Breach Requirements. 1. Business associate shall comply with Sections 164.308, 164.310, 164.312 and 164.316 of title 45, Code of Federal Regulations as of their respective compliance dates. The business associate’s obligations include but are not limited to the following:
a. Implementing administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the Electronic Health Information that the business associate creates, receives, maintains, or transmits on behalf of the Department in connection with business associate’s performance of the Services as required by HIPAA; and
b. Ensuring that any agent, including a subcontractor, to whom the business associate provides such PHI, agrees to implement reasonable and appropriate safeguards to protect such PHI; and
c. Reporting to the Department any Security Incident affecting PHI of which it becomes aware.
Breach Requirements. 1. Sections 164.308, 164.310, 164.312 and 164.316 of title 45, Code of Federal Regulations, apply to the Agency in the same manner that such sections apply to the Provider. The Agency's obligations include but are not limited to the following:
a. Implementing administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic Protected Health Information that the Agency creates, receives, maintains, or transmits on behalf of the covered entity as required by HIPAA;
b. Ensuring that any agent, including a sub the Agency, to whom the Agency provides such information, agrees to implement reasonable and appropriate safeguards to protect the data; and
c. Reporting to the Provider any security incident of which it becomes aware and conducting the necessary investigation and risk assessment according to 45 CFR § 164.402 to determine if PHI was compromised.
2. Privacy Obligations. To comply with the privacy obligations imposed by HIPAA, the Agency agrees to:
a. Abide by any Individual's request to restrict the disclosure of Protected Health Information consistent with the requirements of Section 13405(a) of the HITECH Act;
b. Use appropriate safeguards to prevent use or disclosure of the information other than as provided for by this Agreement;
c. Report to the Provider any use or disclosure of the information not provided for by the Underlying Agreement of which the Agency becomes aware;
d. Ensure that any agents, including a sub the Agency, to whom the Agency provides Protected Health Information received from the Provider or created or received by the Agency on behalf of the Provider, agrees to the same restrictions and conditions that apply to the Agency with respect to such information;
e. Make available to the Provider within ten (10) calendar days Protected Health Information to comply with an Individual's right of access to their Protected Health Information in compliance with 45 C.F.R. § 164.524 and Section 13405(f) of the HITECH Act;
f. Make available to the Provider within fifteen (15) calendar days Protected Health Information for amendment and incorporate any amendments to Protected Health Information in accordance with 45 C.F.R. § 164.526;
g. Make available to the Provider within fifteen (15) calendar days the information required to provide an accounting of disclosures in accordance with 45 C.F.R. § 164.528 and Section 13405(c) of the HITECH Act;
h. To the ex...
Breach Requirements. 1. Sections 164.308, 164.310, 164.312 and 164.316 of title 45, Code of Federal Regulations, apply to the Vendor in the same manner that such sections apply to the Agency. The Vendor's obligations include but are not limited to the following:
a. Implementing administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic Protected Health Information that the Vendor creates, receives, maintains, or transmits on behalf of the covered entity as required by HIPAA;
b. Ensuring that any agent, including a sub Vendor, to whom the Vendor provides such information ,agrees to implement reasonable and appropriate safeguards to protect the data; and
c. Reporting to the Agency any security incident of which it becomes aware.
