Business Associate Responsibilities. The Business Associate agrees to:
3.1 Perform an initial HIPAA Security Rule Compliance Self-Assessment.
3.2 Perform an annual HIPAA Security Rule Compliance Self-Assessment and submit a copy to DES.
3.3 Use appropriate safeguards, and comply with the applicable requirements of Subpart C of 45 CFR Part 164 (Security Standards for the Protection of Electronic Health Information) with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by the Agreement or as required by law, for as long as the PHI is within its possession and control, even after the termination or expiration of this Agreement;
3.4 Report to Covered Entity any use or disclosure of PHI not provided for by the Agreement of which Business Associate becomes aware, including breaches of unsecured PHI as required at 45 CFR 164.410, and any security incident of which it becomes aware, within one (1) business day of discovery;
3.4.1 In the event of a breach of PHI or disclosure which compromises the privacy or integrity of PHI obtained from Covered Entity, Business Associate will take all measures required by state and federal law. Business Associate will provide DES with a copy of its investigation results and other information requested by DES. Business Associate will report all PHI breaches to the U.S. Department of Health and Human Services, Office of Civil Rights (“OCR”) as required by 45 CFR Parts 160 and 164, and will also provide notification to the DES representative identified in Section 3.2.3 that a report has been filed with OCR.
3.4.2 Business Associate will notify DES within one (1) business day by telephone and in writing of any acquisition, access, use or disclosure of PHI and/or electronic PHI not allowed by the provisions of this Agreement of which it becomes aware, and of any instance where the PHI is subpoenaed, copied or removed by anyone except an authorized representative of DES or the Business Associate.
3.4.3 Business Associate will notify DES within one (1) business day by telephone or e-mail of any potential breach of security or privacy. Business Associate will follow telephone or e-mail notification with a faxed or other written explanation of the breach, to include the following: date and time of the breach, medium that contained the PHI, origination and destination of PHI, Business Associate unit and personnel associated with the breach, detailed description of PHI, anticipated mitigation steps, and the name, address, telephone numb...
Business Associate Responsibilities. Business Associate agrees to:
4.1 Fully comply with the HIPAA Rules as they apply to Business Associate.
4.2 Not use or disclose PHI except as permitted by this Agreement or as otherwise required by law.
4.3 Use appropriate safeguards to prevent use or disclosure of PHI other than as permitted by this Agreement. Business Associate shall comply with the requirements in 45 CFR Part 164, Subpart C applicable to business associates, including using administrative, physical and technical safeguards to protect electronic PHI. In addition, if Business Associate performs activities related to Covered Entity’s covered accounts as defined in 16 C.F.R.
4.4 Immediately report to Covered Entity’s Privacy Officer any use or disclosure of PHI not permitted by this Agreement or the HIPAA Rules of which Business Associate becomes aware, including reporting breaches of unsecured PHI as required by 45 CFR §164.410, and reporting security incidents as required by 45 CFR
4.5 Mitigate, to the extent practicable, any harmful effect caused by a use or disclosure of PHI by Business Associate in violation of this Agreement.
4.6 Fully cooperate with Covered Entity’s efforts to promptly investigate, mitigate and notify third parties of breaches of unsecured PHI or security incidents as required by the HIPAA Rules.
4.7 Ensure that any subcontractors that create, receive, maintain or transmit PHI on behalf of Business Associate agree to the same restrictions, conditions and requirements set forth in this Agreement and the HIPAA Rules applicable to such subcontractors. Business Associate may fulfill this requirement by executing a written agreement with the subcontractor incorporating the terms of this Agreement and otherwise complying with the requirements in 45 CFR §§164.502(e)(1)(ii), 164.502(e)(2) and 164.308(b)(2),(3).
4.8 To the extent Business Associate maintains a designated record set on behalf of Covered Entity, Business Associate shall make available PHI in a designated record set to Covered Entity, within 10 days of request, to satisfy Covered Entity’s obligations under 45 CFR §164.524. Should Business Associate or its subcontractors receive a direct request from an individual, Business Associate will promptly forward the individual’s request to Covered Entity.
4.9 To the extent Business Associate maintains a designated record set on behalf of Covered Entity, Business Associate shall make any amendment(s) to PHI in a designated record set within 10 days of request, as direct...
Business Associate Responsibilities. Business Associate agrees to:
4.1 Fully comply with the HIPAA Rules as they apply to business associates.
4.2 Not use or disclose protected health information except as permitted by this Agreement or as otherwise required by law.
4.3 Use appropriate safeguards to prevent the use or disclosure of protected health information other than as permitted by this Agreement. Business Associate shall comply with the requirements in 45 CFR Part 164, Subpart C applicable to business associates, including the use of administrative, physical and technical safeguards to protect electronic protected health information and conducting risk assessments of Business Associate’s information technology systems and environment as well as training its personnel regarding the requirements of the HITECH Act, HIPAA Rules, and other applicable law.
4.4 Immediately report to Covered Entity’s Privacy Officer any use or disclosure of protected health information not permitted by this Agreement or the HIPAA Rules of which Business Associate becomes aware, including reporting breaches of unsecured protected health information as required by 45 CFR § 164.410, and reporting security incidents as required by 45 CFR § 164.314(a)(2)(i)(C). Business Associate further agrees to immediately report to Covered Entity’s Privacy Officer any attempted or successful unauthorized access, use, disclosure, modification, or destruction of electronic protected health information or interference with information system operations involving electronic protected health information.
Business Associate Responsibilities. To the extent Business Associate is to carry out Covered Entity’s obligations under the HIPAA Privacy and Security Regulations, Business Associate will comply with the requirements of the HIPAA Privacy Rule that apply to Covered Entity’s compliance with such obligations.
Business Associate Responsibilities. Business Associate may only access, use, or disclose the minimum necessary PHI needed to accomplish the intended functions, services, or activities on behalf of the Agency. Business Associate shall comply with the following requirements:
4.1. Business Associate acknowledges and agrees that it must review, understand, and comply with applicable federal and state confidentiality and security laws; specifically, the provisions of the HIPAA rules at 45 CFR Parts 160, 162, and 164, Fla. Stat. § 501.171, as well as any applicable amendments.
4.2. Business Associate shall familiarize its workforce members with the requirements of this Agreement, shall provide HIPAA training to any member of its workforce that is authorized to access, use, or disclose PHI, and shall develop and implement a sanctions policy in accordance with 45 CFR 164.530(e) for any workforce member, agent, or subcontractor who violates this Agreement or the requirements of HIPAA.
4.3. Business Associate shall not use or disclose PHI other than as permitted or required by the Agency or as required by federal or state law.
4.4. Business Associate will implement and maintain appropriate administrative, technical, and physical safeguards that protect the confidentiality, integrity, and privacy of PHI which Business Associate receives, creates, maintains, or transmits on behalf of the Agency.
4.5. Use appropriate safeguards and comply, where applicable, with Subpart C of 45 CFR Part 164 regarding electronic PHI, to prevent the access, use, or disclosure of PHI for any purpose not in conformity with the functions, service, or activities provided on behalf of the Agency, this Agreement, or federal or state law.
4.6. Business Associate shall make a good faith effort to identify any access, use, or disclosure of PHI that is not authorized under this Agreement nor permitted under the HIPAA rules and report the same to the Agency, including breaches by Business Associate or its subcontractor of unsecured PHI, per 45 CFR §164.410, and any security incidents.
Business Associate Responsibilities. Business Associate agrees to:
a. Fully comply with the HIPAA Rules as they apply to business associates.
b. Not use or disclose protected health information except as permitted by this Agreement or as otherwise required by law.
c. Use appropriate safeguards to prevent the use or disclosure of protected health information other than as permitted by this Agreement. Business Associate shall comply with the requirements in 45 CFR Part 164, Subpart C applicable to business associates, including the use of administrative, physical and technical safeguards to protect electronic protected health information.
