Business Associates Responsibilities. With respect to any use and/or disclosure of PHI, Business Associate hereby agrees that it shall:
a) use and/or disclose PHI only as permitted or required by this Agreement, as required by the Privacy Rule or as otherwise Required by Law.
b) at all times after the effective date of Section 13405 of American Recovery and Reinvestment Act (“ARRA”), the uses, disclosures, or requests for the PHI described herein shall be limited to a Limited Data Set or the minimum necessary (as may be described by the Secretary in guidance under Section 13424(c) of the ARRA) to accomplish the intended purpose of such use, disclosure, or request.
c) implement comprehensive procedures for mitigating any harmful effects from any unauthorized use and/or disclosure of PHI by Business Associate, its agents or subcontractors.
d) report to Business Associate’s designated Privacy Officer, in writing, any use and/or disclosure of PHI that is not authorized hereunder of which Business Associate becomes aware within one (1) day of Business Associate’s discovery of such unauthorized use and/or disclosure. Business Associate’s report of such unauthorized use and/or disclosure shall specify at least, (i) the nature of the unauthorized use and/or disclosure; (ii) the specific PHI that was disclosed; (iii) the party responsible for making the unauthorized use and/or disclosure; (iv) what, if any actions Business Associate has taken or will take to limit the extent of the unauthorized use(s) and/or disclosure(s), and to mitigate the damage resulting therefrom; (v) what, if any corrective actions Business Associate has or will take to prevent further unauthorized uses and/or disclosures; (vi) when such corrective measures will be taken (if they have not already been completed), and, as applicable, an explanation of why they have not already been completed; and (vii) provide HMO with any other information HMO reasonably requests.
e) develop, implement, maintain and utilize appropriate administrative, technical and physical safeguards, in compliance with the Social Security Act § 1173(d) (42 U.S.C. § 1320d-2(d)), the Privacy Rule, and any other regulations now in effect or later issued by HHS which implement HIPAA, to preserve the integrity and confidentiality of, and to prevent unauthorized use and/or disclosure of PHI.
f) require any of its subcontractors and/or agents, that receive, use or have any access to PHI as authorized by this Agreement, to enter into a written agreement, which agreeme...
Business Associates Responsibilities. With respect to any use and/or disclosure of EPHI, Business Associate agrees that it shall:
a) implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of EPHI that Business Associate creates, receives, maintains, or transmits on behalf of HMO. Business Associate shall be responsible for ensuring that such safeguards are adequate to comply with the requirements of the Security Rule.
b) ensure that any agent to whom it provides EPHI, including a subcontractor, agrees to implement reasonable and appropriate safeguards to protect such EPHI.
c) report to HMO, in writing, any Security Incident within three (3) business days of becoming aware of such Security Incident. Without limiting the foregoing, Business Associate shall report to HMO regarding whether such Security Incident has resulted in a breach of the Security Rule. Moreover, effective 30 days after the publication of interim final regulations regarding the breach provisions under the ARRA, in the event that Business Associate becomes aware or reasonably should be aware that any of the PHI that is “unsecured protected health information” within the meaning of the ARRA or the regulations has been subject to a “breach,” as that term is defined by ARRA and its regulations, in the time and manner as described or defined by the regulations. Such notification shall include the identification of each individual who has been or is reasonably believed to have been affected by the breach. Business Associate’s notification to HMO shall be provided in accordance with the ARRA, the regulations, and any guidance that may be provided by the Secretary of HHS.
d) provide the Secretary of HHS with access to all records, books, agreements, policies and procedures relating to the use and/or disclosure of EPHI for compliance investigations.
e) within ten (10) days of receipt of a written request, provide HMO with access to all records, books, agreements, policies and procedures relating to the use and/or disclosure of EPHI for purposes of enabling HMO to determine Business Associate’s compliance with the terms of this Agreement. Such access shall be at Business Associates place of business during routine operating hours.
Business Associates Responsibilities
