a specific function required or permitted by this Addendum in accordance with the HIPAA Rules;
2.4. Mitigate to the extent practicable, any harmful effect that is known to BA from a use or disclosure of PHI by BA in violation of this Addendum;
2.5. Timely report to Covered Entity any use or disclosure of PHI of which BA becomes aware that is not provided for or allowed by this Addendum or the HIPAA Rules, including Breaches of Unsecured PHI that BA discovers as required by, and in the manner set forth at, 45 C.F.R. § 164.410, and any Security Incident of which BA becomes aware. The parties acknowledge and agree that this section constitutes notice by BA to Covered Entity of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined below) for which no additional notice to Covered Entity shall be required. “Unsuccessful Security Incidents” shall include, but are not limited to, pings and other broadcast attacks on BA’s firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as no such incident results in unauthorized acquisition, access, use, or disclosure of PHI;
2.6. In accordance with 45 C.F.R. §§ 164.308(b)(2) and 164.502(e)(1)(ii), require any of its agents or subcontractors that maintain, create, receive, and/or transmit PHI on behalf of BA to agree, in writing, to the same restrictions, conditions and obligations with respect to the use and disclosure of PHI that apply to BA under this Addendum;
2.7. Make available to Covered Entity such information in such form as Covered Entity may require to fulfill Covered Entity’s obligations to provide an Individual with access to, amendment of, and an accounting of disclosures of...
BA Obligations. BA may receive from CE, or create or receive or maintain on behalf of CE, health information that is protected under applicable state and/or federal law, including without limitation, PHI and EPHI. All references to PHI herein shall be construed to include EPHI. BA agrees not to use or disclose (or permit the use or disclosure of) PHI in a manner that would violate HIPAA, the HITECH Act, or Applicable Law if the PHI were used or disclosed by CE in the same manner.
BA Obligations. BA covenants and agrees that it shall:
(1) Not use or further disclose PHI other than as permitted or required under the Agreement or this Addendum, or as required by applicable law or regulation.
(2) Use appropriate safeguards, including written policies and procedures, and comply with Subpart C of 45CFR Part 164 with respect to electronic protected health information, to prevent the use or disclosure of PHI other than as permitted under the Agreement or this Addendum.
(3) BA shall maintain a written information security program that includes administrative, technical, and physical safeguards to maintain the security of and prevent unauthorized access to PHI within BA’s possession, custody or control.
(4) Report to EMSI any use or disclosure of PHI not provided for by the Agreement or this Addendum of which it becomes aware, including suspected breaches of unsecured PHI, as required at 45 CFR 164.410, and any security incident of which it becomes aware.
(5) In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any of its employees, agents, contractors and subcontractors that have access to, receive, create, maintain, or transmit PHI on behalf of BA agree in writing to adhere to all of the same obligations, restrictions and conditions that apply to BA under this Addendum.
(6) As requested by EMSI, make available to EMSI or its customers, or through its customers, to individuals or individuals’ designees, any PHI within a Designated Record Set then within BA’s possession or control, as necessary to fulfill EMSI’s customers’ obligations to provide amendments or access to PHI under 45 CFR 164.524 and 164.526.
(7) As requested by EMSI, maintain an accounting of any and all disclosures of PHI by BA and its employees, contractors, subcontractors, and agents, and make such accounting of information available to EMSI or its customers, or through its customers, to individuals, or individual’s designees, as necessary to satisfy EMSI’s obligations under 45 CFR 164.528.
(8) As requested by EMSI, make available to EMSI, its customers or the Secretary of the U.S. Department of Health and Human Services all internal practices, books and records relating to the use and disclosure of PHI received, accessed, provided to, or created by BA, for purposes of determining compliance with federal privacy laws and regulations.
(9) Disclose to its employees, contractors, subcontractors, agents or other third parties, and request from EMSI or its c...
BA Obligations. BA covenants and agrees that it shall:
(1) Not use or further disclose PHI other than as permitted or required under this Addendum or as required by applicable law or regulation.
(2) Use safeguards, including written policies and procedures, to prevent the use or disclosure of PHI other than as permitted under this Addendum.
(3) BA shall maintain a written information security program that includes administrative, technical, and physical safeguards to maintain the security of and prevent unauthorized access to PHI within BA’s possession, custody or control.
(4) Require all of its employees, agents and contractors that have access to PHI to agree, in writing, to adhere to all of the same obligations, restrictions and conditions that apply to BA under this Addendum.
(5) As requested by FTS, make available to FTS or its customers any and all information then within BA’s possession involving PHI, FTS’s customers and/or Individuals toward fulfilling FTS’s customers’ obligations to provide, amend or account for PHI.
(6) As requested by FTS, make available to FTS, its customers or the Secretary of the U.S. Department of Health and Human Services all internal practices, books and records then within BA’s possession relating to the use and disclosure of PHI received or created by BA, for purposes of determining FTS’s customers’ compliance with federal privacy laws and regulations.
(7) Disclose to its employees, contractors, agents or other third parties, and request from FTS or its customers, only the minimum Protected Health Information necessary to perform or fulfill a specific function required or permitted by this Addendum.
(8) Maintain an accounting of any and all disclosures of PHI by BA and its employees, agents and/or contractors.
(9) Notify FTS of any and all requests for PHI received, and violations of the provisions of this Addendum, by BA or its employees, agents or contractors upon BA becoming aware of them.
