Obligations and Activities of Business Associate. a. Business Associate agrees to not Use or Disclose PHI other than as permitted or required by the Service Agreement or as Required by Law. b. Business Associate shall use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use or Disclosure of PHI other than as provided for by this Agreement. c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware. d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations. e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410. f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410. g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion. h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies. i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP. j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions. k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements. l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524. m. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX. n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination. o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM. q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation. r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310. s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 4 contracts
Samples: Business Associate Agreement, Business Associate Agreement, Business Associate Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use or Disclose PHI other than comply with those provisions of the Security Rule that are set forth at 45 C.F.R. §§ 164.308, 164.310, 164.312, and 164.316, as permitted or required by amended from time to time, with respect the Service Agreement or as Required by Lawsecurity of PHI, in the same manner that such regulations apply to the Provider.
b. Business Associate agrees to comply with the Privacy Rule at 45 C.F.R. § 164.504(e), as amended from time to time, with respect to its use and disclosure of PHI, in the same manner that such regulation applies to Provider. The additional requirements of the HITECH Act that relate to privacy and that are made applicable with respect to covered entities shall also be applicable to Business Associate and shall be and by this reference hereby are incorporated into the Business Associate Agreement.
c. Business Associate agrees to not use or further disclose PHI other than as specifically permitted or required by this Agreement or as required by law.
d. Business Associate agrees to use appropriate safeguards and comply comply, where applicable, with Subpart C of 45 C.F.R. CFR Part 164 with respect to electronic PHI (ePHI) Electronic PHI, to prevent Use use or Disclosure disclosure of PHI other than as provided for by this Agreement.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. e. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsAgreement.
e. f. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery report to Provider if it becomes aware of any actual use or suspected disclosure of PHI not provided for by this Agreement, including any Breach of Unsecured PHIPHI as required by 45 CFR 164.410, all in accordance with 45 C.F.R. § 164.410and any Security Incident of which it becomes aware. The notification shall include, Notwithstanding anything herein to the extent possible and subsequently as the information becomes availablecontrary, the identification of all Individuals whose Unsecured PHI is reasonably believed by parties acknowledge and agree that this Agreement shall constitute notice to Provider that Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individualmay periodically experience broadcast attacks on its firewall, HHSport scans, and/or the mediaunsuccessful log-on attempts, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOMdenials of service and similar unsuccessful security incidents, and Business Associate agrees need not further report such incidents to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use Provider so long as such incidents do not result in unauthorized access, use or Disclosure disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410PHI.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will on behalf of Provider agree to comply with the applicable requirements of the Security Rule same restrictions and Privacy Rule by entering into a conditions that apply to Business Associate Agreement and Business Associate shall provide DOM with a copy respect to such information, including, without limitation, implementation of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior appropriate safeguards to disclosing any protect the security of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreementsElectronic PHI.
l. h. Upon the written request of Provider, Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, access to Provider to PHI that Business Associate maintains in a Designated Record SetSet (if in fact its arrangements with Provider require Business Associate to maintain Designated Record Sets on behalf of Provider), to DOM or, as directed by XXX, to an Individual in order for Provider to meet the Patient access and copying requirements under 45 CFR § 164.524. If Business Associate maintains an electronic health record which contains the PHI, Business Associate shall provide such information produced in accordance with this section 2(h) in electronic format to enable Provider to fulfill its obligations under applicable regulations.
m. i. Upon the written request of Provider, Business Associate agrees to make any amendment(s) to PHI that Business Associate maintains in a Designated Record Set (if in fact its arrangements with Provider require Business Associates to maintain Designated Record Sets on behalf of Provider), that DOM the Provider directs or agrees to pursuant to 45 CFR § 164.526 164.526.
j. Business Associate agrees to make its internal practices, books and records relating to the use and disclosure of PHI available at the request of DOM the Provider to the Secretary, for purposes of determining Provider’s compliance with the Privacy Rule, subject to attorney-client or an Individual, and in the time and manner designated by XXXother applicable legal privileges.
n. k. Business Associate agrees to document such Disclosures disclosures of PHI and information related to such Disclosures disclosures as would be required for DOM Provider to respond to a request by an Individual Patient for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees , as may be amended from time to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of terminationtime.
o. l. Upon written request of Provider, Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, Provider with information collected in accordance with section (III)(h) Section II.i. of this Agreement, Agreement to permit XXX Provider to respond to a request by an Individual Patient for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. m. Business Associate agrees that to the extent that Business Associate carries it is to carry out DOMProvider’s obligations obligation under the Privacy Rule, Business Associate Rule that it will comply with the requirements of the Privacy Rule that apply to DOM Provider in the performance of such obligation.
r. n. Business Associate agrees to make internal practicesnotify Provider without unreasonable delay, books, and records, including policies and procedures, available but in no event more than 60 days after Business Associate becomes aware of an unauthorized use or disclosure by or on behalf of Business Associate which constitutes a Breach of Unsecured PHI unless it receives a request to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule delay such notification from a law enforcement official pursuant to 45 C.F.R. § 160.310CFR 164.412. Such notification shall include a list of impacted Patients, and describe the Breach in such reasonable detail.
s. o. Upon written request of Provider, Business Associate agrees will comply with a Patient request for restriction of certain disclosures to health plans in accordance with 45 CFR 164.522 and the HITECH Act, if the disclosure is to a health care plan for the purposes of carrying out payment or health care operations and the PHI pertains solely to a health care item or service for which Patient has paid for out of pocket in full. Except to the extent that nothing in this Agreement shall permit Provider must agree to a Patient request for restriction under the HITECH Act, Business Associate shall not be required to access, store, share, maintain, transmit or comply with a Patient’s request to restrict the use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction disclosure of the United States without express written authorization from DOMPHI.
Appears in 4 contracts
Samples: Business Associate Agreement, Business Associate Agreement, Business Associate Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use or further Disclose PHI other than as permitted or required by the Service Agreement this BAA or as Required required by Lawlaw.
b. Business Associate shall agrees to use appropriate safeguards safeguards, and comply comply, as applicable, with Subpart C of 45 C.F.R. Part CFR §164 with respect to electronic PHI (ePHI) PHI, to prevent Use Uses or Disclosure Disclosures of the PHI other than as provided for by this BAA or the Agreement; however, the parties acknowledge and agree it shall be the responsibility of Customer and not Business Associate to comply with requirements under 45 CFR §164.312 to implement encryption or decryption mechanisms for electronic PHI maintained on physical media (e.g. tapes) stored by Customer with Business Associate.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discoverypromptly report to Customer any Security Incident, of any Breach, or other Use or Disclosure of PHI not provided for by this Agreement of which it becomes awareaware that is not permitted or required by this BAA or the Agreement. In the event of a Breach, such notification shall be made in accordance with and as required of a business associate by the HIPAA Rules, including without limitation pursuant to 45 CFR 164.410, but in no event more than three (3) business days after Business Associate has completed its internal investigation and confirmed a Breach as occurred. Business Associate will provide reasonable assistance and cooperation in the investigation of any such Breach and shall document the specific Deposits which have been compromised, the identity of any unauthorized third party who may have accessed or received the PHI, if known, and any Security Incident actions that have been taken by Business Associate to mitigate the effects of which it becomes awaresuch Breach.
d. Business Associate agrees to mitigateshall, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ CFR 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to as applicable, ensure that any subcontractors business associate that createis a subcontractor that creates, receivereceives, maintainmaintains, or transmit protected health information transmits PHI on behalf of the Business Associate agree for the purpose of assisting in providing services pursuant to the Agreement, agrees to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. PHI through this BAA.
e. If Business Associate agrees has custody of PHI in a Designated Record Set with respect to ensure that any Subcontractors that createIndividuals, receiveand if Customer so requests, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, access to such PHI to Customer by retrieving and in the time and manner designated by XXX, to delivering such PHI in a Designated Record Setaccordance with the terms and conditions of the Agreement, to DOM or, as directed by XXX, so that Customer may respond to an Individual in order to meet the requirements under of 45 CFR § §164.524.
m. f. Business Associate agrees to make any amendment(s) that if an amendment to PHI in a Designated Record Set in the custody of Business Associate is required, and if Customer instructs Business Associate to retrieve such PHI in accordance with the Agreement, Business Associate shall perform such service so that DOM directs Customer may make any amendment to such PHI as may be required by either Customer or agrees to an Individual pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX§164.526.
n. g. Business Associate agrees to document such and make available to Customer the information required to provide an accounting of Disclosures of PHI and PHI, provided that Customer has provided Business Associate with information related sufficient to enable Business Associate to determine which records or data received from or on behalf of Customer by Business Associate contain PHI. The documentation of Disclosures shall contain such Disclosures information as would be required for DOM Customer to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. §164.528 or other provisions of the HIPAA Rules.
h. Business Associate agrees shall promptly notify Customer of any requests by Individuals for access to retain or knowledge or correction of PHI, without responding to such documentation requests, and Customer shall be responsible for at least six (6) years after the date of disclosure or provide a full accounting receiving and relevant documentation responding to DOM at the time of terminationany such Individual requests.
o. i. To the extent the Business Associate agrees is to provide to DOM carry out one or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(hmore of Customer's obligation(s) under Subpart E of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule§164, Business Associate will shall comply with the requirements of the Privacy Rule Subpart E that apply to DOM Customer in the performance of such obligationobligation(s).
r. Business x. Xxxxxxxx Associate agrees to make its internal practices, books, and records, including policies and procedures, records available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310HIPAA Rules.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 4 contracts
Samples: Terms and Conditions of Service, Terms and Conditions of Service, Terms and Conditions of Service
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use use or Disclose PHI disclose Protected Health Information other than as permitted or required by the Service this Agreement or as Required by By Law.
b. , or if such use or disclosure does not otherwise cause a Breach of Unsecured Protected Health Information. Business Associate agrees that 45 CFR §§ 164.308, 164.310, 164.312, and 164.316 shall apply to Business Associate in the same manner that such sections apply to Covered Entity, and that Business Associate shall use appropriate administrative, physical, and technical safeguards and comply in compliance with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) the Security Rule, to prevent Use use or Disclosure disclosure of PHI the Protected Health Information other than as provided for by this Agreement.
c. . Business Associate shall ensure that all Protected Health Information is Secured. The written policies and procedures and documentation required by 45 CFR § 164.316 shall be made available to Covered Entity, upon Covered Entity’s request. Business Associate shall comply with all the obligations required of a Business Associate under the HITECH Act. The additional requirements of the HITECH Act that relate to privacy and security and that are made applicable with respect to covered entities shall also be applicable to Business Associate and shall be and by this reference hereby are incorporated into this Agreement. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to promptly mitigate, to the extent practicableRequired by Law with respect to Business Associate, any harmful effect that is known to Business Associate as a result of a Use use or Disclosure disclosure of PHI Protected Health Information by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence Agreement, or that would otherwise cause a Breach of any Incident, including any action required by applicable federal and state laws and regulations.
e. Unsecured Protected Health Information. Business Associate agrees to notify DOM without unreasonable delayimmediately report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement. Business Associate agrees, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §CFR § 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees ) to ensure that any subcontractors that createagent, receiveincluding Subcontractors, maintainto whom it provides Protected Health Information in any form, including electronic form, created, maintained, transmitted, or transmit protected health information received by Business Associate from or on behalf of the Business Associate agree Covered Entity agrees in writing to the same restrictions, conditions, and requirements that apply through to Business Associate with respect to such information. Moreover, Business Associate agrees to shall ensure that any Subcontractors that createsuch agent or Subcontractor agrees to implement reasonable and appropriate safeguards to protect the Covered Entity’s Protected Health Information. Notwithstanding anything to the contrary in this BAA, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy not use any agent or Subcontractor to perform any service requiring access to Protected Health Information without the express written consent of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any an authorized representative of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this AgreementCovered Entity. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide prompt access, at the request of XXX, and in the time and manner designated by XXX, Covered Entity to PHI Protected Health Information in a Designated Record Set, to DOM Covered Entity, or, as if directed by XXXCovered Entity, to an Individual Individual, in order to meet the requirements under 45 CFR § 164.524.
m. . If an Individual requests directly from Business Associate (i) to inspect or copy his or her Protected Health Information, or (ii) requests its disclosure to a third party, the Business Associate shall promptly notify Covered Entity in writing of such request. Business Associate also agrees to comply with an Individual’s request to restrict the disclosure of his or her personal Protected Health Information in a manner consistent with 45 CFR § 164.522, except where such use, disclosure or request is required or permitted under applicable law. Business Associate further agrees that when requesting, using or disclosing Protected Health Information in accordance with 45 CFR § 502(b)(1) that such request, use or disclosure shall be to the minimum extent necessary, including the use of a “limited data set” as defined in 45 CFR § 164.514(e)(2), to accomplish the intended purpose of such request, use or disclosure, as interpreted under related guidance issued by the Secretary from time to time. Business Associate agrees to promptly make any amendment(s) to PHI Protected Health Information in a Designated Record Set that DOM the Covered Entity directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and Covered Entity in the time and manner designated as mutually agreed by XXX.
n. the parties, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR § 164.526. Business Associate agrees to make its internal practices, books, and records, including its policies and procedures, relating to the use and disclosure of Protected Health Information and Breach of any Unsecured Protected Health Information created, transmitted, or received by Business Associate from or on behalf of Covered Entity, available to Covered Entity or the Secretary, in a time and manner designated by Covered Entity or the Secretary, for purposes of Covered Entity or the Secretary determining compliance with the Privacy Rule. Business Associate agrees to account for and document such Disclosures disclosures of PHI Protected Health Information, Breaches of Unsecured Protected Health Information, and information related to such Disclosures disclosures as would be required for DOM Covered Entity to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI Protected Health Information in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to promptly provide to DOM Covered Entity or an Individual, in a time and manner designated by DOM, Individual information collected in accordance with section (III)(hSection 2(j) of this AgreementBAA, to permit XXX Covered Entity to respond to a request by an Individual or the Secretary for an accounting of disclosures of Protected Health Information and Breaches of Unsecured Protected Health Information. To the extent that Business Associate is to carry out one or more of Covered Entity’s obligation(s) under Subpart E of 45 CFR Part 164, Business Associate agrees to comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such obligation(s). Business Associate hereby represents and warrants that to the extent it is transmitting a financial or administrative transaction described in the Regulations (each a “Transaction”) for Covered Entity, the format and structure of such transmissions shall be in compliance with the Transaction Standards. With respect to any such Transactions, neither party shall: (i) change the definition, data, condition, or use of a data element or segment in a Transaction Standard; (ii) add any data elements or segments to the maximum defined data set; (iii) use any code or data elements that are either marked “not used” in the Transaction Standard’s implementation specification or are not in the Transaction Standard’s implementation specification(s); or (iv) change the meaning or intent of the Transaction Standard’s implementation specification(s). With respect to Electronic Protected Health Information, Business Associate will: Implement, in compliance with the requirements of the Security Rule, administrative, physical, and technical safeguards to reasonably and appropriately protect the confidentiality, integrity, and availability of the Electronic Protected Health Information it creates, transmits, maintains, or receives from or on behalf of Covered Entity; Ensure that any agent, including a Subcontractor, to whom Business Associate provides Electronic Protected Health Information agrees in writing to implement reasonable and appropriate safeguards to protect such information in compliance with the Security Rule; Business Associate acknowledges that, effective on the Effective Date of this BAA, (x) the foregoing safeguards, policies and procedures requirements shall apply to Business Associate in the same manner that such requirements apply to Covered Entity, and (y) Business Associate shall be liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. 1320d-5 and 1320d-6, as amended from time to time, for failure to comply with the safeguards, policies and procedures requirements and any guidance issued by the Secretary from time to time with respect to such requirements; Report to Covered Entity any Security Incident of which Business Associate becomes aware, including any failure of safeguards or unauthorized access to Electronic Protected Health Information. Business Associate agrees to account for and document any disclosure of Protected Health Information used or maintained as Electronic Protected Health Information and Breaches of Unsecured Protected Health Information in electronic form in a manner consistent with 45 CFR § 164.528 as would be required for Covered Entity to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI Protected Health Information. Business Associate agrees to promptly provide to Covered Entity, or an Individual, information collected in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use this paragraph, to permit Covered Entity to respond to a request by an Individual or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service AgreementsSecretary for an accounting of disclosures of Protected Health Information and Breaches of Unsecured Protected Health Information. Business Associate agrees to comply with the “Prohibition on Sale of Electronic Health Records or Protected Health Information,” as provided in section 13405(d) of Subtitle D (Privacy) of the HITECH Act, and the “Conditions on Certain Contacts as Part of Health Care Operations,” as provided in section 13406 of Subtitle D (Privacy) of the HITECH Act and related guidance issued by the Secretary from time to time. Business Associate acknowledges that, effective on the Effective Date of this BAA, it shall be liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. 1320d-5 and 1320d-6, as amended, for failure to comply with any of the use and disclosure requirements of this BAA and any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, from time to time with respect to such use and any minimum necessary policies and procedures communicated to Business Associate by DOMdisclosure requirements.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 3 contracts
Samples: Hosted Information Technology Services Agreement, Professional Information Technology Consulting Services Agreement, Standard Services Agreement
Obligations and Activities of Business Associate. a. 1. Business Associate agrees to not Use use or Disclose disclose PHI other than as permitted or required by the Service Agreement this BAA or as Required by Law.
b. 2. Business Associate shall agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. CFR Part 164 with respect to electronic PHI (ePHI) protected health information to prevent Use the use or Disclosure disclosure of PHI other than as provided for by this AgreementBAA. Business Associate shall implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of any paper or electronic PHI it creates, receives, maintains, or transmits on behalf of Covered Entity.
c. 3. Business Associate agrees shall have procedures in place to notify DOM without unreasonable delay mitigate and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsBAA.
e. 4. Business Associate agrees to notify DOM without unreasonable delayreport immediately, and but no later than seventy-two three (723) hours after discovery days, to Covered Entity any use or disclosure of PHI not provided for by this BAA of which it becomes aware including breaches of unsecured protected health information as required at 45 CFR 164.410, and any actual or suspected security incident of which it becomes aware Breach of Unsecured PHI, all notification will be written in accordance with 45 C.F.R. § 164.410. The notification shall plain language and will include, to the extent possible and subsequently as the information becomes or available, the following:
a. The identification of all Individuals the individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in been, accessed, acquired or disclosed during the notification to Breach;
b. A brief description of what happened, including the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one date of the exceptions to Breach and the definition date of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the IncidentBreach;
c. A description of the types of Unsecured Protected Health Information that were involved in the Breach (such as whether the full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved);
d. Any steps Individuals who were subjects of the Breach should take to protect themselves from potential harm that may result from the Breach;
e. A brief description of what Business Associate is doing to investigate the Breach, to mitigate the harm to individuals, and perform such notifications if so required by DOM in its sole discretionto protect against further Breaches; and
f. Contact procedures for individuals to ask questions or learn additional information, including a toll-free telephone number, an email address, Web site, or postal address.
h. 5. Business Associate agrees to be solely responsible will pay or reimburse Covered Entity for all costs and expenses penalties incurred as by Covered Entity in connection with any incident giving rise to a result Breach of an IncidentPHI and/or a Breach of System Security, including without limitation all costs associated with mitigation of the Incident and preparation and delivery of related to any investigation, any notices to affected individuals be given, reasonable legal fees, credit monitoring (where applicable), and government agenciesother efforts to mitigate the harm to Individuals or other actions taken to comply with HIPAA, the HITECH Act, or any other applicable law or regulation, where (i) the PHI was in the custody or control of Business Associate when the Breach of PHI and/or Breach of System Security occurred, or (ii) the Breach of PHI and/or Breach of System Security was caused by the negligence or wrongful acts or omissions of Business Associate and its employees, directors, officers, subcontractors, agents or other members of its workforce.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), 6. Business Associate agrees to ensure that any agents or subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate the business associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. 7. Business Associate agrees to provide access, at the request of XXXCovered Entity, and in the a reasonable time and manner designated by XXXmanner, to PHI in a Designated Record Set, to DOM Covered Entity or, as directed by XXXCovered Entity, to an Individual Individual, in order to meet the requirements under 45 CFR § 164.524.
m. 8. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM the Covered Entity directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM Covered Entity or an Individual, and in the a reasonable time and manner designated by XXXmanner.
n. 9. Business Associate agrees to make internal practices, books, and records including policies and procedures and PHI relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of, Covered Entity available to the Secretary, in a reasonable time and manner, for the purpose of permitting the Secretary to determine Covered Entity's compliance with the HIPAA Rules.
10. Business Associate agrees to document such Disclosures disclosures of PHI and information related to such Disclosures disclosures as would be required for DOM Covered Entity to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § §164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. 11. Business Associate agrees to provide to DOM Covered Entity or an Individual, in a time and manner designated by DOMreasonable time, information collected in accordance with section (III)(hSection B.(10) of this AgreementBAA, to permit XXX Covered Entity to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements12. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Ruleagrees, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that the Business Associate carries is to carry out DOM’s obligations one or more of Covered Entity's obligation(s) under the Privacy RuleSubpart E of 45 CFR Part 164, Business Associate will to comply with the requirements of the Privacy Rule Subpart E that apply to DOM the Covered Entity in the performance of such obligationobligation(s).
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 3 contracts
Samples: Interlocal Cooperation Agreement and Business Associate Agreement, Interlocal Cooperation Agreement and Business Associate Agreement, Interlocal Cooperation Agreement and Business Associate Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use to: Only use or Disclose PHI other than disclose Protected Health Information as permitted or required by the Service Agreement or as Required required by Law.
b. Business Associate shall use law; Use appropriate safeguards safeguards, and comply with Subpart C of 45 C.F.R. CFR Part 164 with respect to electronic PHI (ePHI) Electronic Protected Health Information, to prevent Use use or Disclosure disclosure of PHI Protected Health Information other than as provided for by this the Agreement.
c. ; Report immediately, but in any case within not more than five (5) days, in writing to Covered Entity any non-permitted use or disclosure of Individually Identifiable Health Information, Protected Health Information or Electronic Health Information, by Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI Business Associate’s subcontractors not provided for by this the Agreement or otherwise required by law of which it becomes aware, . The report at minimum should include: Nature of the non-permitted or violating use or disclosure; The health information used or disclosed; Name of individual(s) who made the non-permitted or violating use or disclosure; Name of individual(s) or entity who received the non-permitted or violating use or disclosure; Identify corrective action(s) Business Associate did or will take to mitigate any adverse effect of the non-permitted use or disclosure; and any Provide such other information as Covered Entity may reasonably request. Monitor all Security Incidents and report a successful Security Incident in accordance with Section II (c) above and shall report unsuccessful Security Incidents upon request of which it becomes aware.
d. Business Associate agrees to mitigate, Covered Entity; Mitigate to the extent practicable, any practicable harmful effect effects that is are known to Business Associate of a Use use or Disclosure disclosure of PHI Protected Health Information by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any IncidentAgreement, including any action or as required by applicable federal and state laws and regulations.
e. law; Report immediately, but in any case within not more than five (5) days, in writing to Covered Entity any Breach or potential Breach of unsecured Individually Identifiable Health Information, Protected Health information, or Electronic Protected Health Information, as required by 45 CFR 164.410, involving Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one ’s subcontractors. The report at minimum should include: Nature of the exceptions to breach or potential breach; The Information involved; Suspected individual(s) or entity if known responsible for the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. breach or potential breach; Identify corrective action(s) Business Associate agrees did or will take to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that mitigate any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery adverse effect of the Incident, breach; and perform Provide such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred other information as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. Covered Entity may reasonably request. In accordance with 45 C.F.R. §§ CFR 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to if applicable, ensure that any subcontractors that create, receive, maintain, or transmit protected health information Protected Health Information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. Business Associate agrees to make any amendment(s) to PHI ; Make available Protected Health Information in a Designated Record Set that DOM directs to the Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.524; Make any amendment(s) to Protected Health Information in a Designated Record Set as directed or agrees agreed to by Covered Entity pursuant to 45 CFR § 164.526 164.526, or take other appropriate measures within thirty (30) days as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526; Maintain and make available the information required to provide an accounting of disclosures to Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CF 164.528. Such information shall include at minimum: Date each disclosure is made; Name and address of the person or entity to whom each disclosure is made; A brief description of the health information disclosed; and A brief statement of the purpose of each disclosure. Notify Covered Entity’s HIPAA Compliance Officer in writing of any request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent disclosures that Business Associate carries out DOM’s obligations under receives directly from an individual within five (5) days of receipt of request; To the Privacy Rule, extent Business Associate will is to carry out one or more of Covered Entity's obligation(s) under Subpart E of 45 CFR Part 164, comply with the requirements of the Privacy Rule Subpart E that apply to DOM Covered Entity in the performance of such obligation.
r. Business Associate agrees to make obligation(s); Make its internal practices, books, and records, including policies and procedures, records available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees HIPAA Rules; Implement administrative, physical, and technical safeguards that nothing in this Agreement shall permit Business Associate to accessreasonably and appropriately protect the confidentiality, storeintegrity, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction availability of the United States without express written authorization from DOMelectronic Protected Health Information that it creates, receives, maintains, or transmits on behalf of Covered Entity in accordance with the 45 CFR 164.306 (the HIPAA Security standards); and Maintain policies and procedures to detect, prevent, mitigate, and promptly notify Covered Entity regarding indicators of a possible risk of identity theft in connection with Covered Accounts as required by the Red Flags Rule, set forth in 16 CFR 681.1.
Appears in 3 contracts
Samples: Business Associate Agreement, Business Associate Agreement, Business Associate Agreement
Obligations and Activities of Business Associate. a. (a) Business Associate agrees to not Use use or Disclose PHI disclose Protected Health Information other than as permitted or required by the Service this Agreement or as Required by By Law.
b. . Business Associate shall also comply with any further limitations on uses and disclosures agreed to by Covered Entity in accordance with 45 C.F.R. 164.522 provided that such agreed upon limitations have been communicated to Business Associate according with Section 4.l(c) of this Agreement.
(b) Business Associate agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of PHI the Protected Health Information other than as provided for by this Agreement.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72c) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI Protected Health Information by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsAgreement.
e. (d) Business Associate agrees to notify DOM without unreasonable delayreport to Covered Entity any use or disclosure of the Protected Health Information not allowed by this Agreement of which it becomes aware.
(e) Beginning on the later of the Effective Date of this Agreement or the Security Breach Compliance Date, and no later than seventy-two (72) hours after discovery of Business Associate agrees to report to Covered Entity any actual or suspected Security Breach of Unsecured PHI, all Protected Health Information without unreasonable delay and in accordance with 45 C.F.R. § 164.410no case later than sixty (60) calendar days after Discovery of a Security Breach. The notification Such notice shall include, to the extent possible and subsequently as the information becomes available, include the identification of all Individuals each individual whose Unsecured PHI Protected Health Information has been, or is reasonably believed by Business Associate Associate, to have been Breached along been, accessed, acquired, or disclosed In connection with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOMsuch Security Breach. In addition, Business Associate agrees to shall provide a written assessment to determine whether any additional information reasonably requested by Covered Entity for purposes of investigating the incident is reportable within ten (10) working daysSecurity Breach. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as notification of a business associate for DOM, regardless Security Breach under this section shall comply in all respects with each applicable provision of whether DOM and/or Business Associate are named as parties Section 13400 of Subtitle D (Privacy) of ARRA and related guidance issued by the Secretary from time to such Actionstime.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii(f) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that createagent, receiveincluding a subcontractor, maintainto whom it provides Protected Health Information received from, or transmit protected health information created or received by Business Associate on behalf of the Business Associate agree Covered Entity, agrees to the same restrictions, conditions, restrictions and requirements conditions that apply through this Agreement to Business Associate with respect to such information. In no event shall Business Associate, without Covered Entity’s prior written approval, provide Protected Health Information received from, or created or received by Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree Covered Entity, to comply with any employee or agent, including a subcontractor, if such employee, agent or subcontractor receives, processes or otherwise has access to the applicable requirements Protected Health Information outside of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreementsUnited States.
l. (g) Business Associate agrees to provide access, at the request of XXXCovered Entity, and in the time and manner designated by XXXCovered Entity, to PHI Protected Health Information in a Designated Record Set, to DOM Covered Entity or, as directed by XXXCovered Entity, to an Individual in order to meet the requirements under 45 CFR § C.F.R. 164.524. Covered Entity’s determination of what constitutes “Protected Health Information” or a “Designated Record Set” shall be final and conclusive. If Business Associate provides copies or summaries of Protected Health Information to an Individual it may impose a reasonable, cost-based fee in accordance with 45 C.F.R. 164.524 (c)(4).
m. (h) Business Associate agrees to make any amendment(s) to PHI Protected Health Information in a Designated Record Set that DOM the Covered Entity directs or agrees to pursuant to 45 CFR § C.F.R. 164.526 at the request of DOM Covered Entity or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528Covered Entity. Business Associate agrees shall not charge any fee for fulfilling requests for amendments. Covered Entity’s determination of what Protected Health Information is subject to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting amendment pursuant to 45 C.F.R. 164.526 shall be final and relevant documentation to DOM at the time of terminationconclusive.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(hi) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make (i) internal practices, books, and records, including policies and procedures, relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity, and (ii) policies, procedures, and documentation relating to the safeguarding of Electronic Protected Health Information available to the Secretary Covered Entity, or at the request of the Covered Entity to the Secretary, in a time and manner designated by the Covered Entity or the Secretary, for purposes of the Secretary determining Business AssociateCovered Entity’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310and Security Rules.
s. (j) Business Associate agrees to document such disclosures of Protected Health Information as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 C.F.R. 164.528.
(k) Business Associate agrees to provide to Covered Entity, in the time and manner designated by Covered Entity, the information collected in accordance with Section 2(i) of this Agreement, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 C.F.R. 164.528. In addition, with respect to information contained in an Electronic Health Record, Business Associate shall document, and maintain such documentation for three (3) years from date of disclosure, such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of information contained in an Electronic Health Record, as required by Section 13405(c) of Subtitle D (Privacy) of ARRA and related regulations issued by the Secretary from time to time.
(l) Business Associate acknowledges that nothing it shall request from the Covered Entity and so disclose to its affiliates, agents and subcontractors or other third parties, only (i) the information contained in a “limited data set,” as such term is defined at 45 C.F.R. 164.514(e)(2), or, (ii) if needed by Business Associate, to the minimum necessary to accomplish the intended purpose of such requests or disclosures. In all cases, Business Associate shall request and disclose Protected Health Information only in a manner that is consistent with guidance issued by the Secretary from time to time.
(m) With respect to Electronic Protected Health Information, Business Associate shall implement and comply with (and ensure that its subcontractors implement and comply with) the administrative safeguards set forth at 45 C.F.R. 164.308, the physical safeguards set forth at 45 C.F.R. 310, the technical safeguards set forth at 45 C.F.R. 164.312, and the policies and procedures set forth at 45 C.F.R. 164.316 to reasonably and appropriately protect the confidentiality, integrity, and availability of the Electronic Protected Health Information that it creates, receives, maintains, or transmits on behalf of Covered Entity. Business Associate acknowledges that, effective the later of the Effective Date of this Agreement or February 17, 2010, (i) the foregoing safeguards, policies and procedures requirements shall permit apply to Business Associate in the same manner that such requirements apply to accessCovered Entity, storeand (ii) Business Associate shall be liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. 1320d-5 and 1320d-6, shareas amended from time to time, maintainfor failure to comply with the safeguards, transmit or use or disclose PHI in policies and procedures requirements and any form via guidance issued by the Secretary from time to time with respect to such requirements.
(n) With respect to Electronic Protected Health Information, Business Associate shall ensure that any medium with any third partyagent, including a subcontractor, to whom it provides Electronic Protected Health Information, agrees to implement reasonable and appropriate safeguards to protect it.
(o) Business Associate shall report to Covered Entity any Security Incident of which it becomes aware.
(p) If Business Associate conducts any Standard Transactions on behalf of Covered Entity, Business Associate shall comply with the applicable requirements of 45 C.F.R. Parts 160-162.
(q) During the term of this Agreement, Business Associate may be asked to complete a security survey and/or attestation document designed to assist Covered Entity in understanding and documenting Business Associate’s Subcontractorssecurity procedures and compliance with the requirements contained herein. Business Associate’s failure to complete either of these documents within the reasonable timeframe specified by Covered Entity shall constitute a material breach of this Agreement.
(r) Business Associate acknowledges that, beyond effective the boundaries and jurisdiction later of the United States without express written authorization Effective Date of this Agreement or February 17, 2010, it shall be liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. 1320d-5 and 1320d-6, as amended from DOMtime to time, for failure to comply with any of the use and disclosure requirements of this Agreement and any guidance issued by the Secretary from time to time with respect to such use and disclosure requirements.
Appears in 3 contracts
Samples: Master Business Agreement (Benefitfocus, Inc.), Master Business Agreement (Benefitfocus,Inc.), Master Business Agreement (Benefitfocus,Inc.)
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use or further Disclose PHI other than as permitted or required by the Service Agreement this BAA or as Required required by Lawlaw.
b. Business Associate shall agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) designed to prevent Use Uses or Disclosure Disclosures of the PHI other than as provided for by this BAA or the Services Agreement.
c. Business Associate agrees to notify DOM without unreasonable delay implement and no later than seventy-two (72) hours after discoverymaintain procedures that reasonably and appropriately protect the confidentiality, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes awareintegrity, and any Security Incident availability of which electronic PHI, and consistent with and as required of business associates by the HIPAA Rules. However, it becomes awareshall be the responsibility of Customer and not Business Associate to comply with requirements under 45 CFR §164.312 to implement encryption or decryption mechanisms for electronic PHI maintained on physical media (e.g. tapes) stored by Business Associate.
d. Business Associate agrees to mitigatepromptly report to Customer any Security Incident, to the extent practicableBreach, any harmful effect that is known to Business Associate of a or other Use or Disclosure of PHI of which it becomes aware that is not permitted or required by this BAA or the Services Agreement. In the event of a Breach, such notification shall be made in accordance with and as required of a business associate by the HIPAA Rules, including without limitation pursuant to 45 CFR 164.410. Business Associate will provide reasonable assistance and cooperation in the investigation of any such Breach and shall document the specific PHI which have been compromised, the identity of any unauthorized third party who may have accessed or received the PHI, if known, and any actions that have been taken by Business Associate in Violation to mitigate the effects of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationssuch Breach.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of require any actual agent or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall includesubcontractor, to whom it delivers PHI for the extent possible purposes of assisting in providing services pursuant to the Services Agreement, to enter into a written agreement requiring such agent or subcontractor to provide privacy and subsequently security protections to such PHI at least as the information becomes available, the identification stringent as those required of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410through this BAA.
f. Once an actual or suspected Breach is reported If Business Associate has custody of PHI in a Designated Record Set with respect to DOMIndividuals, and if Customer so requests, Business Associate agrees to provide a written assessment access to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed such PHI to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the Customer by retrieving such PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, the terms and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery conditions of the IncidentServices Agreement, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, Customer may respond to an Individual in order to meet the requirements under of 45 CFR § §164.524.
m. g. Business Associate agrees to make any amendment(s) that if an amendment to PHI in a Designated Record Set is required, if Business Associate has custody of PHI in a Designated Record Set with respect to Individuals, and if Customer instructs Business Associate to retrieve such PHI in accordance with the Services Agreement, Business Associate shall perform such service so that DOM directs Customer may make any amendment to such PHI as may be required by either Customer or agrees to an Individual pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX§164.526.
n. h. Business Associate agrees to document such and make available to Customer the information required to provide an accounting of Disclosures of PHI and PHI, provided that Customer has provided Business Associate with information related sufficient to enable Business Associate to know which records or data received from or on behalf of Customer by Business Associate contain PHI. The documentation of Disclosures shall contain such Disclosures information as would be required for DOM Customer to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after §164.528 or other provisions of the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of terminationHIPAA Rules.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified i. Unless otherwise expressly agreed in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy RuleServices Agreement, Business Associate will shall promptly notify Customer of any requests by Individuals for access to or knowledge or correction of PHI, without responding to such requests, and Customer shall be responsible for receiving and responding to any such Individual requests.
j. To the extent the Business Associate is to carry out one or more of Customer's obligation(s) under Subpart E of 45 CFR §164, Business Associate shall comply with the requirements of the Privacy Rule Subpart E that apply to DOM Customer in the performance of such obligationobligation(s).
r. k. Business Associate agrees to make its internal practices, books, and records, including policies and procedures, records available to the Secretary of Health and Human Services (“Secretary”) for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310HIPAA Rules.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 3 contracts
Samples: Service Agreement, Service License and Support Agreement, Service Agreement
Obligations and Activities of Business Associate. a. a) Business Associate acknowledges and agrees that it is obligated by law (or upon the effective date of any portion thereof shall be obligated) to meet the applicable provisions of HIPAA and such provisions are incorporated herein and made a part of this Business Associate Agreement. Covered Entity and Business Associate agree that any regulations and/or guidance issued by DHHS with respect to HIPAA that relate to the obligations of business associates shall be deemed incorporated into and made a part of this Business Associate Agreement.
b) In accordance with 45 CFR §164.502(a)(3), Business Associate agrees not to not Use use or Disclose disclose PHI other than as permitted or required by the Service this Business Associate Agreement or as Required by Law.
b. c) Business Associate shall agrees to develop, implement, maintain, and use appropriate administrative, technical, and physical safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to that reasonably prevent Use the use or Disclosure disclosure of PHI other than as provided for by this Business Associate Agreement.
c. , in accordance with 45 CFR §§164.306, 310 and 312. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discoverydevelop, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes awareimplement, maintain, and any Security Incident use administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of which it becomes awareElectronic PHI, in accordance with 45 CFR §§164.306, 308, 310, and 312. In accordance with 45 CFR §164.316, Business Associate shall also develop and implement policies and procedures and meet the documentation requirements as and at such time as may be required by HIPAA.
d. d) Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate Associate, of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsBusiness Associate Agreement.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72e) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. CFR §§ 164.502(e)(1)(ii) §164.308, 314 and 164.308(b)(2)502, Business Associate agrees to will ensure that any subcontractors that workforce member or agent, including a vendor or subcontractor, whom Business Associate engages to create, receive, maintain, or transmit protected health information PHI on behalf of the Business Associate agree Associate’s behalf, agrees to the same restrictions, conditions, restrictions and requirements conditions that apply through this Business Associate Agreement to Business Associate with respect to such information, including minimum necessary limitations. Business Associate agrees to will ensure that any Subcontractors that workforce member or agent, including a vendor or subcontractor, whom Business Associate engages to create, receive, maintain, or transmit electronic PHI (ePHIon Business Associate’s behalf, agrees to implement reasonable and appropriate safeguards to ensure the confidentiality, integrity, and availability of the PHI.
f) on behalf At the request of Covered Entity, Business Associate will agree provide Covered Entity, or as directed by Covered Entity, an Individual, access to comply with PHI maintained in a Designated Record Set in a time and manner that is sufficient to meet the applicable requirements of the Security Rule and Privacy Rule 45 CFR § 164.524, and, where required by entering into a Business Associate Agreement and Business Associate HIPAA, shall provide DOM with a copy of all make such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or information available in an electronic copy to DOM’s Privacy Officer format where directed by the Covered Entity.
g) At the written request of Covered Entity, (or if so, directed by Covered Entity, at the address included in Section VII(f) written request of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kindan Individual), including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, make any amendment to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order a time and manner that is sufficient to meet the requirements under of 45 CFR § 164.524164.526.
m. h) In accordance with 45 CFR §164.504(e)(2), Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make its internal practices, books, and records, including policies and procedures, and any PHI, relating to the use and disclosure of PHI, available to Covered Entity or to the Secretary for purposes of determining compliance with applicable law. To the extent permitted by law, said disclosures shall be held in strictest confidence by the Covered Entity. Business Associate will provide such access in a time and manner that is sufficient to meet any applicable requirements of applicable law.
i) Business Associate agrees to document and maintain a record of disclosures of PHI and information related to such disclosures, including the date, recipient, and purpose of such disclosures, in a manner that is sufficient for Covered Entity or Business Associate to respond to a request by Covered Entity or an Individual for an Accounting of disclosures of PHI and in accordance with 45 CFR § 164.528. Business Associate further shall provide any additional information where required by HIPAA and any implementing regulations. Unless otherwise provided under HIPAA, Business Associate will maintain the Accounting with respect to each disclosure for at least six years following the date of the disclosure.
j) Business Associate agrees to provide to Covered Entity upon written request, or, as directed by Covered Entity, to an Individual, an Accounting of disclosures in a time and manner that is sufficient to meet the requirements of HIPAA, in accordance with 45 CFR §164.528. In addition, where Business Associate is contacted directly by an Individual based upon information provided to the Individual by Covered Entity and where so required by HIPAA and/or any implementing regulations, Business Associate shall make such Accounting available directly to the Individual.
k) In accordance with 45 CFR §164.502(b), Business Associate agrees to make reasonable efforts to limit use, disclosure, and/or requests for PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request. Where required by HIPAA, Business Associate shall determine (in its reasonable judgment) what constitutes the minimum necessary to accomplish the intended purpose of a disclosure.
l) In accordance with 45 CFR §502(a)(5), Business Associate shall not directly or indirectly receive remuneration in exchange for any PHI of an Individual, except with the express written pre- approval of Covered Entity.
m) To the extent Business Associate is to carry out one or more obligation(s) of the Covered Entity’s under Subpart E of 45 CFR Part 164, Business Associate shall comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such obligation(s).
n) In accordance with 45 CFR §164.314(a)(1)(i)(C), Business Associate agrees to promptly report to Covered Entity any Security Incident of which Business Associate becomes aware.
o) In accordance with 45 CFR §164.410 and the provisions of this Business Associate Agreement, Business Associate will report to Covered Entity, following Discovery and without unreasonable delay, but in no event later than five business days following Discovery, any Breach of Unsecured Protected Health Information. Business Associate shall cooperate with Covered Entity in investigating the Breach and in meeting Covered Entity’s obligations under HIPAA and any other applicable security breach notification laws, including, but not limited to, providing Covered Entity with such information in addition to Business Associate’s and/or DOM's compliance with report as Covered Entity may reasonably request, e.g., for purposes of Covered Entity making an assessment as to whether/what Breach Notification is required. Business Associate’s report under this subsection shall, to the Privacy Rule pursuant to 45 C.F.R. § 160.310.extent available at the time the initial report is required, or as promptly thereafter as such information becomes available but no later than 30 days from discovery, include:
s. Business Associate agrees that nothing in this Agreement shall permit 1. The identification (if known) of each Individual whose Unsecured Protected Health Information has been, or is reasonably believed by Business Associate to have been, accessed, acquired, or disclosed during such Breach;
2. A description of the nature of the unauthorized acquisition, access, storeuse, share, maintain, transmit or use or disclose PHI in any form via any medium with any third partydisclosure, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction date of the United States without express written authorization from DOM.Breach and the date of discovery of the Breach;
Appears in 2 contracts
Samples: Contract Agreement, Contract Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use to:
a. Not use or Disclose disclose PHI other than as permitted or required by the Service this Agreement or as Required required to perform services under a Participation Agreement into which the Parties may enter or as required by Lawlaw.
b. Business Associate shall use Use appropriate safeguards administrative, technical and physical safeguards, and comply with Subpart C of 45 C.F.R. CFR Part 164 with respect to electronic PHI (ePHI) PHI, to preserve the integrity and confidentiality of PHI, and to prevent Use or Disclosure of PHI other than as provided for by the HIPAA Rules and this Agreement.
c. Business Associate agrees Report to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of Covered Entity any Use or Disclosure of PHI not provided for by this the Agreement of which it becomes aware, including Breaches of Unsecured PHI as required by 45 CFR 164.410, and any Security Incident of which it becomes aware.
d. . Such incidents shall be reported without delay, but in no event later than fifteen (15) calendar days from the date the incident was discovered by the Business Associate. Notification from Business Associate agrees to mitigateCovered Entity must include information regarding individuals affected and number of individuals affected, to description of the extent practicableBreach or situation, any harmful effect that is known to Business Associate of a Use or Disclosure types of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt involved, steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed taken by Business Associate to have been Breached along with any other available investigate, mitigate and protect against similar future incidents, and contact information that for the individual who is required reporting the incident to be included in Covered Entity. Covered Entity reserves the notification right to make further inquiries or request further action related to the Individual, HHS, and/or reported incident. All reporting requirements related to the media, all in accordance with incident shall be handled by the data Breach notification requirements set forth in 45 C.F.R.§ 164.410Covered Entity.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. d. In accordance with 45 C.F.R. §§ CFR 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to shall ensure that any subcontractors Subcontractor that createcreates, receivereceives, maintainmaintains, or transmit protected health information transmits PHI on behalf of the Business Associate agree agrees in writing to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such informationPHI. The Business Associate agrees to ensure is not in compliance with the HIPAA Rules if it knew of a pattern of activity or practice of a Subcontractor that any Subcontractors that create, receive, maintain, constitute a material breach or transmit electronic PHI (ePHI) on behalf violation of the subcontractor’s obligation under its contact with Business Associate will agree to comply with or other arrangement, unless the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement took reasonable steps to cure the breach or end the violation, and Business Associate shall provide DOM with a copy of all if such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written steps were unsuccessful terminated the Subcontractor or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kindarrangement, including of the use of such Subcontractors or of the adequacy of such agreementsif feasible.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to e. Make available PHI in a Designated Record Set, Set to DOM or, as directed by XXX, to an Individual Covered Entity in order to timely meet the requirements Covered Entity’s obligations under 45 CFR § 164.524.
m. . Any request received by the Business Associate agrees from an Individual who is requesting access to a Designated Record Set shall be promptly forwarded to the Covered Entity. Promptly make any amendment(s) to PHI in a Designated Record Set that DOM directs as directed or agrees agreed to pursuant to 45 CFR § 164.526 at 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations timely under 45 CFR 164.526. Any request received by the request of DOM or Business Associate from an Individual, and in Individual who is requesting amendment to a Designated Record Set shall be promptly forwarded to the time and manner designated by XXXCovered Entity.
n. Business Associate agrees f. Maintain a system of documentation to document such Disclosures of PHI and make available the information related required to such Disclosures as would be required for DOM to respond to a request by an Individual for provide an accounting of Disclosures of PHI in accordance with disclosures to the Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR § 164.528. Any request received by the Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by from an Individual for who is requesting an accounting of Disclosures disclosures shall be promptly forwarded to the Covered Entity.
g. To the extent Business Associate is to carry out one or more of PHI in accordance with Covered Entities obligations under Subpart E of 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose Part 164, the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the HIPAA Privacy Rule, Business Associate will shall comply with the requirements of the Privacy Rule Subpart E that apply to DOM the Covered Entity in the performance of such obligation.
r. Business Associate agrees to make h. Make its internal practices, books, and records, including policies and procedures, records available to the Secretary of the Department of Health and Human Services or his or her designee, in a reasonable time and manner for purposes the purpose of determining Business Associate’s and/or DOM's permitting the Secretary to determine compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310HIPAA Rules.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 2 contracts
Samples: Business Associate Agreement, Business Associate Agreement
Obligations and Activities of Business Associate. a. a) Business Associate acknowledges and agrees that it is obligated by law (or upon the effective date of any portion thereof shall be obligated) to meet the applicable provisions of HIPAA and such provisions are incorporated herein and made a part of this Business Associate Agreement. Covered Entity and Business Associate agree that any regulations and/or guidance issued by DHHS with respect to HIPAA that relate to the obligations of business associates shall be deemed incorporated into and made a part of this Business Associate Agreement.
b) In accordance with 45 CFR §164.502(a)(3), Business Associate agrees not to not Use use or Disclose disclose PHI other than as permitted or required by the Service this Business Associate Agreement or as Required by Law.
b. c) Business Associate shall agrees to develop, implement, maintain and use appropriate administrative, technical, and physical safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to that reasonably prevent Use the use or Disclosure disclosure of PHI other than as provided for by this Business Associate Agreement.
c. , in accordance with 45 CFR §§164.306, 310 and 312. Business Associate agrees to notify DOM without unreasonable delay develop, implement, maintain and no later than seventy-two (72) hours after discoveryuse administrative, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes awarephysical, and any Security Incident technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of which it becomes awareElectronic PHI, in accordance with 45 CFR §§164.306, 308, 310, and 312. In accordance with 45 CFR §164.316, Business Associate shall also develop and implement policies and procedures and meet the documentation requirements as and at such time as may be required by HIPAA.
d. d) Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate Associate, of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsBusiness Associate Agreement.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72e) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. CFR §§ 164.502(e)(1)(ii) §164.308, 314 and 164.308(b)(2)502, Business Associate agrees to will ensure that any subcontractors that workforce member or agent, including a vendor or subcontractor, whom Business Associate engages to create, receive, maintain, or transmit protected health information PHI on behalf of the Business Associate agree Associate’s behalf, agrees to the same restrictions, conditions, restrictions and requirements conditions that apply through this Business Associate Agreement to Business Associate with respect to such information, including minimum necessary limitations. Business Associate agrees to will ensure that any Subcontractors that workforce member or agent, including a vendor or subcontractor, whom Business Associate engages to create, receive, maintain, or transmit electronic PHI (ePHIon Business Associate’s behalf, agrees to implement reasonable and appropriate safeguards to ensure the confidentiality, integrity, and availability of the PHI.
f) on behalf At the request of Covered Entity, Business Associate will agree provide Covered Entity, or as directed by Covered Entity, an Individual, access to comply with PHI maintained in a Designated Record Set in a time and manner that is sufficient to meet the applicable requirements of the Security Rule and Privacy Rule 45 CFR § 164.524, and, where required by entering into a Business Associate Agreement and Business Associate HIPAA, shall provide DOM with a copy of all make such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or information available in an electronic copy to DOM’s Privacy Officer format where directed by the Covered Entity.
g) At the written request of Covered Entity, (or if so directed by Covered Entity, at the address included in Section VII(f) written request of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kindan Individual), including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, make any amendment to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order a time and manner that is sufficient to meet the requirements under of 45 CFR § 164.524164.526.
m. h) In accordance with 45 CFR §164.504(e)(2), Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make its internal practices, books, and records, including policies and procedures, and any PHI, relating to the use and disclosure of PHI, available to Covered Entity or to the Secretary for purposes of determining compliance with applicable law. To the extent permitted by law, said disclosures shall be held in strictest confidence by the Covered Entity. Business Associate will provide such access in a time and manner that is sufficient to meet any applicable requirements of applicable law.
i) Business Associate agrees to document and maintain a record of disclosures of PHI and information related to such disclosures, including the date, recipient and purpose of such disclosures, in a manner that is sufficient for Covered Entity or Business Associate to respond to a request by Covered Entity or an Individual for an Accounting of disclosures of PHI and in accordance with 45 CFR § 164.528. Business Associate further shall provide any additional information where required by HIPAA and any implementing regulations. Unless otherwise provided under HIPAA, Business Associate will maintain the Accounting with respect to each disclosure for at least six years following the date of the disclosure.
j) Business Associate agrees to provide to Covered Entity upon written request, or, as directed by Covered Entity, to an Individual, an Accounting of disclosures in a time and manner that is sufficient to meet the requirements of HIPAA, in accordance with 45 CFR §164.528. In addition, where Business Associate is contacted directly by an Individual based upon information provided to the Individual by Covered Entity and where so required by HIPAA and/or any implementing regulations, Business Associate shall make such Accounting available directly to the Individual.
k) In accordance with 45 CFR §164.502(b), Business Associate agrees to make reasonable efforts to limit use, disclosure, and/or requests for PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request. Where required by HIPAA, Business Associate shall determine (in its reasonable judgment) what constitutes the minimum necessary to accomplish the intended purpose of a disclosure.
l) In accordance with 45 CFR §502(a)(5), Business Associate shall not directly or indirectly receive remuneration in exchange for any PHI of an Individual, except with the express written pre- approval of Covered Entity.
m) To the extent Business Associate is to carry out one or more obligation(s) of the Covered Entity’s under Subpart E of 45 CFR Part 164, Business Associate shall comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such obligation(s).
n) In accordance with 45 CFR §164.314(a)(1)(i)(C), Business Associate agrees to promptly report to Covered Entity any Security Incident of which Business Associate becomes aware.
o) In accordance with 45 CFR §164.410 and the provisions of this Business Associate Agreement, Business Associate will report to Covered Entity, following Discovery and without unreasonable delay, but in no event later than five business days following Discovery, any Breach of Unsecured Protected Health Information. Business Associate shall cooperate with Covered Entity in investigating the Breach and in meeting Covered Entity’s obligations under HIPAA and any other applicable security breach notification laws, including, but not limited to, providing Covered Entity with such information in addition to Business Associate’s and/or DOM's compliance with report as Covered Entity may reasonably request, e.g., for purposes of Covered Entity making an assessment as to whether/what Breach Notification is required. Business Associate’s report under this subsection shall, to the Privacy Rule pursuant to 45 C.F.R. § 160.310.extent available at the time the initial report is required, or as promptly thereafter as such information becomes available but no later than 30 days from discovery, include:
s. Business Associate agrees that nothing in this Agreement shall permit 1. The identification (if known) of each Individual whose Unsecured Protected Health Information has been, or is reasonably believed by Business Associate to have been, accessed, acquired, or disclosed during such Breach;
2. A description of the nature of the unauthorized acquisition, access, storeuse, share, maintain, transmit or use or disclose PHI in any form via any medium with any third partydisclosure, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction date of the United States without express written authorization from DOM.Breach and the date of discovery of the Breach;
Appears in 2 contracts
Samples: Contract Agreement, Contract Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use use or Disclose disclose PHI or other Confidential Information other than as permitted or required by the Service this Agreement or as Required by Law.
b. Business Associate shall agrees to use appropriate safeguards and comply comply, where applicable, with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) the Security Rule, to prevent Use use or Disclosure disclosure of PHI other than as provided for by this Agreement.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI or other Confidential Information by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsAgreement.
e. d. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 42 U.S.C. § 17932 and 45 C.F.R.§ 164.410.C.F.R. Parts 160 and 164, Subparts A, D, and E.
f. e. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use use or Disclosure disclosure of protected health information is presumed to be a Breach unless the DOM Covered Entity or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § §164.410.
g. f. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent DOM without unreasonable delay, and in no case more later than 60 days seventy-two (72) hours after discovery discovery, any use or disclosure of the IncidentPHI not provided for by this Agreement of which it becomes aware, and perform such notifications if so required by DOM in its sole discretionany Security Incident of which it becomes aware.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), g. Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information PHI or Confidential Information on behalf of the Business Associate agree to the same restrictions, conditions, restrictions and requirements conditions that apply to the Business Associate with respect to such information. , in accordance with 45 C.F.R. §§ 164.308 and 164.502.
h. Business Associate agrees to ensure that any Subcontractors subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement Agreement, in accordance with 45 C.F.R. §§ 164.308, 164.314, 164.502, and 164.504, and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreementsubcontractors. Business Associate understands that submission of their Subcontractorssubcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors subcontractors or of the adequacy of such agreements.
l. i. Business Associate agrees to provide access, at the request of XXXDOM, and in the time and manner designated by XXXDOM, to PHI in a Designated Record Set, to DOM or, as directed by XXXDOM, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. j. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXXDOM.
n. k. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at disclosure; the time provisions of terminationthis section shall survive termination of this Agreement for any reason.
o. l. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(hIII)(j) of this Agreement, to permit XXX DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. m. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. n. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. o. Business Associate agrees to make internal practices, books, and records, including policies and proceduresprocedures and PHI, relating to the use and disclosure of PHI received from, created, or received by Business Associate on behalf of DOM available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310Rule.
s. p. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractorssubcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
q. Business Associate agrees that all DOM data shall not be co-mingled with other trading partner’s data, and shall be easily identifiable and exportable. DOM Data shall be stored in an individual structure in accordance with the following: Business Associate shall create an instance (single-tenant) of the particular database software utilized by Business Associate, and only DOM data shall reside in that instance of the database. The intent of this section is not to require separate procurement of hardware specific to DOM, however DOM data must not reside in a database that contains other entities’ data.
r. Business Associate agrees that all DOM data will be encrypted using industry standard algorithms Triple DESDESK, AES or SSL/TLS.
s. Business Associate agrees to comply with the State of Mississippi ITS Enterprise Security Policy, which will be provided upon request.
t. The provisions of the HITECH Act that apply to Business Associate and are required to be incorporated by reference in a business associate agreement are hereby incorporated into this Agreement, including, without limitation, 42 U.S.C. §§ 17935(b), (c), (d) and (e), and 17936(a) and (b), and their implementing regulations.
u. Without limitation of the foregoing:
i. Pursuant to 42 U.S.C. § 17931(a), the following sections of the Security Rule shall apply to Business Associate in the same manner as they apply to DOM: 45 C.F.R. §§ 164.308 (Administrative Safeguards); 164.310 (Physical Safeguards); 164.312 (Technical Safeguards); and 164.316 (Policies and procedures and documentation requirements).
ii. 42 U.S.C. §§ 17931(b) and 17934(c), and their implementing regulations, each apply to Business Associate with respect to its status as a business associate to the extent set forth in each such section.
Appears in 2 contracts
Samples: Business Associate Agreement, Business Associate Agreement
Obligations and Activities of Business Associate. a. a) Business Associate agrees to shall not Use use or Disclose PHI disclose Protected Health Information other than as permitted or required by the Service Agreement this BAA or as permitted or Required by Law.
b. Business Associate shall use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHIb) to prevent Use or Disclosure of PHI other than as provided for by this Agreement.
c. Business Associate agrees to notify DOM without unreasonable delay provide those physical, technical and no later than seventy-two (72) hours after discoveryadministrative safeguards described in the Agreement including those safeguards and services selected by you and described in a Order. If Business Associate agrees as part of this BAA to carry out an obligation of yours under the Privacy Rule, then Business Associate will comply with the requirements of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes awarethe Privacy Rule applicable to such obligation.
d. c) Business Associate agrees to mitigate, to the extent commercially reasonable and reasonably practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI Protected Health Information by Business Associate or its agents or subcontractors in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsBAA.
e. d) Within five Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery Days of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOMbecoming aware, Business Associate agrees to provide a written assessment report to determine whether you
(i) Security Incidents (as defined in 45 C.F.R. §164.304 and as further described below), (ii) the incident is reportable within ten Breach of unsecured PHI (10as defined in 45 CFR §164.402), or (iii) working days. An impermissible Use an access, acquisition, use or Disclosure disclosure of protected health information is presumed PHI in violation of this BAA.
e) Both parties acknowledge that there are likely to be a Breach unless significant number of meaningless or unsuccessful attempts to access the DOM or Services, which make a real-time reporting requirement impractical for both parties. The parties acknowledge that Business Associate’s ability to report on system activity, as applicableincluding Security Incidents, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applieslimited by, all in accordance with 45 C.F.R. § 164.410and to, Customer’s specific Services and instances thereof, and does not include End User Devices.
g. f) Business Associate undertakes no obligation to report unsuccessful security incidents or to report network security related incidents which occur on the Impero managed network or systems but do not directly involve Customer Data. The parties agree that the following are illustrative examples of unsuccessful security incidents which, when they do not result in the unAuthorised access, use, disclosure, modification or destruction of PHI need not be reported by Business Associate: pings against network devices, port scans, attempts to log on to a system or database with an invalid password or username, malware.
g) Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that obtain from any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incidentagent, including costs associated with mitigation of the Incident and preparation and delivery of notices a subcontractor to affected individuals and government agencies.
i. With respect to an Incidentwhom it provides Protected Health Information, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure reasonable assurances that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree it will adhere to the same restrictions, conditions, restrictions and requirements conditions that apply to Business Associate under this BAA with respect to such information. .
h) All Protected Health Information maintained by Business Associate agrees for you will be available to ensure you in a time and manner that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree reasonably allows you to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524. Business Associate shall not be obligated to provide any such information directly to any Individual or person other than you.
m. i) All Protected Health Information and other information maintained by Business Associate for you will be available to you in a time and manner that reasonably allows you to comply with the requirements under 45 CFR § 164.526.
j) Business Associate agrees to make any amendment(s) internal practices, books, and records available to PHI the Secretary, in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXXthe Secretary, for purposes of the Secretary’s determining your compliance with the Privacy Rule; provided, however, that time incurred by Business Associate in complying with any such request that exceeds its normal customer service parameters shall be charged to you at Business Associate’s then current hourly rate for additional services.
n. k) You acknowledge that Business Associate agrees is not required by this BAA to make disclosures of Protected Health Information to Individuals or any person other than you, and that Business Associate does not, therefore, expect to maintain documentation of such disclosure as described in 45 CFR § 164.528. In the event that Business Associate does make such disclosure, it shall document such Disclosures of PHI and information related to such Disclosures the disclosure as would be required for DOM you to respond to a request by an Individual for an accounting of Disclosures of PHI disclosures in accordance with 45 CFR § §164.504(e)(2)(ii)(G) and §164.528. Business Associate agrees to retain , and shall provide such documentation for at least six (6) years after to you promptly on your request. In the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to event that a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated is made directly to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy RuleAssociate, Business Associate will comply with the requirements of the Privacy Rule that apply shall, within 2 Business Days, forward such request to DOM in the performance of such obligationCustomer.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 2 contracts
Samples: Impero Services Agreement, Impero Services Agreement
Obligations and Activities of Business Associate. a. (a) Business Associate agrees to not Use use or Disclose further disclose PHI other than as permitted or required by the Service Agreement or as Required by Law, or as otherwise permitted or as required by this Agreement.
b. (b) Business Associate shall agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of PHI other than as provided for by this Agreement and to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of any electronic PHI that it creates, receives, maintains, or transmits on behalf of Covered Entity pursuant to this Agreement.
c. , in accordance with 42 CFR Part 2 (the Confidentiality Rule) and 45 CFR §164 (the HIPAA Security Rule). Business Associate agrees to notify DOM without unreasonable delay fully comply with the responsibilities of Business Associates as set forth in Sections 13401 and no later than seventy-two (72) hours after discovery, 13404 of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes awarethe HITECH Act.
d. (c) Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsAgreement.
e. (d) Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery report to Covered Entity any use or disclosure of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410PHI not provided for by this Agreement. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOMFurther, Business Associate agrees to report to Covered Entity any security incident, including a breach of Unsecured PHI as defined by the Security Rule, of which it becomes aware. In the event of such a breach:
(1) Business Associate shall promptly notify Covered Entity of a breach when it is discovered. A breach is considered discovered on the first day on which Business Associate knows or should have known of such breach. Such notification shall identify the Individuals (and their contact information) whose Unsecured PHI has, or is reasonably believed to have been, the subject of the breach. Business Associate shall provide a written assessment additional information concerning such breach to determine whether the incident is reportable within ten Covered Entity as requested.
(102) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM Covered Entity or Business Associate, as applicabledetermined by Covered Entity, demonstrates there is shall promptly notify individuals about a low probability the breach of their Unsecured PHI has been compromised or one of the exceptions to the definition of Breach appliesas soon as possible, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more but not later than 60 calendar days after discovery of the IncidentBreach, except where a law enforcement official determines that a notification would impede a criminal investigation or cause damage to national security. Notification shall be in a form and perform such notifications if so required format prescribed by DOM in its sole discretionCovered Entity and shall meet the requirements of Section 13402 of the HITECH Act.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15e) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that createagent, receiveincluding a subcontractor, maintainto whom it provides PHI received from, or transmit protected health information created or received by Business Associate on behalf of the Business Associate agree Covered Entity, agrees to the same restrictions, conditions, restrictions and requirements conditions that apply through this Agreement to Business Associate with respect to such information. Notwithstanding the preceding language of this subsection, Business Associate agrees to ensure acknowledges that any Subcontractors that create, receive, maintainthe PHI received from Covered Entity, or transmit electronic PHI (ePHI) on behalf of created by Business Associate will agree is covered by 42 CFR Part 2 and, therefore, Business Associate is specifically prohibited from disclosing such information to comply with the applicable requirements agents or subcontractors without specific written consent of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreementssubject individual.
l. (f) Business Associate agrees to provide access, at the request of XXX, Covered Entity and in the time and manner designated by XXXCovered Entity, to PHI in a Designated Record Set, to DOM Covered Entity or, as directed by XXXCovered Entity, to an Individual in order to meet the requirements under 45 CFR § §164.524, if the Business Associate has PHI in a Designated Record Set.
m. (g) Business Associate agrees to make any amendment(s) amendments to PHI in a Designated Record Set that DOM the Covered Entity directs or agrees to pursuant to 45 CFR § §164.526 at the request of DOM Covered Entity or an Individual, and in the time and manner designated by XXXCovered Entity, if Business Associate has PHI in a Designated Record Set.
n. (h) Business Associate agrees to make internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of Covered Entity, available to the Covered Entity, or at the request of the Covered Entity, to the Secretary, in a time and manner designated by the Covered Entity or the Secretary, for purposes of the Secretary’s determining Covered Entity’s compliance with the Privacy Rule.
(i) Business Associate agrees to document such Disclosures disclosures of PHI and information related to such Disclosures disclosures as would be required for DOM Covered Entity to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § §164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. (j) Business Associate agrees to provide to DOM Covered Entity or an Individual, in a time and manner designated by DOMCovered Entity, information collected in accordance with section Section (III)(h2)(i) of this Agreement, to permit XXX Covered Entity to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § §164.528.
p. (k) Business Associate hereby acknowledges and agrees that Covered Entity has notified Business Associate that it is required to comply with the confidentiality, disclosure, and redisclosure requirements of Mental Hygiene Law Sections 32.17, 33.13 and 33.16 to the extent that such requirements may be applicable.
(l) Business Associate shall only use or disclose be directly responsible for full compliance with the minimum PHI necessary relevant requirements of the Confidentiality, Privacy, and the Security Rules to perform functions, activities, or services for, or on behalf of, DOM as specified the same extent that Covered Entity is responsible for compliance with such Rules. Business Associate acknowledges that it is subject to civil and criminal penalties for violations of such provisions in the Service Agreements. same manner as if Covered Entity violated such provisions.
(m) Business Associate agrees to comply with resist any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated efforts in judicial proceedings to Business Associate by DOM.
q. Business Associate agrees that obtain access to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM PHI except as expressly provided for in the performance regulations governing the Confidentiality of such obligationAlcohol and Drug Abuse Patient Records, 42 CFR Part 2.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 2 contracts
Samples: Business Associate Agreement, Business Associate Agreement
Obligations and Activities of Business Associate. a. a) Business Associate acknowledges and agrees that it is obligated by law (or upon the effective date of any portion thereof shall be obligated) to meet the applicable provisions of HIPAA and such provisions are incorporated herein and made a part of this Business Associate Agreement. Covered Entity and Business Associate agree that any regulations and/or guidance issued by DHHS with respect to HIPAA that relate to the obligations of business associates shall be deemed incorporated into and made a part of this Business Associate Agreement.
b) In accordance with 45 CFR §164.502(a)(3), Business Associate agrees not to not Use use or Disclose disclose PHI other than as permitted or required by the Service this Business Associate Agreement or as Required by Law.
b. c) Business Associate shall agrees to develop, implement, maintain and use appropriate administrative, technical, and physical safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to that reasonably prevent Use the use or Disclosure disclosure of PHI other than as provided for by this Business Associate Agreement.
c. , in accordance with 45 CFR §§164.306, 310 and 312. Business Associate agrees to notify DOM without unreasonable delay develop, implement, maintain and no later than seventy-two (72) hours after discoveryuse administrative, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes awarephysical, and any Security Incident technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of which it becomes awareElectronic PHI, in accordance with 45 CFR §§164.306, 308, 310, and 312. In accordance with 45 CFR §164.316, Business Associate shall also develop and implement policies and procedures and meet the documentation requirements as and at such time as may be required by HIPAA.
d. d) Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate Associate, of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsBusiness Associate Agreement.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72e) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. CFR §§ 164.502(e)(1)(ii) §164.308, 314 and 164.308(b)(2)502, Business Associate agrees to will ensure that any subcontractors that workforce member or agent, including a vendor or subcontractor, whom Business Associate engages to create, receive, maintain, or transmit protected health information PHI on behalf of the Business Associate agree Associate’s behalf, agrees to the same restrictions, conditions, restrictions and requirements conditions that apply through this Business Associate Agreement to Business Associate with respect to such information, including minimum necessary limitations. Business Associate agrees to will ensure that any Subcontractors that workforce member or agent, including a vendor or subcontractor, whom Business Associate engages to create, receive, maintain, or transmit electronic PHI (ePHIon Business Associate’s behalf, agrees to implement reasonable and appropriate safeguards to ensure the confidentiality, integrity, and availability of the PHI.
f) on behalf At the request of Covered Entity, Business Associate will agree provide Covered Entity, or as directed by Covered Entity, an Individual, access to comply with PHI maintained in a Designated Record Set in a time and manner that is sufficient to meet the applicable requirements of the Security Rule and Privacy Rule 45 CFR § 164.524, and, where required by entering into a Business Associate Agreement and Business Associate HIPAA, shall provide DOM with a copy of all make such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or information available in an electronic copy to DOM’s Privacy Officer format where directed by the Covered Entity.
g) At the written request of Covered Entity, (or if so directed by Covered Entity, at the address included in Section VII(f) written request of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kindan Individual), including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, make any amendment to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order a time and manner that is sufficient to meet the requirements under of 45 CFR § 164.524164.526.
m. h) In accordance with 45 CFR §164.504(e)(2), Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make its internal practices, books, and records, including policies and procedures, and any PHI, relating to the use and disclosure of PHI, available to Covered Entity or to the Secretary for purposes of determining compliance with applicable law. To the extent permitted by law, said disclosures shall be held in strictest confidence by the Covered Entity. Business Associate will provide such access in a time and manner that is sufficient to meet any applicable requirements of applicable law.
i) Business Associate agrees to document and maintain a record of disclosures of PHI and information related to such disclosures, including the date, recipient, and purpose of such disclosures, in a manner that is sufficient for Covered Entity or Business Associate to respond to a request by Covered Entity or an Individual for an Accounting of disclosures of PHI and in accordance with 45 CFR § 164.528. Business Associate further shall provide any additional information where required by HIPAA and any implementing regulations. Unless otherwise provided under HIPAA, Business Associate will maintain the Accounting with respect to each disclosure for at least six years following the date of the disclosure.
j) Business Associate agrees to provide to Covered Entity upon written request, or, as directed by Covered Entity, to an Individual, an Accounting of disclosures in a time and manner that is sufficient to meet the requirements of HIPAA, in accordance with 45 CFR §164.528. In addition, where Business Associate is contacted directly by an Individual-based upon information provided to the Individual by Covered Entity and where so required by HIPAA and/or any implementing regulations, Business Associate shall make such Accounting available directly to the Individual.
k) In accordance with 45 CFR §164.502(b), Business Associate agrees to make reasonable efforts to limit use, disclosure, and/or requests for PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request. Where required by HIPAA, Business Associate shall determine (in its reasonable judgment) what constitutes the minimum necessary to accomplish the intended purpose of a disclosure.
l) In accordance with 45 CFR §502(a)(5), Business Associate shall not directly or indirectly receive remuneration in exchange for any PHI of an Individual, except with the express written pre- approval of Covered Entity.
m) To the extent Business Associate is to carry out one or more obligation(s) of the Covered Entity’s under Subpart E of 45 CFR Part 164, Business Associate shall comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such obligation(s).
n) In accordance with 45 CFR §164.314(a)(1)(i)(C), Business Associate agrees to promptly report to Covered Entity any Security Incident of which Business Associate becomes aware.
o) In accordance with 45 CFR §164.410 and the provisions of this Business Associate Agreement, Business Associate will report to Covered Entity, following Discovery and without unreasonable delay, but in no event later than five business days following Discovery, any Breach of Unsecured Protected Health Information. Business Associate shall cooperate with Covered Entity in investigating the Breach and in meeting Covered Entity’s obligations under HIPAA and any other applicable security breach notification laws, including, but not limited to, providing Covered Entity with such information in addition to Business Associate’s and/or DOM's compliance with report as Covered Entity may reasonably request, e.g., for purposes of Covered Entity making an assessment as to whether/what Breach Notification is required. Business Associate’s report under this subsection shall, to the Privacy Rule pursuant to 45 C.F.R. § 160.310.extent available at the time the initial report is required, or as promptly thereafter as such information becomes available but no later than 30 days from discovery, include:
s. Business Associate agrees that nothing in this Agreement shall permit 1. The identification (if known) of each Individual whose Unsecured Protected Health Information has been, or is reasonably believed by Business Associate to have been, accessed, acquired, or disclosed during such Breach;
2. A description of the nature of the unauthorized acquisition, access, storeuse, share, maintain, transmit or use or disclose PHI in any form via any medium with any third partydisclosure, including the date of the Breach and the date of discovery of the Breach;
3. A description of the type of Unsecured PHI acquired, accessed, used or disclosed in the Breach (e.g., full name, Social Security number, date of birth, etc.);
4. The identity of the individual(s) who made and who received the unauthorized acquisition, access, use, or disclosure;
5. A description of what Business Associate is doing to investigate the Breach, to mitigate losses, and to protect against any further breaches; and
6. Contact information for Business Associate’s Subcontractorsrepresentatives knowledgeable about the Breach.
p) Business Associate shall maintain for a period of six years all information required to be reported under paragraph "o". This records retention requirement does not in any manner change the obligation to timely disclose all required information relating to a non-permitted acquisition, beyond access, use or disclosure of Protected Health Information to the boundaries County Privacy Officer and jurisdiction of the United States without express written authorization from DOMCounty Project Officer or designee five business days following Discovery.
Appears in 2 contracts
Samples: Rider Agreement, Agreement No. 22 DHS Sfa 668
Obligations and Activities of Business Associate. a. (a) Business Associate agrees to not Use use or Disclose PHI other than disclose Protected Health Information only as permitted or required by the Service this Agreement or as Required by Law.
b. (b) Business Associate shall agrees to use reasonable and appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) security measures to prevent Use or Disclosure of PHI Protected Health Information other than as provided for by this Agreement.
c. . Business Associate agrees to notify DOM without unreasonable delay implement reasonable and no later than seventy-two (72) hours after discoveryappropriate administrative, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes awaretechnical, and any Security Incident physical measures to protect the confidentiality, integrity, and availability of which it becomes awareElectronic Protected Health Information as required by HIPAA.
d. (c) Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI Protected Health Information by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsAgreement.
e. (d) Business Associate agrees to notify DOM without unreasonable delayreport any Use or Disclosure of Protected Health Information not provided for by this Agreement of which Business Associate becomes aware including any Breach of unsecured Protected Health Information, and no later than seventy-two (72) hours after discovery any successful Security Incident of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410which it becomes aware. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a make the written assessment report to determine whether the incident is reportable within Covered Entity without unreasonable delay but in no event later than ten (10) working days. An impermissible business days after Business Associate learns of such unauthorized Use or Disclosure of protected health information is presumed to be a Breach unless the DOM Disclosure, Breach, or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Security Incident. Business Associate agrees to fully cooperate, coordinate with, and assist XXX cooperate with Covered Entity in gathering information necessary to notify investigating the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, Breach and in meeting the Covered Entity’s obligations under HIPAA and any other applicable security breach notification laws. To avoid unnecessary burden on either party, Business Associate shall only be required to report, upon the Covered Entity’s request, successful Security Incidents which Business Associate becomes aware; provided that the Covered Entity’s request shall be made no case more often than 60 days after discovery of is reasonable based upon the Incidentrelevant facts, circumstances and perform such notifications if so required by DOM in its sole discretionindustry standards.
h. (e) Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident enter into a written corrective action plan agreement with each Subcontractor (“CAP”including, without limitation, a Subcontractor that is an agent under applicable law) describingthat creates, at a minimumreceives, maintains or transmits Protected Health Information on behalf of Business Associate, which agreement shall both meet the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii164.504(e) and 164.308(b)(2), Business Associate agrees 164.314(a)(2) and obligate the Subcontractor to ensure comply with restrictions and conditions that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of are at least as restrictive as the Business Associate agree to the same restrictions, conditions, restrictions and requirements conditions that apply to Business Associate with respect under this Agreement, all to such informationthe extent required by HIPAA. Notwithstanding the foregoing, Covered Entity acknowledges that Business Associate is not required to execute Business Associate Agreements prior to disclosing Protected Health Information to (a) employees of its wholly owned subsidiaries, and (b) individuals who are part of Business Associate’s workforce but are on staff as independent contractors. Business Associate agrees to ensure that remain responsible for any Subcontractors that create, receive, maintain, breach of this Agreement by such independent contractors or transmit electronic PHI (ePHI) on behalf employees of wholly owned subsidiaries as if the independent contractors and/or employees of wholly owned subsidiaries were employees of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. Business Associate agrees to make any amendment(s(f) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and proceduresprocedures and Protected Health Information, relating to the Use and Disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity, available to the Secretary Secretary, in a time and manner as reasonably requested by or designated by the Secretary, for purposes of the Secretary determining Business AssociateCovered Entity’s and/or DOM's compliance with the Privacy Rule Rule.
(g) Business Associate agrees to document such Disclosures of Protected Health Information and information related to such Disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of Disclosures of Protected Health Information in accordance with 45 C.F.R. § 164.528. Within ten (10) business days’ notice by Covered Entity to Business Associate that Covered Entity has received a request for an accounting of Disclosures of Protected Health Information (other than Disclosures to which an exception to the accounting requirement applies), Business Associate agrees to make such documentation available to Covered Entity as necessary for Covered Entity to make the accounting required by 45 C.F.R. § 164.528.
(h) Business Associate agrees to provide access to Protected Health Information about an Individual at the request of Covered Entity, and in the time and manner as reasonably requested by Covered Entity, but no later than ten (10) business days, to Covered Entity or, as directed by Covered Entity, to an Individual, in order to meet the requirements under 45 C.F.R. § 164.524. If Business Associate receives a request for access to Protected Health Information directly from an Individual, Business Associate agrees to forward such request to Covered Entity within five (5) business days.
(i) Business Associate agrees to make any amendment(s) to Protected Health Information that the Covered Entity directs or agrees to pursuant to 45 C.F.R. § 160.310.
s. 164.526 at the request of Covered Entity, and in the time and manner mutually agreed by the parties. If Business Associate receives a request for amendment to Protected Health Information directly from an Individual, Business Associate agrees that nothing in this Agreement shall permit to forward such request to Covered Entity within five (5) business days.
(j) To the extent reasonable and/or required by applicable law, Business Associate agrees to accesscomply with the determination of a request for restriction to the Use or Disclosure of Protected Health Information and/or determination of a request for alternative methods of confidential communication pursuant to 45 C.F.R § 164.522 at the request of Covered Entity, storeand in the time and manner mutually agreed to by the parties acting reasonably and in good faith. If Business Associate receives a request for restriction to the Use or Disclosure of Protected Health Information and/or request for alternative methods of confidential communication directly from an Individual, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOMAssociate agrees to forward such request to Covered Entity within five (5) business days.
Appears in 2 contracts
Samples: Campuspass Solution License Agreement, Workforce Safety Subscription Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use use or Disclose PHI disclose Protected Health Information other than as permitted or required by the Service Agreement or as Required required by Lawlaw.
b. Business Associate shall agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of PHI the Protected Health Information other than as provided for by this Agreement.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, report to Covered Entity any use or disclosure of any Use or Disclosure of PHI the Protected Health Information not provided for by this Agreement of which it becomes aware, and any Security Incident including breaches of which it becomes awareunsecured protected health information, as required at 45 C.F.R. 164.410.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to if applicable, ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information.
e. Report to the Covered Entity any security incident of which it becomes aware.
f. Business Associate shall notify the Covered Entity of a breach of unsecured PHI on the first day on which such breach is known by Business Associate or an employee, officer or agent of Business Associate other than the person committing the breach, or as soon as possible following the first day on which Business Associate or an employee, officer or agent of Business Associate other than the person committing the breach should have known by exercising reasonable diligence of such breach. Notification shall include, to the extent possible, the identification of each individual whose unsecured PHI has been, or is reasonably believed by the Business Associate to have been, accessed, acquired, used or disclosed during the breach. Business Associate agrees shall also provide the Covered Entity with any other available information at the time Business Associate makes notification to ensure the Covered Entity or promptly thereafter as information becomes available. Such additional information shall include (i) a brief description of what happened, including the date of the breach; (ii) a description of the types of unsecured PHI that were involved in the breach; (iii) any Subcontractors steps the Business Associate believes individuals should take to protect themselves from potential harm resulting from the breach; and (iv) a brief description of what Business Associate is doing to investigate the breach, mitigate harm to individuals, and protect against any future breaches. For purposes of this paragraph, unsecured PHI means protected health information that createis not rendered unusable, receive, maintainunreadable, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree indecipherable to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of unauthorized persons through the use of such Subcontractors a technology or methodology specified by the U.S. Secretary of the adequacy of such agreementsHealth and Human Services.
l. g. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, Covered Entity to PHI in a Designated Record Set, Protected Health Information to DOM Covered Entity or, as directed by XXXCovered Entity, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. h. Business Associate agrees to make internal practices, books, and records, including policies and proceduresprocedures and Protected Health Information, available to the Secretary of the U.S. Department of Health and Human Services for purposes the purpose of determining Business Associate’s and/or DOM's compliance with the Privacy Rule HIPAA Rules.
i. Business Associate agrees to document and provide to Covered Entity such disclosures of Protected Health Information and information as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.
j. Make any amendment(s) to Protected Health Information in a designated record set as directed or agreed to by the covered entity pursuant to 45 C.F.R. § 160.310164.526, or take other measures as necessary to satisfy covered entity's obligations under 45 C.F.R. 164.526.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 2 contracts
Samples: Business Associate Agreement, Business Associate Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use or Disclose PHI other than comply with those provisions of the Security Rule that are set forth at 45 C.F.R. §§ 164.308, 164.310, 164.312, and 164.316, as permitted or required by amended from time to time, with respect the Service Agreement or as Required by Lawsecurity of PHI, in the same manner that such regulations apply to the Provider.
b. Business Associate agrees to comply with the Privacy Rule at 45 C.F.R. § 164.504(e), as amended from time to time, with respect to its use and disclosure of PHI, in the same manner that such regulation applies to Provider. The additional requirements of the HITECH Act that relate to privacy and that are made applicable with respect to covered entities shall also be applicable to Business Associate and shall be and by this reference hereby are incorporated into the Business Associate Agreement.
c. Business Associate agrees to not use or further disclose PHI other than as specifically permitted or required by this Agreement or as required by law.
d. Business Associate agrees to use appropriate safeguards and comply comply, where applicable, with Subpart C of 45 C.F.R. CFR Part 164 with respect to electronic PHI (ePHI) Electronic PHI, to prevent Use use or Disclosure disclosure of PHI other than as provided for by this Agreement.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. e. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsAgreement.
e. f. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery report to Provider if it becomes aware of any actual use or suspected disclosure of PHI not provided for by this Agreement, including any Breach of Unsecured PHIPHI as required by 45 CFR 164.410, all in accordance with 45 C.F.R. § 164.410and any Security Incident of which it becomes aware. The notification shall include, Notwithstanding anything herein to the extent possible and subsequently as the information becomes availablecontrary, the identification of all Individuals whose Unsecured PHI is reasonably believed by parties acknowledge and agree that this Agreement shall constitute notice to Provider that Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individualmay periodically experience broadcast attacks on its firewall, HHSport scans, and/or the mediaunsuccessful log-on attempts, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOMdenials of service and similar unsuccessful security incidents, and Business Associate agrees need not further report such incidents to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use Provider so long as such incidents do not result in unauthorized access, use or Disclosure disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410PHI.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will on behalf of Provider agree to comply with the applicable requirements of the Security Rule same restrictions and Privacy Rule by entering into a conditions that apply to Business Associate Agreement and Business Associate shall provide DOM with a copy respect to such information, including, without limitation, implementation of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior appropriate safeguards to disclosing any protect the security of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreementsElectronic PHI.
l. h. Upon the written request of Provider, Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, access to Provider to PHI that Business Associate maintains in a Designated Record SetSet (if in fact its arrangements with Provider require Business Associate to maintain Designated Record Sets on behalf of Provider), to DOM or, as directed by XXX, to an Individual in order for Provider to meet the Patient access and copying requirements under 45 CFR § 164.524. If Business Associate maintains an electronic health record which contains the PHI, Business Associate shall provide such information produced in accordance with this section 2(h) in electronic format to enable Provider to fulfill its obligations under applicable regulations.
m. i. Upon the written request of Provider, Business Associate agrees to make any amendment(s) to PHI that Business Associate maintains in a Designated Record Set (if in fact its arrangements with Provider require Business Associates to maintain Designated Record Sets on behalf of Provider), that DOM the Provider directs or agrees to pursuant to 45 CFR § 164.526 164.526.
j. Business Associate agrees to make its internal practices, books and records relating to the use and disclosure of PHI available at the request of DOM the Provider to the Secretary, for purposes of determining Provider’s compliance with the Privacy Rule, subject to attorney-client or an Individual, and in the time and manner designated by XXXother applicable legal privileges.
n. k. Business Associate agrees to document such Disclosures disclosures of PHI and information related to such Disclosures disclosures as would be required for DOM Provider to respond to a request by an Individual Patient for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees , as may be amended from time to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of terminationtime.
o. l. Upon written request of Provider, Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, Provider with information collected in accordance with section (III)(h) Section II.k of this Agreement, Agreement to permit XXX Provider to respond to a request by an Individual Patient for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. m. Business Associate agrees that to the extent that Business Associate carries it is to carry out DOMProvider’s obligations obligation under the Privacy Rule, Business Associate Rule that it will comply with the requirements of the Privacy Rule that apply to DOM Provider in the performance of such obligation.
r. n. Business Associate agrees to make internal practicesnotify Provider without unreasonable delay, books, and records, including policies and procedures, available but in no event more than 60 days after Business Associate becomes aware of an unauthorized use or disclosure by or on behalf of Business Associate which constitutes a Breach of Unsecured PHI unless it receives a request to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule delay such notification from a law enforcement official pursuant to 45 C.F.R. § 160.310CFR 164.412. Such notification shall include a list of impacted Patients, and describe the Breach in such reasonable detail to enable Provider to fulfill its obligations under applicable regulations.
s. o. Upon written request of Provider, Business Associate agrees will comply with a Patient request for restriction of certain disclosures to health plans in accordance with 45 CFR 164.522 and the HITECH Act, if the disclosure is to a health care plan for the purposes of carrying out payment or health care operations and the PHI pertains solely to a health care item or service for which Patient has paid for out of pocket in full. Except to the extent that nothing in this Agreement shall permit Provider must agree to a Patient request for restriction under the HITECH Act, Business Associate shall not be required to access, store, share, maintain, transmit or comply with a Patient’s request to restrict the use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction disclosure of the United States without express written authorization from DOMPHI.
Appears in 2 contracts
Samples: Business Associate Agreement, Business Associate Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use or Disclose PHI other than as permitted or required by the Service this Agreement or as Required by By Law.
b. Business Associate shall agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent the Use or Disclosure of PHI other than as provided for by this Agreement. Business Associate further agrees to implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of any electronic PHI, as provided for in the Security Rule and as mandated by Section 13401 of the HITECH Act.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement. Business Associate further agrees to report to Covered Entity any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsin a manner as prescribed in this Agreement.
e. d. Business Associate agrees to notify DOM without unreasonable delayreport to Covered Entity any Security Incident, and no later than seventy-two (72) hours after discovery including all data Breaches or compromises, whether internal or external, related to PHI, whether the PHI is secured or unsecured, of any actual or suspected Breach of which Business Associate becomes aware.
e. If the Breach, as discussed in paragraph 2(d), pertains to Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, then Business Associate agrees to provide a written assessment report any such data Breach to determine whether the incident is reportable Covered Entity within ten (10) working daysbusiness days of discovery of the Breach; all other compromises, or attempted compromises, of PHI must be reported to Covered Entity within twenty (20) business days of discovery. An impermissible Use or Disclosure Business Associate further agrees, consistent with Section 13402 of protected health the HITECH Act, to provide Covered Entity with information is presumed necessary for Covered Entity to meet the requirements of the HITECH Act, and in a manner and format to be specified by Covered Entity.
f. If Business Associate is an Agent of Covered Entity, then Business Associate agrees that any Breach of Unsecured PHI will be reported to Covered Entity immediately after the Business Associate becomes aware of the Breach, and under no circumstances later than one (1) business day after the Breach. Business Associate further agrees that any compromise, or attempted compromise, of PHI, other than a Breach unless of Unsecured PHI as specified in 2(e) of this Agreement, must be reported to Covered Entity within ten (10) business days of discovering the DOM compromise, or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410attempted compromise.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident areSubcontractor, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. whom Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or provides PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, restrictions and requirements conditions that apply through this Agreement to Business Associate with respect to such information. Business Associate further agrees that restrictions and conditions analogous to those contained in this Agreement will be imposed on the Subcontractors via a written agreement that complies with all the requirements specified in §164.504(e)(2), and that Business Associate may only provide the Subcontractors PHI consistent with Section 13405(b) of the HITECH Act. Further, Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements provide copies of the Security Rule and Privacy Rule by entering into written agreements to Covered Entity within ten (10) business days of a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business AssociateCovered Entity’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a request for the written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. h. Business Associate agrees to provide access, at the request of XXX, Covered Entity and in the time and manner designated by XXXduring normal business hours, to PHI in a Designated Record Set, Set to DOM Covered Entity or, as directed by XXXCovered Entity, to an Individual Individual, in order to meet the Covered Entity’s requirements under 45 CFR § §164.524, provided that Covered Entity delivers to Business Associate a written notice at least three (3) business days in advance of requesting such access. Business Associate further agrees, in the case where Business Associate controls access to PHI in an Electronic Health Record, or controls access to PHI stored electronically in any format, to provide similar access in order for Covered Entity to meet its requirements under the HIPAA Rules and under Section 13405(c) of the HITECH Act. These provisions do not apply if Business Associate and its employees or Subcontractors have no PHI in a Designated Record Set of Covered Entity.
m. i. Business Associate agrees to make any amendment(s) amendments to PHI in a Designated Record Set that DOM Covered Entity directs or agrees to pursuant to 45 CFR § 164.526 §164.526, at the request of DOM Covered Entity or an Individual, . This provision does not apply if Business Associate and in the time and manner designated by XXXits employees or Subcontractors have no PHI from a Designated Record Set of Covered Entity.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request j. Unless otherwise protected or prohibited from discovery or disclosure by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individuallaw, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and proceduresprocedures (collectively “Compliance Information”), relating to the Use or Disclosure of PHI and the protection of PHI, available to the Covered Entity or to the Secretary for purposes of the Secretary determining Covered Entity’s compliance with the HIPAA Rules and the HITECH Act. Business Associate further agrees, at the request of Covered Entity, to provide Covered Entity with demonstrable evidence that its Compliance Information ensures Business Associate’s and/or DOM's compliance with this Agreement over time. Business Associate will have a reasonable time within which to comply with requests for such access or demonstrable evidence, consistent with this Agreement. In no case may access, or demonstrable evidence, be required in less than five (5) business days after Business Associate’s receipt of such request, unless otherwise designated by the Privacy Rule pursuant to 45 C.F.R. § 160.310Secretary.
s. k. Business Associate agrees that nothing to maintain necessary and sufficient documentation of Disclosures of PHI as would be required for Covered Entity to respond to a request by an Individual for an accounting of such Disclosures, in accordance with 45 CFR §164.528.
l. On request of Covered Entity, Business Associate agrees to provide to Covered Entity documentation made in accordance with this Agreement to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. §164.528. Business Associate shall provide the documentation in a manner and format to be specified by Covered Entity. Business Associate will have a reasonable time within which to comply with such a request from Covered Entity and in no case may Business Associate be required to provide such documentation in less than three (3) business days after Business Associate's receipt of such request.
m. Except as provided for in this Agreement shall permit Agreement, in the event Business Associate to receives an access, storeamendment, shareaccounting of disclosure, maintainor other similar request directly from an Individual, transmit Business Associate shall redirect the Individual to the Covered Entity.
n. To the extent that Business Associate carries out one or use more of Covered Entity’s obligations under the HIPAA Rules, the Business Associate must comply with all requirements of the HIPAA Rules that would be applicable to the Covered Entity.
o. Business Associate must honor all restrictions consistent with 45 C.F.R. §164.522 that the Covered Entity or disclose PHI in any form via any medium with any third partythe Individual makes the Business Associate aware of, including Business Associatethe Individual’s Subcontractorsright to restrict certain disclosures of PHI to a health plan where the individual pays out of pocket in full for the healthcare item or service, beyond the boundaries and jurisdiction in accordance with Section 13405(a) of the United States without express written authorization from DOMHITECH Act.
Appears in 2 contracts
Samples: Business Associate Agreement, Group Vision Plan Insurance Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use or Disclose comply with those provisions of the Security Rule that are set forth at 45 C.F.R. §§ 164.308, 164.310, 164.312, and 164.316, as amended from time to time, with respect the security of PHI, in the same manner that such regulations apply to the Provider. Any additional requirements of the HITECH Act that relate to security of PHI other than as permitted or required and that are made applicable with respect to covered entities shall also be applicable to Business Associate and shall be and by the Service Agreement or as Required by Lawthis reference hereby are incorporated into this Business Associate Agreement.
b. Business Associate shall use appropriate safeguards and agrees to comply with Subpart C of the Privacy Rule at 45 C.F.R. Part 164 § 164.504(e), as amended from time to time, with respect to electronic its use and disclosure of PHI, in the same manner that such regulation applies to Provider. The additional requirements of the HITECH Act that relate to privacy and that are made applicable with respect to covered entities shall also be applicable to Business Associate and shall be and by this reference hereby are incorporated into the Business Associate Agreement.
c. Business Associate agrees to not use or further disclose PHI other than as specifically permitted or required by this Agreement or as required by law.
d. Business Associate agrees to use appropriate Administrative, Technical, and Physical Safeguards to (ePHI1) to prevent Use use or Disclosure disclosure of PHI other than as provided for by this Agreement; and (2) reasonably and appropriately protect the Confidentiality, Integrity and Availability of Electronic PHI.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. e. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsAgreement.
e. f. Business Associate agrees to notify DOM without unreasonable delayreport to Provider if it becomes aware of any (1) use or disclosure of PHI not provided for by this Agreement; (2) unauthorized access of Electronic PHI; (3) unauthorized destruction or modification of Electronic PHI; or (4) unauthorized interference with the systems operations of Business Associate’s electronic information systems containing Electronic PHI. Notwithstanding anything herein to the contrary, the parties acknowledge and agree that this Agreement shall constitute notice to Provider that Business Associate may periodically experience broadcast attacks on its firewall, port scans, unsuccessful log-on attempts, denials of service and similar unsuccessful security incidents, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate need not further report such incidents to have been Breached along with any other available information that is required to be included Provider so long as such incidents do not result in the notification to the Individualunauthorized access, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual use or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410PHI.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident areagent, subject including a sub-contractor, to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required whom it provides PHI created or received by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree Provider, agrees to substantially the same restrictions, conditions, restrictions and requirements conditions that apply through this Agreement to Business Associate with respect to such information. Business Associate agrees , including, without limitation, implementation of appropriate safeguards to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf protect the security of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreementsElectronic PHI.
l. h. Upon the written request of Provider, Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, access to Provider to PHI that Business Associate maintains in a Designated Record SetSet (if in fact its arrangements with Provider require Business Associate to maintain Designated Record Sets on behalf of Provider), to DOM or, as directed by XXX, to an Individual in order for Provider to meet the Patient access and copying requirements under 45 CFR § 164.524. If Business Associate maintains an electronic health record which contains the PHI, Business Associate shall provide such information produced in accordance with this section 2(h) in electronic format to enable Provider to fulfill its obligations under applicable regulations.
m. i. Upon the written request of Provider, Business Associate agrees to make any amendment(s) to PHI that Business Associate maintains in a Designated Record Set (if in fact its arrangements with Provider require Business Associates to maintain Designated Record Sets on behalf of Provider), that DOM the Provider directs or agrees to pursuant to 45 CFR § 164.526 164.526.
j. Business Associate agrees to make its internal practices, books and records relating to the use and disclosure of PHI available at the request of DOM the Provider to the Secretary, for purposes of determining Provider’s compliance with the Privacy Rule, subject to attorney-client or an Individual, and in the time and manner designated by XXXother applicable legal privileges.
n. k. Business Associate agrees to document such Disclosures disclosures of PHI and information related to such Disclosures disclosures as would be required for DOM Provider to respond to a request by an Individual Patient for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees , as may be amended from time to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of terminationtime.
o. l. Upon written request of Provider, Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, Provider with information collected in accordance with section (III)(h) Section II.i. of this Agreement, Agreement to permit XXX Provider to respond to a request by an Individual Patient for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. m. Business Associate agrees to comply with any guidance issued notify Provider without unreasonable delay, but in no event more than 60 days after Business Associate becomes aware of an unauthorized use or disclosure by the Secretary or on what behalf of Business Associate which constitutes “minimum necessary” for purposes a Breach of the Privacy RuleUnsecured PHI. Such notification shall include a list of impacted Patients, and any minimum necessary policies and procedures communicated to Business Associate by DOMdescribe the Breach in such reasonable detail.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rulen. Upon written request of Provider, Business Associate will comply with a Patient request for restriction of certain disclosures to health plans in accordance with 45 CFR 164.522 and the requirements HITECH Act, if the disclosure is to a health care plan for the purposes of carrying out payment or health care operations and the Privacy Rule PHI pertains solely to a health care item or service for which Patient has paid for out of pocket in full. Except to the extent that apply Provider must agree to DOM in a Patient request for restriction under the performance of such obligation.
r. HITECH Act, Business Associate agrees shall not be required to make internal practices, books, and records, including policies and procedures, available comply with a Patient’s request to restrict the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction disclosure of the United States without express written authorization from DOMPHI.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. (a) Business Associate agrees to not Use use or Disclose PHI further disclose Protected Health Information other than as permitted or required by the Service Agreement this BAA or as Required by Law.
b. . Business Associate shall also comply with any further limitations on uses and disclosures agreed by Covered Entity in accordance with 45 C.F.R. 164.522 provided that such agreed upon limitations have been communicated to Business Associate in accordance with Section 4.1(c) of this BAA.
(b) Business Associate agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of PHI the Protected Health Information other than as provided for by this AgreementBAA, including but not limited to the safeguards described in Section 2(m) of this BAA.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72c) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI Protected Health Information by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsBAA.
e. (d) Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two promptly report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this BAA of which it becomes aware.
(72e) hours after discovery of Business Associate agrees to report to Covered Entity any actual or suspected Breach of Unsecured PHI, all Protected Health Information without unreasonable delay and in accordance with 45 C.F.R. § 164.410no case later than five (5) Business days after Discovery of a Breach. The notification Such notice shall include, to the extent possible and subsequently as the information becomes available, include the identification of all Individuals each Individual whose Unsecured PHI Protected Health Information has been, or is reasonably believed by Business Associate Associate, to have been Breached along been, accessed, acquired, or disclosed In connection with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOMsuch Breach. In addition, Business Associate agrees to shall provide a written assessment to determine whether any additional information reasonably requested by Covered Entity for purposes of investigating the incident is reportable within ten (10) working daysBreach. An impermissible Use or Disclosure Business Associate’s notification of protected health information is presumed to be a Breach unless under this section shall comply in all respects with each applicable provision of Section 13400 of Subtitle D (Privacy) of AXXX, 00 XXX 164.410, and related guidance issued by the DOM Secretary from time to time. Without limiting Covered Entity’s remedies under Section 6 or any other provision of this BAA, in the event of a Breach involving Unsecured Protected Health Information maintained, used or disclosed by Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees shall reimburse Covered Entity for the cost of providing any legally required notice to fully cooperate, coordinate with, affected Individuals and assist XXX in gathering information the cost of credit monitoring for such Individuals to extent deemed necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM Covered Entity in its sole reasonable discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15f) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(iiCFR 164.502(e)(l)(ii) and 164.308(b)(2), if applicable, Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information Protected Health Information on behalf of the Business Associate agree in writing to the same restrictions, conditions, restrictions and requirements conditions that apply through this BAA to Business Associate with respect to such information. In no event shall Business Associate, without Covered Entity’s prior written approval, provide Protected Health Information received from, or created or received by Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree Covered Entity, to comply with any employee or agent, including a subcontractor, if such employee, agent or subcontractor receives, processes or otherwise has access to the applicable requirements Protected Health Information outside of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreementsUnited States.
l. (g) Business Associate agrees to provide access, at the request of XXXCovered Entity, and in within ten (10) business days of the time and manner designated by XXXrequest from Covered Entity, to PHI Protected Health Information in a Designated Record Set, to DOM Covered Entity or, as directed by XXXCovered Entity, to an Individual in order to meet the requirements under 45 CFR § C.F.R. 164.524. Covered Entity’s determination of what constitutes “Protected Health Information” or a “Designated Record Set” shall be final and conclusive. If Business Associate provides copies or summaries of Protected Health Information to an Individual it may impose a reasonable, cost-based fee in accordance with 45 C.F.R. 164.524 (c)(4).
m. (h) Business Associate agrees to make any amendment(s) to PHI Protected Health Information in a Designated Record Set that DOM the Covered Entity directs or agrees to pursuant to 45 CFR § C.F.R. 164.526 at the request of DOM Covered Entity or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures within ten (10) business days of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528Covered Entity. Business Associate agrees shall not charge any fee for fulfilling requests for amendments. Covered Entity’s determination of what Protected Health Information is subject to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting amendment pursuant to 45 C.F.R. 164.526 shall be final and relevant documentation to DOM at the time of terminationconclusive.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(hi) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make (i) internal practices, books, and records, including policies and procedures, relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity, and (ii) policies, procedures, and documentation relating to the safeguarding of Electronic Protected Health Information available to the Secretary Covered Entity, or at the request of the Covered Entity to the Secretary, in a time and manner designated by the Covered Entity or the Secretary, for purposes of the Secretary determining Covered Entity’s or Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310and Security Rules.
s. (j) Business Associate agrees that nothing to document such disclosures of Protected Health Information as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in this Agreement shall permit accordance with 45 C.F.R. 164.528.
(k) Business Associate agrees to accessprovide to Covered Entity, storein the time and manner described below, sharethe information collected in accordance with Section 2(j) of this BAA, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 C.F.R. 164.528. Business Associate agrees to provide such information to Covered Entity within thirty (30) business days of receipt of a request from Covered Entity.
(l) Business Associate acknowledges that it shall request from the Covered Entity and so disclose to its affiliates, Licensed Agents and subcontractors or other third parties, (i) the information contained in a “limited data set,” as such term is defined at 45 C.F.R. 164.514(e)(2), or, (ii) if needed by Business Associate, to the minimum necessary to accomplish the intended purpose of such requests or disclosures, in all cases, Business Associate shall request and disclose Protected Health Information only in a manner that is consistent with guidance issued by the Secretary from time to time.
(m) With respect to Electronic Protected Health Information, Business Associate shall implement and comply with (and ensure that its subcontractors implement and comply with) the administrative safeguards set forth at 45 C.F.R. 164.308, the physical safeguards set forth at 45 C.F.R. 310, the technical safeguards set forth at 45 C.F.R. 164.312, and the policies and procedures set forth at 45 C.F.R. 164.316 to reasonably and appropriately protect the confidentiality, integrity, and availability of the Electronic Protected Health Information that it creates, receives, maintains, or transmits on behalf of Covered Entity. Business Associate acknowledges that, (i) the foregoing safeguard, policies and procedures requirements shall apply to Business Associate in the same manner that such requirements apply to Covered Entity, and (ii) Business Associate shall be liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. 1320d-5 and 1320d-6, as amended from time to time, for failure to comply with the safeguard, policies and procedures requirements and any guidance issued by the Secretary from time to time with respect to such requirements.
(n) With respect to Electronic Protected Health Information, Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit or use or disclose PHI in Electronic Protected Health Information on behalf of Business Associate, agree to comply with the applicable requirements of Subpart C of 45 C.F.R. Part 164 by entering into a contract that complies with 45 C.F.R. Section 164.314.
(o) Business Associate shall report to Covered Entity any form via any medium with any third partySecurity Incident of which it becomes aware, including Breaches of Unsecured Protected Health Information as required by 45 C.F.R. Section 164.410.
(p) If Business Associate conducts any Standard Transactions on behalf of Covered Entity, Business Associate shall comply with the applicable requirements of 45 C.F.R. Parts 160- 162.
(q) During the term of this BAA, Business Associate may be asked to complete a security survey and/or attestation document designed to assist Covered Entity in understanding and documenting Business Associate’s Subcontractorssecurity procedures and compliance with the requirements contained herein. Business Associate’s failure to complete either of these documents within the reasonable timeframe specified by Covered Entity shall constitute a material breach of this BAA.
(r) Business Associate acknowledges that, beyond the boundaries and jurisdiction as of the United States without express written authorization Effective Date, it shall be liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. 1320d-5 and 1320d-6, as amended from DOMtime to time, for failure to comply with any of the use and disclosure requirements of this BAA and any guidance issued by the Secretary from time to time with respect to such use and disclosure requirements.
(s) To the extent Business Associate is to carry out one or more of Covered Entity’s obligation(s) under Subpart E of 45 CFR Part 164, Business Associate shall comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligation(s).
(t) To the extent that Business Associate provides services to Covered Entity relating to individuals enrolled in state or federal programs (e.g., Medicare or Medicaid), Business Associate shall comply with any additional restrictions or requirements related to the use, disclosure, maintenance, and protection of Protected Health Information of individuals enrolled in such programs through Covered Entity. With respect to the Protected Health Information of Medicare enrollees, Business Associate shall report privacy and security incidents and/or Breaches immediately, but not later than one (1) day, to Covered Entity and include the information required under this Section 2 of this Addendum.
Appears in 1 contract
Samples: Upline Marketing Agreement (GRANDPARENTS.COM, Inc.)
Obligations and Activities of Business Associate. a. 2.1. Business Associate agrees to shall not Use use or Disclose PHI disclose Protected Health Information other than as permitted or required by the Service Agreement this BAA or as Required by Law.
b. 2.2. Business Associate shall agrees to use appropriate physical, technical, and administrative safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of PHI Protected Health Information other than as provided for by this AgreementBAA. These safeguards shall include, but not be limited to, policies and procedures for reasonably and appropriately protecting the confidentiality, integrity and availability of Electronic Protected Health Information. With respect to such information, Business Associate shall meet the requirements of the Security Rule that apply to business associates.
c. 2.3. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, report in writing to Covered Entity any use or disclosure of any Use or Disclosure of PHI Protected Health Information not provided for by this Agreement BAA and any Security Incidents within the meaning of 45 CFR § 164.304, of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that . Notice is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delaydeemed provided, and no later than seventy-two (72) hours after discovery further notice will be given, with respect to routine unsuccessful attempts at unauthorized access to ePHI such as pings and other broadcast attacks on firewalls, denial of any actual or suspected service attacks, failed login attempts, and port scans. Business Associate shall provide a summary of such unsuccessful Security Incidents, at an aggregate level, upon request of Covered Entity once a year. In the event of a Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed Protected Health Information by Business Associate, Business Associate to have been Breached along with any other available information that is required to be included in shall notify Covered Entity of the notification to the Individual, HHS, and/or the media, all Breach in accordance with the data Breach notification requirements set forth in under 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. CFR § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent . Incidents under this section shall be reported without unreasonable delay, delay and in no case more later than 60 thirty (30) calendar days after discovery of the Incidentincident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees unless a law enforcement delay applies pursuant to be solely responsible for all costs and expenses incurred as 45 CFR § 164.412. In the event of a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental law enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2)delay, Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of shall notify Covered Entity within the time frame required by such section.
2.4. Business Associate shall, through written agreement, require any Subcontractor to agree to the same restrictions, conditions, restrictions and requirements conditions at least as strict as those that apply through this BAA to Business Associate with respect to such informationProtected Health Information. Business Associate agrees may disclose all or some of the terms of this BAA to ensure that any of its Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of to secure its compliance with such restrictions and conditions.
2.5. To the extent Business Associate will agree maintains in its systems Covered Entity’s Protected Health Information, and at Covered Entity’s reasonable and timely request, pursuant to comply with the applicable requirements of the Security Rule and Privacy Rule a request by entering into a Business Associate Agreement and an Individual, Business Associate shall provide DOM Covered Entity with a copy of all such executed agreements between Protected Health Information that Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI maintains in a Designated Record Set, Set within fifteen calendar days of receipt of notice of an Individual’s request to DOM or, as directed by XXX, allow Covered Entity to an Individual in order to meet comply with the requirements under 45 CFR § 164.524.
m. 2.6. To the extent Business Associate maintains in its systems Covered Entity’s Protected Health Information, and at Covered Entity’s reasonable and timely request, pursuant to a request by an Individual, Business Associate shall make Protected Health Information that it maintains in a Designated Record Set available to Covered Entity for amendment within fifteen calendar days of receipt of notice of an Individual’s request to allow Covered Entity to comply with the requirements under 45 CFR § 164.526.
2.7. Business Associate agrees to make any amendment(s) internal practices, books, and records relating to PHI the use and disclosure of Protected Health Information available to the Secretary in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXXthe Secretary, for purposes of the Secretary’s determining Covered Entity’s compliance with the Privacy Rule.
n. 2.8. Business Associate agrees to document such Disclosures disclosures of PHI Protected Health Information and information related to such Disclosures disclosures as would be required for DOM Covered Entity to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI Protected Health Information in accordance with the requirements under 45 CFR § 164.528. Upon Covered Entity’s reasonable and timely request, Business Associate agrees to retain shall provide Covered Entity with such documentation for at least six (6) years after the date accounting within fifteen calendar days of disclosure or provide a full accounting and relevant documentation to DOM at the time receipt of termination.
o. Business Associate agrees to provide to DOM or notice of an Individual, in a time and manner designated by DOM, information collected in accordance ’s request to allow Covered Entity to comply with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with the requirements under 45 CFR § 164.528.
p. 2.9. To the extent Business Associate agrees that it shall only use is to carry out one or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes more of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOMCovered Entity’s obligations obligation(s) under the Privacy RuleSubpart E of 45 CFR Part 164, Business Associate will shall comply with the requirements of the Privacy Rule Subpart E that apply to DOM Covered Entity in the performance of such obligationobligation(s). Notwithstanding the foregoing, the Parties do not intend for Covered Entity to delegate any HIPAA regulated functions or obligations to Business Associate.
r. 2.10. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or associate may not use or disclose PHI Protected Health Information in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity except for the boundaries specific uses and jurisdiction of the United States without express written authorization from DOMdisclosures set forth below in Sections 3(c) and (d).
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. A. To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate agrees to not Use to:
1. Not use or Disclose disclose PHI other than as permitted or required by the Service this Agreement or as Required by By Law.
b. Business Associate shall use 2. Use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of the PHI other than as provided for by this Agreement.
c. 3. Appoint and authorize a Privacy Officer to monitor the Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by Associate’s compliance with this Agreement and provisions of which it becomes aware, HIPAA and any Security Incident of which it becomes awareHITECH.
d. Business Associate agrees 4. Cooperate with Covered Entity to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsAgreement.
e. Business Associate agrees 5. Report to notify DOM without unreasonable delayCovered Entity within sixty (60) days of discovery any use or disclosure of the PHI not provided for by this Agreement of which it becomes aware, and no later than seventy-two (72) hours after discovery include such detail as may be available concerning the nature of the unauthorized use or disclosure, together with any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed remedial steps taken by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410prevent further nay disclosure or recurrence.
f. Once an actual 6. Ensure that any agent, including a subcontractor, to whom it provides PHI received from, or suspected Breach is reported to DOM, created or received by Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree Covered Entity agrees to the same restrictions, conditions, restrictions and requirements conditions that apply through this Agreement to Business Associate with respect to such information.
7. Business Associate agrees to ensure that any Subcontractors that createMake internal practices, receivebooks, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kindrecords, including of policies and procedures and PHI, available to the use of such Subcontractors Covered Entity or of to the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and Secretary in the a time and manner specified by Covered Entity or designated by XXXthe Secretary, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet for purposes of the requirements under 45 CFR § 164.524Secretary determining Covered Entity’s compliance with the Privacy Rule.
m. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document 8. Document such Disclosures disclosures of PHI and information related to such Disclosures disclosures as would be required for DOM Covered Entity to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees 9. Provide to provide to DOM Covered Entity or an Individual, in a time and manner designated reasonably specified by DOMCovered Entity, information collected in accordance with section (III)(h) Section II.A.7. above of this Agreement, to permit XXX Covered Entity to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose B. In connection with the minimum PHI necessary to perform functionsperformance of its services, activities, or services for, and/or functions to or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy RuleCovered Entity, Business Associate will comply with the requirements may disclose information, including PHI, to other business associates of the Privacy Rule that apply to DOM Covered Entity which have been identified by Covered Entity in the performance of such obligation.
r. writing. Likewise, Business Associate agrees to make internal practices, books, may use and recordsdisclose information, including policies and proceduresPHI, available to the Secretary for purposes received from other business associates of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310Covered Entity, as if this information was received from, or originated with, Covered Entity.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use or Disclose PHI other than as permitted or required by the Service Agreement or as Required by Law.
b. a) Business Associate shall use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use or Disclosure of PHI other than as provided for by this Agreement.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discoveryensure, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide through a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associateagreement, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors of Business Associate that create, receive, maintain, maintain or transmit protected health information PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that createPHI, receiveincluding without limitation, maintainthe restrictions, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable conditions and requirements of the Security Rule and Privacy Rule by entering into a this Business Associate Agreement and the HIPAA Standards.
b) Business Associate shall report to Covered Entity any use or disclosure of PHI not provided for by this Business Associate Agreement, any Breach, any breach of security of personal information as defined by any applicable state law, or any successful Security Incident involving PHI, in each case of which the Business Associate, or a subcontractor of the Business Associate, becomes aware (each, an “Incident”). Initial notice of an Incident shall be made to the Covered Entity no later than ten (10) business days after discovery of the Incident by Business Associate and Business Associate shall provide DOM with a copy to Covered Entity any information necessary for Covered Entity to notify affected individuals and/or governmental authorities of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least the Incident within thirty (30) calendar business days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at discovery. The foregoing notwithstanding, for purposes of the address included in Section VII(f) of Security Incident reporting obligation under this Agreement. paragraph 4(b), Business Associate understands hereby reports and Covered Entity acknowledges that submission of their Subcontractors’ (i) Business Associate Agreement(sexperiences inconsequential incidents from time to time such as scans or "pings" that are not permitted past Business Associate’s firewall (“Inconsequential Attempted Incidents”), and (ii) to DOM does not constitute DOM approval of any kind, including this report satisfies the requirements of the use of HIPAA Standards with respect to Inconsequential Security Incidents until such Subcontractors or of time as further guidance from the adequacy of such agreementsSecretary indicates otherwise.
l. c) Business Associate agrees to shall restrict disclosures or communicate confidentially with Individuals as required by the HIPAA Standards and as requested by the Covered Entity.
d) If the Business Associate maintains PHI in a Designated Record Set, the Business Associate shall:
(1) provide accessaccess (including inspection, at the request of XXXobtaining a copy or both), and in the time and manner designated by XXXCovered Entity, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. and Business Associate agrees to shall not charge any fee greater than the lesser of the amount permitted by State law or the Business Associate’s actual cost of postage, labor and supplies for complying with the request;
(2) make available PHI for amendment and incorporate any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXXCovered Entity; and
(3) provide access to PHI that is in electronic format in the form and format requested by the Individual or Covered Entity, or if not readily producible in such form and format, in a readable electronic form and format agreed to by the Covered Entity and the Individual, and transmit such copy directly to an entity or person designated by the Individual or Covered Entity. Business Associate shall not charge any fee greater than the lesser of the amount permitted by State law or the Business Associate’s actual cost of postage, labor and supplies for complying with the request.
n. e) Business Associate agrees shall make internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary, in a time and manner designated by the Secretary, for purposes of the Secretary investigating or determining Covered Entity’s or Business Associate’s compliance with the HIPAA Standards. Nothing in this Section shall be construed as a waiver of any legal privilege or of any protections for trade secrets or confidential commercial information by Business Associate.
f) Business Associate shall document such Disclosures disclosures of PHI and information related to such Disclosures disclosures as would be required for DOM Covered Entity or Business Associate under the HIPAA Standards to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528PHI. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individualshall provide, in a the time and manner designated by DOMCovered Entity, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528disclosures required by the HIPAA Standards made by the Business Associate.
p. g) Business Associate agrees that it shall only prevent use or disclose disclosure of the minimum PHI other than as provided for in this Business Associate Agreement and shall comply, where applicable, with the HIPAA Standards with respect to electronic PHI and State law. The Business Associate shall implement and maintain safeguards as necessary to perform functions, activities, ensure that all PHI is used or services for, or on behalf of, DOM disclosed only as specified in authorized under the Service Agreements. HIPAA Standards and this Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOMAgreement.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. (a) Business Associate agrees to not Use use or Disclose PHI further disclose Protected Health Information other than as permitted or required by the Service Agreement this BAA or as Required by Law.
b. . Business Associate shall also comply with any further limitations on uses and disclosures agreed by Covered Entity in accordance with 45 C.F.R. 164.522 provided that such agreed upon limitations have been communicated to Business Associate in accordance with Section 4.1(c) of this BAA.
(b) Business Associate agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of PHI the Protected Health Information other than as provided for by this AgreementBAA, including but not limited to the safeguards described in Section 2(m) of this BAA.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72c) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI Protected Health Information by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsBAA.
e. (d) Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two promptly report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this BAA of which it becomes aware.
(72e) hours after discovery of Business Associate agrees to report to Covered Entity any actual or suspected Breach of Unsecured PHI, all Protected Health Information without unreasonable delay and in accordance with 45 C.F.R. § 164.410no case later than two (2) calendar days after Discovery of a Breach. The notification Such notice shall include, to the extent possible and subsequently as the information becomes available, include the identification of all Individuals each Individual whose Unsecured PHI Protected Health Information has been, or is reasonably believed by Business Associate Associate, to have been Breached along been, accessed, acquired, or disclosed In connection with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOMsuch Breach. In addition, Business Associate agrees to shall provide a written assessment to determine whether any additional information reasonably requested by Covered Entity for purposes of investigating the incident is reportable within ten (10) working daysBreach. An impermissible Use or Disclosure Business Associate’s notification of protected health information is presumed to be a Breach unless under this section shall comply in all respects with each applicable provision of Section 13400 of Subtitle D (Privacy) of AXXX, 00 XXX 164.410, and related guidance issued by the DOM Secretary from time to time. Without limiting Covered Entity’s remedies under Section 6 or any other provision of this BAA, in the event of a Breach involving Unsecured Protected Health Information maintained, used or disclosed by Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees shall reimburse Covered Entity for the cost of providing any legally required notice to fully cooperate, coordinate with, affected Individuals and assist XXX in gathering information the cost of credit monitoring for such Individuals to extent deemed necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM Covered Entity in its sole reasonable discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15f) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information Protected Health Information on behalf of the Business Associate agree in writing to the same restrictions, conditions, restrictions and requirements conditions that apply through this BAA to Business Associate with respect to such information. In no event shall Business Associate, without Covered Entity’s prior written approval, provide Protected Health Information received from, or created or received by Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree Covered Entity, to comply with any employee or agent, including a subcontractor, if such employee, agent or subcontractor receives, processes or otherwise has access to the applicable requirements Protected Health Information outside of the Security Rule and Privacy Rule by entering into a Business Associate United States. Upline Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty 2015 53
(30g) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXXCovered Entity, and in within ten (10) business days of the time and manner designated by XXXrequest from Covered Entity, to PHI Protected Health Information in a Designated Record Set, to DOM Covered Entity or, as directed by XXXCovered Entity, to an Individual in order to meet the requirements under 45 CFR § C.F.R. 164.524. Covered Entity’s determination of what constitutes “Protected Health Information” or a “Designated Record Set” shall be final and conclusive. If Business Associate provides copies or summaries of Protected Health Information to an Individual it may impose a reasonable, cost-based fee in accordance with 45 C.F.R. 164.524 (c)(4).
m. (h) Business Associate agrees to make any amendment(s) to PHI Protected Health Information in a Designated Record Set that DOM the Covered Entity directs or agrees to pursuant to 45 CFR § C.F.R. 164.526 at the request of DOM Covered Entity or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures within ten (10 ) business days of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528Covered Entity. Business Associate agrees shall not charge any fee for fulfilling requests for amendments. Covered Entity’s determination of what Protected Health Information is subject to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting amendment pursuant to 45 C.F.R. 164.526 shall be final and relevant documentation to DOM at the time of terminationconclusive.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(hi) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make (i) internal practices, books, and records, including policies and procedures, relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity, and (ii) policies, procedures, and documentation relating to the safeguarding of Electronic Protected Health Information available to the Secretary Covered Entity, or at the request of the Covered Entity to the Secretary, in a time and manner designated by the Covered Entity or the Secretary, for purposes of the Secretary determining Covered Entity’s or Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310and Security Rules.
s. (j) Business Associate agrees that nothing to document such disclosures of Protected Health Information as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in this Agreement shall permit accordance with 45 C.F.R. 164.528.
(k) Business Associate agrees to accessprovide to Covered Entity, storein the time and manner described below, sharethe information collected in accordance with Section 2(j) of this BAA, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 C.F.R. 164.528. Business Associate agrees to provide such information to Covered Entity within thirty (30) business days of receipt of a request from Covered Entity.
(l) Business Associate acknowledges that it shall request from the Covered Entity and so disclose to its affiliates, agents and subcontractors or other third parties, (i) the information contained in a “limited data set,” as such term is defined at 45 C.F.R. 164.514(e)(2), or, (ii) if needed by Business Associate, to the minimum necessary to accomplish the intended purpose of such requests or disclosures. In all cases, Business Associate shall request and disclose Protected Health Information only in a manner that is consistent with guidance issued by the Secretary from time to time
(m) With respect to Electronic Protected Health Information, Business Associate shall implement and comply with (and ensure that its subcontractors implement and comply with) the administrative safeguards set forth at 45 C.F.R. 164.308, the physical safeguards set forth at 45 C.F.R. 310, the technical safeguards set forth at 45 C.F.R. 164.312, and the policies and procedures set forth at 45 C.F.R. 164.316 to reasonably and appropriately protect the confidentiality, integrity, and availability of the Electronic Protected Health Information that it creates, receives, maintains, or transmits on behalf of Covered Entity. Business Associate acknowledges that, (i) the foregoing safeguard, policies and procedures requirements shall apply to Business Associate in the same manner that such requirements apply to Covered Entity, and (ii) Business Associate shall be liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. 1320d-5 and 1320d-6, as amended from time to time, for failure to comply with the safeguard, policies and procedures requirements and any guidance issued by the Secretary from time to time with respect to such requirements. Upline Agreement 2015 54
(n) With respect to Electronic Protected Health Information, Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit or use or disclose PHI in Electronic Protected Health Information on behalf of Business Associate, agree to comply with the applicable requirements of Subpart C of 45 C.F.R. Part 164 by entering into a contract that complies with 45 C.F.R. Section 164.314.
(o) Business Associate shall report to Covered Entity any form via any medium with any third partySecurity Incident of which it becomes aware, including Breaches of Unsecured Protected Health Information as required by 45 C.F.R. Section 164.410.
(p) If Business Associate conducts any Standard Transactions on behalf of Covered Entity, Business Associate shall comply with the applicable requirements of 45 C.F.R. Parts 160-162.
(q) During the term of this BAA, Business Associate may be asked to complete a security survey and/or attestation document designed to assist Covered Entity in understanding and documenting Business Associate’s Subcontractorssecurity procedures and compliance with the requirements contained herein. Business Associate’s failure to complete either of these documents within the reasonable timeframe specified by Covered Entity shall constitute a material breach of this BAA.
(r) Business Associate acknowledges that, beyond the boundaries and jurisdiction as of the United States without express written authorization Effective Date of this BAA, it shall be liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. 1320d-5and 1320d- 6, as amended from DOMtime to time, for failure to comply with any of the use and disclosure requirements of this BAA and any guidance issued by the Secretary from time to time with respect to such use and disclosure requirements.
(s) To the extent Business Associate is to carry out one or more of Covered Entity’s obligation(s) under Subpart E of 45 CFR Part 164, Business Associate shall comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligation(s).
(t) To the extent that Business Associate provides services to Covered Entity relating to individuals enrolled in state or federal programs (e.g., Medicare or Medicaid), Business Associate shall comply with any additional restrictions or requirements related to the use, disclosure, maintenance, and protection of Protected Health Information of individuals enrolled in such programs through Covered Entity. With respect to the Protected Health Information of Medicare enrollees, Business Associate shall report privacy and security incidents and/or Breaches immediately, but not later than one (1) day, to Covered Entity and include the information required under this Section 2 of this Addendum
Appears in 1 contract
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use or Disclose PHI other than comply with those provisions of the Security Rule that are set forth at 45 C.F.R. §§ 164.308, 164.310, 164.312, and 164.316, as permitted or required by amended from time to time, with respect the Service Agreement or as Required by Lawsecurity of PHI, in the same manner that such regulations apply to the Provider.
b. Business Associate agrees to comply with the Privacy Rule at 45 C.F.R. § 164.504(e), as amended from time to time, with respect to its use and disclosure of PHI, in the same manner that such regulation applies to Provider. The additional requirements of the HITECH Act that relate to privacy and that are made applicable with respect to covered entities shall also be applicable to Business Associate and shall be and by this reference hereby are incorporated into the BAA.
c. Business Associate agrees to not use or further disclose PHI other than as specifically permitted or required by this BAA or as required by law.
d. Business Associate agrees to use appropriate safeguards and comply comply, where applicable, with Subpart C of 45 C.F.R. CFR Part 164 with respect to electronic PHI (ePHI) Electronic PHI, to prevent Use use or Disclosure disclosure of PHI other than as provided for by this AgreementBAA.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. e. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsBAA.
e. f. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery report to Provider if it becomes aware of any actual use or suspected disclosure of PHI not provided for by this BAA, including any Breach of Unsecured PHIPHI as required by 45 CFR 164.410, all in accordance with 45 C.F.R. § 164.410and any Security Incident of which it becomes aware. The notification shall include, Notwithstanding anything herein to the extent possible and subsequently as the information becomes availablecontrary, the identification of all Individuals whose Unsecured PHI is reasonably believed by parties acknowledge and agree that this BAA shall constitute notice to Provider that Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individualmay periodically experience broadcast attacks on its firewall, HHSport scans, and/or the mediaunsuccessful log-on attempts, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOMdenials of service and similar unsuccessful security incidents, and Business Associate agrees need not further report such incidents to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use Provider so long as such incidents do not result in unauthorized access, use or Disclosure disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410PHI.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will on behalf of Provider agree to comply with the applicable requirements of the Security Rule same restrictions and Privacy Rule by entering into a conditions that apply to Business Associate Agreement and Business Associate shall provide DOM with a copy respect to such information, including, without limitation, implementation of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior appropriate safeguards to disclosing any protect the security of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreementsElectronic PHI.
l. h. Upon the written request of Provider, Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, access to Provider to PHI that Business Associate maintains in a Designated Record SetSet (if in fact its arrangements with Provider require Business Associate to maintain Designated Record Sets on behalf of Provider), to DOM or, as directed by XXX, to an Individual in order for Provider to meet the Patient access and copying requirements under 45 CFR § 164.524. If Business Associate maintains an electronic health record which contains the PHI, Business Associate shall provide such information produced in accordance with this section 2(h) in electronic format to enable Provider to fulfill its obligations under applicable regulations.
m. i. Upon the written request of Provider, Business Associate agrees to make any amendment(s) to PHI that Business Associate maintains in a Designated Record Set (if in fact its arrangements with Provider require Business Associates to maintain Designated Record Sets on behalf of Provider), that DOM the Provider directs or agrees to pursuant to 45 CFR § 164.526 164.526.
j. Business Associate agrees to make its internal practices, books and records relating to the use and disclosure of PHI available at the request of DOM the Provider to the Secretary, for purposes of determining Provider’s compliance with the Privacy Rule, subject to attorney-client or an Individual, and in the time and manner designated by XXXother applicable legal privileges.
n. k. Business Associate agrees to document such Disclosures disclosures of PHI and information related to such Disclosures disclosures as would be required for DOM Provider to respond to a request by an Individual Patient for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees , as may be amended from time to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of terminationtime.
o. l. Upon written request of Provider, Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, Provider with information collected in accordance with section (III)(h) Section II.k of this Agreement, BAA to permit XXX Provider to respond to a request by an Individual Patient for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. m. Business Associate agrees that to the extent that Business Associate carries it is to carry out DOMProvider’s obligations obligation under the Privacy Rule, Business Associate Rule that it will comply with the requirements of the Privacy Rule that apply to DOM Provider in the performance of such obligation.
r. n. Business Associate agrees to make internal practicesnotify Provider without unreasonable delay, books, and records, including policies and procedures, available but in no event more than 60 days after Business Associate becomes aware of an unauthorized use or disclosure by or on behalf of Business Associate which constitutes a Breach of Unsecured PHI unless it receives a request to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule delay such notification from a law enforcement official pursuant to 45 C.F.R. § 160.310CFR 164.412. Such notification shall include a list of impacted Patients, and describe the Breach in such reasonable detail to enable Provider to fulfill its obligations under applicable regulations.
s. o. Upon written request of Provider, Business Associate agrees will comply with a Patient request for restriction of certain disclosures to health plans in accordance with 45 CFR 164.522 and the HITECH Act, if the disclosure is to a health care plan for the purposes of carrying out payment or health care operations and the PHI pertains solely to a health care item or service for which Patient has paid for out of pocket in full. Except to the extent that nothing in this Agreement shall permit Provider must agree to a Patient request for restriction under the HITECH Act, Business Associate shall not be required to access, store, share, maintain, transmit or comply with a Patient’s request to restrict the use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction disclosure of the United States without express written authorization from DOMPHI.
Appears in 1 contract
Samples: End User License Agreement
Obligations and Activities of Business Associate. a. With regard to the use and/or disclosure of PHI the Business Associate agrees that all uses and disclosures will be in accordance with the Notice of Privacy Practices and applicable federal, state, and local law. The Business Associate will not use or disclose any PHI in violation of HIPAA. In all instances where the use or disclosure of PHI is necessary, the Business Associate will use or disclose only the minimum necessary to not Use achieve the intended purpose for such use or Disclose disclosure. Business Associate agrees that it will de-identify all PHI prior to its use or disclosure, to the extent possible. Business further agrees to:
(a) Not use or further disclose PHI other than as permitted or required by the Service this Agreement or as Required required by Lawlaw.
b. Business Associate shall use (b) Use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use the use or Disclosure disclosure of PHI other than as provided for by this Agreement.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72c) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigateMitigate, to the extent practicable, any harmful effect that is known to Business Associate of from a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement Agreement.
(d) Use appropriate safeguards, and take prompt steps comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information, to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual use or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure disclosure of protected health information is presumed other than as provided for by the Agreement;
(e) Report to be a Breach unless the DOM covered entity any use or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one disclosure of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf not provided for by the Agreement of the Business Associate agree which it becomes aware, including breaches of unsecured protected health information as required at 45 CFR 164.410, and any security incident of which it becomes aware;
(f) Ensure that any agent, including a subcontractor, to whom it provides PHI, agrees to the same restrictions, conditions, restrictions and requirements conditions that apply through this Agreement to the Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide (g) Provide access, at the request of XXXCovered Entity, and in the time and manner designated by XXXCovered Entity, to PHI in a Designated Record SetSet (if applicable), to DOM Covered Entity or, as directed by XXXCovered Entity, to an Individual in order to meet the requirements under 45 CFR § 164.524Individual.
m. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Subcontractor Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use use or Disclose PHI disclose Protected Health Information other than as permitted or required by the Service Agreement or as Required required by Lawlaw.
b. Business Associate shall agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of PHI the Protected Health Information other than as provided for by this Agreement.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, report to Covered Entity any use or disclosure of any Use or Disclosure of PHI the Protected Health Information not provided for by this Agreement of which it becomes aware, and any Security Incident including breaches of which it becomes awareunsecured protected health information, as required at 45 C.F.R. 164.410.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to if applicable, ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information.
e. Report to the Covered Entity any security incident of which it becomes aware.
f. Business Associate shall notify the Covered Entity of a breach of unsecured PHI on the first day on which such breach is known by Business Associate or an employee, officer or agent of Business Associate other than the person committing the breach, or as soon as possible following the first day on which Business Associate or an employee, officer or agent of Business Associate other than the person committing the breach should have known by exercising reasonable diligence of such breach. Notification shall include, to the extent possible, the identification of each individual whose unsecured PHI has been, or is reasonably believed by the Business Associate to have been, accessed, acquired, used or disclosed during the breach. Business Associate agrees to ensure that shall also provide the Covered Entity with any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of other available information at the time Business Associate will agree makes notification to comply with the applicable requirements Covered Entity or promptly thereafter as information becomes available. Such additional information shall include (i) a brief description of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kindwhat happened, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide the breach; (ii) a full accounting and relevant documentation to DOM at description of the time types of termination.
o. unsecured PHI that were involved in the breach; (iii) any steps the Business Associate agrees believes individuals should take to provide to DOM or an Individual, in protect themselves from potential harm resulting from the breach; and (iv) a time and manner designated by DOM, information collected in accordance with section (III)(h) brief description of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. what Business Associate agrees that it shall only use or disclose is doing to investigate the minimum PHI necessary breach, mitigate harm to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Ruleindividuals, and protect against any minimum necessary policies and procedures communicated to Business Associate by DOMfuture breaches.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Memorandum of Agreement
Obligations and Activities of Business Associate. a. 2.1 Business Associate agrees to not Use or Disclose access, create, maintain, use and/or disclose the PHI other than only as permitted or required by the Service this Agreement or as Required required by Lawlaw.
b. 2.2 Business Associate shall agrees to use appropriate safeguards to maintain the security of the PHI and to prevent use or disclosure of PHI and comply with Subpart C of 45 C.F.R. CFR Part 164 with respect to electronic PHI (ePHI) to prevent Use or Disclosure of PHI Electronic Protected Health Information other than as provided for by this Agreement.
c. . Business Associate agrees to notify DOM without unreasonable delay implement Security Safeguards that reasonably and no later than seventy-two (72) hours after discoveryappropriately protect the Confidentiality, Integrity, and Availability of the ePHI that Business Associate creates, receives, maintains, or transmits on behalf of Emory and that are in accord with all applicable HIPAA Regulations and HITECH.
2.3 Business Associate agrees to promptly report to Emory any Use use or Disclosure disclosure of PHI that is not provided for permitted by this Agreement Agreement, including breaches of which it becomes aware, and Unsecured PHI as required at 45 CFR 164.410 or of any Security Incident of which it Business Associate becomes aware. The parties acknowledge and agree that this section constitutes notice by Business Associate to Emory of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (defined below) for which no additional notices will be required. Unsuccessful Security Incidents shall include, but not be limited to, pings and other broadcast attacks on Business Associate’s firewall, port scan, unsuccessful log-on attempts, denials of service and any combination of the above, so long as no such incident results in unauthorized acquisition, access, use or disclosure of Protected Health Information.
d. 2.4 Business Associate agrees to ensure that any agent, including any authorized sub- contractor, that creates, receives, maintains, transmits, uses, or has access to PHI in the performance of the Underlying Contracts agrees, in writing, to the same restrictions, conditions and requirements on the use and/or disclosure of such PHI that apply to Business Associate with respect to such information through this Agreement.
2.5 Business Associate agrees to ensure that any agent, including any authorized sub- contractor to whom it provides ePHI, agrees, in writing, to implement reasonable and appropriate Security Safeguards to protect it.
2.6 Business Associate agrees to document any disclosures of PHI by Business Associate or its agents or authorized subcontractors, and information related to such disclosures, as would be required for Emory to respond to a request by an individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528.
2.7 Business Associate agrees to provide to Emory information collected in accordance with Section 2.6 of this Agreement within fifteen (15) days of a request by Emory, as necessary to permit Emory to respond to a request by an individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528.
2.8 Business Associate agrees to make available PHI in a designated record set, within fifteen (15) days of Emory’s request, to Emory or, as directed by Emory, to an individual in order to meet the requirements under 45 C.F.R. § 164.524, relating to an individual’s right to inspect and obtain a copy of PHI relating to such individual.
2.9 Business Associate agrees to make any amendment(s) to Protected Health Information in a designated record set as Emory directs or agrees to pursuant to 45 C.F.R. § 164.526 within thirty (30) days of Emory’s request.
2.10 If Business Associate believes it has a legal obligation to disclose any PHI, it will notify Emory in writing as soon as reasonably practical after it learns of such obligation, and in any event at least five (5) business days prior to the proposed release, as to the legal requirement pursuant to which it believes the PHI must be released. If Emory objects to the release of such PHI, Business Associate will allow Emory to exercise any legal rights or remedies Business Associate might have to object to the release of the PHI, and Business Associate agrees to provide such assistance to Emory, at Emory’s expense, as Emory may reasonably request in connection therewith.
2.11 Business Associate agrees to make its internal practices, policies and procedures, books and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining Emory’s compliance with the HIPAA Regulations. Business Associate agrees to provide Emory with prompt written notice of any request received from the Secretary for access to such documents.
2.12 Business Associate, at its sole expense, agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsAgreement.
e. 2.13 Business Associate agrees to notify DOM report to Emory any use or disclosure of PHI not provided for by this Agreement of which it becomes aware as soon as reasonably possible and in any event within five (5) days of the date on which it becomes aware of the use/disclosure.
2.14 Business Associate acknowledges that Sections 164.308, 164.310, 164.312, and 164.316 of Title 45, Code of Federal Regulations apply to Business Associate in the same manner that such sections apply to covered entities and are incorporated into this Agreement by reference. The additional requirements of HITECH that relate to security of ePHI in Subpart C of Part 164 of Title 45 of the Code of Federal Regulations that apply to covered entities also apply to Business Associate and are incorporated into this Agreement by reference. Business Associate agrees to implement the technical safeguards provided in guidance issued annually by the Secretary for carrying out the obligations under the Code of Federal Regulation sections cited above (in this Section 2.14) and the security standards in Subpart C of Part 164 of Title 45 of the Code of Federal Regulations.
2.15 Business Associate may use and disclose Protected Health Information that Business Associate obtains or creates only if such use or disclosure, respectively, complies with each applicable requirement of Section 164.504(e) of Title 45, Code of Federal Regulations, as permitted or required by this Agreement or as required by law.
2.16 Business Associate acknowledges that Section 164.504(e)(1)(ii) of Title 45, Code of Federal Regulations applies to Business Associate in the same manner that such section applies to covered entities, with respect to compliance with the standards in Sections 164.502(e) and 164.504(e) of Title 45, except that in applying such Section 164.504(e)(1)(ii) each reference to the business associate, with respect to a contract, shall be treated as a reference to the covered entity involved in such contract.
2.17 Business Associate shall comply with Section 13402 of the HITECH Act and the regulations implementing such provisions, currently Subpart D of Title 45 of the Code of Federal Regulations, as such regulations may be in effect from time to time (collectively, the “Breach Notification Rules”).
a. Except as provided in 45 C.F.R. § 164.412, Business Associate will give Emory notice of any Breach of Unsecured Protected Health Information without unreasonable delay, and but in no case later than seventy-two ten (7210) hours days after discovery the first day on which the Breach is known, or by the exercise of any actual or suspected Breach of Unsecured PHIreasonable diligence would have been known, all to the Business Associate.
b. The notice required by Section 2.17.a. above will be written in accordance with 45 C.F.R. § 164.410. The notification shall plain language and will include, to the extent possible and subsequently as the information becomes or available, the following:
i. The identification and address of all Individuals each individual(s) whose Unsecured PHI Protected Health Information has been, or is reasonably believed by the Business Associate to have been Breached along with any other available information been, accessed, acquired or disclosed during the Breach;
ii. A brief description of what happened, including the date of the Breach and the date of the discovery of the Breach;
iii. A description of the types of Unsecured Protected Health Information that is required to be included were involved in the notification Breach (such as whether the full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved);
iv. Any steps individuals who were subjects of the Breach should take to protect themselves from potential harm that may result from the IndividualBreach;
v. A brief description of what the Business Associate is doing to investigate the Breach, HHSto mitigate the harm to individuals, and/or the mediaand to protect against further Breaches; and
vi. Contact procedures for individuals to ask questions or learn additional information, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410including a toll free telephone number, an email address, Web site, or postal address.
f. Once an actual or suspected Breach is reported to DOM, c. Business Associate agrees to provide shall cooperate with Emory in conducting a written risk assessment to determine whether the incident Breach definition is reportable within ten (10) working days. An impermissible Use met, requiring notice to affected individuals.
2.18 Business Associate shall secure all Protected Health Information that is maintained by Business Associate by a technology standard that renders Protected Health Information unusable, unreadable, or Disclosure of protected health information indecipherable to unauthorized individuals and is presumed to be a Breach unless consistent with guidance issued by the DOM or Business AssociateSecretary, as applicablemodified by the Secretary from time to time, demonstrates there is a low probability specifying the PHI has been compromised technologies and methodologies that render Protected Health Information unusable, unreadable, or one indecipherable to unauthorized individuals, including the use of standards developed under Section 3002(b)(2)(B)(vi) of the exceptions Public Health Service Act, as added by Section 13101 of HITECH. Emory acknowledges that much of the Protected Health Information made available to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, is and assist XXX will remain resident in gathering information necessary to notify systems under the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery control of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, Emory and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2)therefore, Business Associate agrees to ensure that is not responsible for any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree technologies employed by Emory to the same restrictions, conditions, and requirements that apply to Business Associate with respect to protect such information. Business Associate agrees to ensure that any Subcontractors that create.
2.19 At Emory’s discretion, receive, maintain, or transmit electronic PHI (ePHI) Emory may require employees and permitted contractors who provide services on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule execute appropriate confidentiality or data use agreements.
2.20 Except as may be expressly permitted under an Underlying Contract or otherwise consented to by entering into a Business Associate Agreement and Emory in writing, Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing not transfer any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at across the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction borders of the United States without express written authorization or permit remote access to the PHI by any employee, affiliate, contractor or other third party from DOMoutside of the United States.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. a) Business Associate agrees to not Use use or Disclose disclose PHI other than as permitted or required by this Agreement, any underlying agreement between the Service Agreement parties, or as Required by By Law.
b. b) Business Associate shall will make reasonable efforts, to the extent practicable, to limit requests for and the use and disclosure of PHI to a Limited Data Set (as defined in 45 C.F.R. § 164.514(e)(2)) or, if needed by Business Associate, to the minimum necessary PHI to accomplish the intended purpose of such use, disclosure or request, and as applicable, in accordance with the regulations and guidance issued by the Secretary on what constitutes the minimum necessary for Business Associate to perform its obligations to Covered Entity under this Agreement, any underlying agreement, or as Required By Law.
c) Business Associate agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use the use or Disclosure disclosure of PHI other than as provided for by this Agreement.
c. d) Business Associate agrees to notify DOM without unreasonable delay implement administrative, physical and no later than seventy-two (72) hours after discoverytechnical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of any Use Electronic PHI that it creates, receives, maintains or Disclosure transmits on behalf of PHI not provided for by this Agreement Covered Entity. Business Associate shall comply with the applicable requirements of which it becomes aware, and any the Security Incident of which it becomes awareRule in the same manner such provisions apply to Covered Entity.
d. e) Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsAgreement.
e. f) Business Associate agrees to report to Covered Entity any use or disclosure of PHI not provided for by this Agreement of which it becomes aware. To the extent that Business Associate creates, receives, maintains or transmits Electronic PHI, Business Associate agrees to report as soon as practicable to Covered Entity any Security Incident, as determined by Business Associate, involving PHI of which Business Associate becomes aware. Notwithstanding the foregoing, Business Associate and Covered Entity acknowledge the ongoing existence and occurrence of attempted but unsuccessful Security Incidents that are trivial in nature, such as pings and port scans, and Covered Entity acknowledges and agrees that no additional notification to Covered Entity of such unsuccessful Security Incidents is required. However, to the extent that Business Associate becomes aware of an unusually high number of such unsuccessful Security Incidents due to the repeated acts of a single party, Business Associate shall notify DOM Covered Entity of these attempts and provide the name, if available, of said party. At the request of Covered Entity, Business Associate shall identify the date of the Security Incident, the scope of the Security Incident, Business Associate’s response to the Security Incident, and the identification of the party responsible for causing the Security Incident, if known.
g) Following Business Associate’s discovery of a Breach of Unsecured PHI, Business Associate shall notify Covered Entity of the Breach without unreasonable delay, and in no event later than seventy-two three (723) hours business days after discovery Business Associate, or any of any actual its employees or suspected Breach of Unsecured PHIagents, all in accordance with 45 C.F.R. § 164.410discovered the Breach. The Such notification shall include, to the extent possible and subsequently as the information becomes availablepossible, the identification of all Individuals each Individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been Breached along with been, accessed, acquired, used, or disclosed during the Breach and any other information available information that to Business Associate about the Breach which is required to be included in the notification of the Breach provided to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all Individual in accordance with 45 C.F.R. § 164.410.
g. §164.404(c). A Breach of Unsecured PHI shall be treated as discovered as of the first day on which such Breach is known to Business Associate agrees or should have be known to fully cooperateBusiness Associate by exercising reasonable diligence. If Business Associate (or one of its subcontractors, coordinate withvendors or agents) is responsible for a Breach of Unsecured PHI, and assist XXX in gathering information necessary Covered Entity may, at its option, require Business Associate to notify provide any of the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to notifications required by 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, § 164.404 at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actionsexpense.
k. h) In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii164.308(b)(2) and 164.308(b)(2164.502(e)(1)(ii), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information PHI on behalf of the Business Associate agree in writing to the same restrictions, conditions, restrictions and requirements conditions that apply through this Agreement to Business Associate with respect to such information. Moreover, Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, such agent or transmit electronic PHI (ePHIsubcontractor agrees to implement reasonable and appropriate safeguards to protect Covered Entity’s Electronic PHI.
i) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXXCovered Entity, and in the a time and manner designated by XXXmutually acceptable to Business Associate and Covered Entity, to PHI in a Designated Record SetSet to Covered Entity, to DOM or, as directed by XXXCovered Entity, to an Individual or another person properly designated by the Individual, in order to meet the requirements under 45 CFR C.F.R. § 164.524. If Business Associate maintains PHI electronically in a Designated Record Set and if the Individual requests an electronic copy of such information, Business Associate must provide Covered Entity, or the Individual or person properly designated by the Individual, as directed by Covered Entity, access to the PHI in the electronic form and format requested by the Individual, if it is readily producible in such form and format; or, if not, in a readable electronic form and format as agreed to by Covered Entity and the Individual. Any fee that Business Associate may charge for such electronic copy shall not be greater than Business Associate’s labor and supply costs in responding to the request.
m. j) Business Associate agrees to make any amendment(s) to PHI in its possession contained in a Designated Record Set that DOM Covered Entity directs or agrees to pursuant to 45 CFR C.F.R. § 164.526 at the request of DOM Covered Entity or an Individual, and in the a time and manner designated by XXXmutually acceptable to Business Associate and Covered Entity.
n. k) Business Associate agrees to document such Disclosures disclosures of PHI and information related to such Disclosures disclosures as would be required for DOM Covered Entity to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR C.F.R. § 164.528. As of the compliance date set forth in the regulations promulgated under HITECH or as otherwise determined by the Secretary, in addition to the accounting of disclosure obligations required under 45 C.F.R. § 164.528, Business Associate agrees to retain such documentation shall account for at least six (6) years after all disclosures of PHI made through an Electronic Health Record in accordance with the date of disclosure or provide a full accounting HITECH Standards and relevant documentation to DOM at the time of terminationany future regulations promulgated thereunder.
o. l) Within ten (10) business days (or such other date that Business Associate and Covered Entity may reasonably agree upon) of receiving written notice from Covered Entity that Covered Entity has received a request for an accounting of disclosures of PHI, Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, Covered Entity information collected in accordance with section (III)(h) of this Agreement, to permit XXX Covered Entity to respond to a request by an Individual for an make the accounting of Disclosures of PHI required in accordance with 45 CFR C.F.R. § 164.528.
p. m) Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make its internal practices, books, and records, including policies and procedures, relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of Covered Entity, available to the Secretary for purposes of determining Covered Entity’s or Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310Rule.
s. n) To the extent Business Associate agrees that nothing in this Agreement shall permit is to carry out Covered Entity’s obligations under the Privacy Rule, Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium shall comply with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction requirements of the United States without express written authorization from DOMPrivacy Rule that apply to Covered Entity in the performance of such delegated obligation.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use or Disclose PHI Protected Health Information other than as permitted or required by the Service this Agreement or as Required by By Law.
b. . • Business Associate shall agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use or Disclosure of PHI Protected Health Information other than as provided for by this Agreement.
c. . Business Associate further agrees to notify DOM without unreasonable delay implement administrative, physical and no later than seventy-two (72) hours after discoverytechnical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of any Use or Disclosure of PHI not electronic Protected Health Information, as provided for in the Security Rule and as mandated by this Agreement Section 13401 of which it becomes aware, and any Security Incident of which it becomes aware.
d. the HITECH Act. • Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI Protected Health Information by Business Associate in Violation violation of the requirements of this Agreement. Business Associate further agrees to report to Covered Entity any Use or Disclosure of Protected Health Information not provided for by this Agreement of which it becomes aware, and take prompt steps in a manner as prescribed herein. • If the Breach, as discussed in paragraph 2(c), pertains to prevent the recurrence of any IncidentUnsecured Protected Health Information, including any action required by applicable federal and state laws and regulations.
e. then Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of report any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the such data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable Covered Entity within ten (10) working daysbusiness days of discovery of said Breach; all other compromises of Protected Health Information shall be reported to Covered Entity within twenty (20) business days of discovery. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business AssociateAssociate further agrees, as applicable, demonstrates there is a low probability the PHI has been compromised or one consistent with Section 13402 of the exceptions HITECH Act, to provide Covered Entity, via email or phone call, with information necessary for Covered Entity to meet the definition requirements of Breach appliessaid section. • If Business Associate is an Agent of Covered Entity, all in accordance with 45 C.F.R. § 164.410.
g. then Business Associate agrees that any Breach of Unsecured Protected Health Information shall be reported to fully cooperate, coordinate withCovered Entity immediately after the Business Associate becomes aware of said Breach, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure under no circumstances later than one (1) business day thereafter. Business Associate further agrees that any notices sent compromise of Protected Health Information, other than a Breach of Unsecured Protected Health Information as specified in connection with the Incident are2(c) of this Agreement, subject shall be reported to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM Covered Entity within fifteen ten (1510) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civildiscovering said compromise, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), attempted compromise. • Business Associate agrees to ensure that any subcontractors that createSubcontractor, receive, maintain, or transmit protected health information on behalf of the to whom Business Associate agree provides Protected Health Information, agrees to the same restrictions, conditions, restrictions and requirements conditions that apply through this Agreement to Business Associate with respect to such information. Business Associate further agrees that restrictions and conditions analogous to ensure those contained herein shall be imposed on said Subcontractors via a written agreement that any Subcontractors complies with all the requirements specified in § 164.504(e)(2), and that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall only provide DOM said Subcontractors Protected Health Information consistent with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f13405(b) of this Agreementthe HITECH Act. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kindFurther, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the copies of said written agreements to Covered Entity within ten (10) business days of a Covered Entity’s request of XXX, and in the time and manner designated by XXXfor same. • Business Associate agrees to provide access via in-app export, to PHI Protected Health Information in a Designated Record Set, Set to DOM Covered Entity or, as directed by XXXCovered Entity, to an Individual Individual, in order to meet the Covered Entity’s requirements under 45 CFR § 164.524.
m. . Business Associate further agrees, in the case where Business Associate controls access to Protected Health Information in an Electronic Health Record, or controls access to Protected Health Information stored electronically in any format, to provide similar access in order for Covered Entity to meet its requirements of the HIPAA Rules and under Section 13405(c) of the HITECH Act. These provisions do not apply if Business Associate and its employees or Subcontractors have no Protected Health Information in a Designated Record Set of Covered Entity. • Business Associate agrees to make any amendment(s) to PHI Protected Health Information in a Designated Record Set that DOM directs or agrees available to the Covered Entity for the purpose of making amendments and incorporate such amendments in the Designated Record Set pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. §164.526. This provision does not apply if Business Associate agrees to document such Disclosures and its employees or Subcontractors have no Protected Health Information from a Designated Record Set of PHI and information related to such Disclosures as would be required for DOM to respond to a request Covered Entity. • Unless otherwise protected or prohibited from discovery or disclosure by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individuallaw, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and proceduresprocedures (collectively “Compliance Information”), relating to the Use or Disclosure of Protected Health Information and the protection of same, available to the Covered Entity or to the Secretary for purposes of the Secretary determining Covered Entity’s compliance with the HIPAA Rules and the HITECH Act. Business Associate further agrees, at the request of Covered Entity, to provide Covered Entity with demonstrable evidence that its Compliance Information ensures Business Associate’s and/or DOM's compliance with this Agreement over time. Business Associate shall have a reasonable time within which to comply with requests for such access and/or demonstrable evidence, consistent with this Agreement. In no case shall access, or demonstrable evidence, be required in less than ten (10) business days after Business Associate’s receipt of such request, unless otherwise designated by the Privacy Rule pursuant Secretary. • Business Associate agrees to maintain necessary and sufficient documentation of Disclosures of Protected Health Information as would be required for Covered Entity to respond to a request by an Individual for an accounting of such Disclosures, in accordance with 45 CFR §164.528. • On request of Covered Entity, Business Associate agrees to provide to Covered Entity documentation made in accordance with this Agreement to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 C.F.R. § 160.310.
s. 164.528. Business Associate agrees that nothing shall provide said documentation in this Agreement shall permit a manner and format to be specified by Covered Entity. Business Associate shall have a reasonable time within which to access, store, share, maintain, transmit or use or disclose PHI comply with such a request from Covered Entity and in any form via any medium with any third party, including no case shall Business Associate be required to provide such documentation in less than five (5) business days after Business Associate’s Subcontractorsreceipt of such request. • Except as provided for in this Agreement, beyond in the boundaries and jurisdiction event Business Associate receives an access, amendment, accounting of disclosure, or other similar request directly from an Individual, Business Associate shall redirect the Individual to the Covered Entity. • To the extent that Business Associate carries out one or more of Covered Entity’s obligations under the HIPAA Rules, the Business Associate must comply with all requirements of the United States without express written authorization from DOMHIPAA Rules that would be applicable to the Covered Entity. • A Business Associate must honor all restrictions consistent with 45 C.F.R. § 164.522 that the Covered Entity or the Individual makes the Business Associate aware of, including the Individual’s right to restrict certain disclosures of protected health information to a health plan where the individual pays out of pocket in full for the healthcare item or service, in accordance with HITECH Act Section 13405(a).
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. (i) Business Associate agrees to shall not Use use or Disclose disclose PHI other than as permitted or required by the Service Agreement under this Agreement, or as Required by Law.
b. (ii) Business Associate shall use appropriate safeguards and comply with the applicable requirements of Subpart C of 45 C.F.R. Part CFR § 164 with respect to electronic E-PHI (ePHI) to prevent Use the use or Disclosure disclosure of PHI other than as provided for herein.
(iii) Business Associate shall comply with the applicable requirements of Subpart E of 45 CFR § 164. To the extent that Business Associate, in providing the Services, is carrying out one or more of Covered Entity’s obligations under Subpart E of 45 CFR § 164, Business Associate shall comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligations.
(iv) Business Associate shall ensure that any Subcontractors that create, receive, maintain or transmit PHI, including any E-PHI, on behalf of Business Associate agree to comply with the applicable requirements of Subpart C and Subpart E of 45 CFR § 164, and that each Subcontractor enters into a business associate agreement with Business Associate under which each Subcontractor agrees to the same restrictions and conditions that apply to Business Associate with respect to PHI. In addition to other provisions required by HIPAA or this Agreement, such Subcontractor agreements shall contain provisions to ensure Business Associate will meet its reporting obligations under Sections 4(a)(v) and 4(a)(vi), immediately below.
(v) Business Associate shall promptly report to Covered Entity, within thirty (30) days of discovery, any use or disclosure of PHI not permitted by this Agreement.
c. , as well as any Security Incident. In addition, Business Associate agrees to notify DOM shall promptly and without unreasonable delay and delay, notify Covered Entity following the discovery of a Breach of Unsecured PHI as required by 45 CFR § 164.410, except that Business Associate shall make such reports to Covered Entity no later than seventy-two thirty (7230) hours days after discoverydiscovery of the same unless a law enforcement official determines that such a report would impede a criminal investigation or cause damage to national security, in which case Business Associate will comply with 45 CFR § 164.412. A Breach is deemed discovered as of any Use or Disclosure of PHI not provided for by this Agreement of the first day on which it becomes awareis known to Business Associate or to any person, other than the person committing the Breach, who is an employee, officer or other agent of Business Associate, or, by exercising reasonable diligence, would have been known to Business Associate or such person.
(vi) Business Associate shall include in any report required under Section 4(a)(v) immediately above, to the extent possible, (A) a description of the impermissible use/disclosure, Security Incident or Breach of Unsecured PHI, (B) the identification of each individual whose PHI has been, or is reasonably believed to have been, the subject of the impermissible use/disclosure, Security Incident or Breach of Unsecured PHI, and (C) such other available information, as requested by Covered Entity, which Covered Entity may be required to include in any Security Incident of which it becomes awarerequired notifications to the affected individuals.
d. (vii) Business Associate agrees to shall mitigate, to the extent practicable, any harmful effect that is known to Business Associate of (A) a Use Security Incident, (B) a Breach of Unsecured PHI, and (C) a use or Disclosure disclosure of PHI by Business Associate or its employees or agents, including any Subcontractors, in Violation violation of the requirements of this Agreement Agreement. Further, Business Associate shall reasonably cooperate and take prompt steps to prevent coordinate with Covered Entity in the recurrence investigation of any Incidentviolation of the requirements of this Agreement, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delayimpermissible use/disclosure, and no later than seventy-two (72) hours after discovery of any actual Security Incident or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10viii) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXXCovered Entity, and in the time and manner designated by XXX, shall provide access to PHI in a Designated Record Set, Set to DOM Covered Entity or, as directed by XXXCovered Entity, to an Individual individual in order to meet the requirements under 45 CFR § 164.524.
m. (ix) Business Associate agrees to shall make any amendment(s) amendments to PHI in a Designated Record Set that DOM Covered Entity directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX164.526.
n. (x) Business Associate agrees shall make available to document such Disclosures of PHI and Covered Entity information related required to such Disclosures as would be required for DOM to respond to a request by an Individual for provide an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528.
p. (xi) Business Associate agrees that it shall only make internal practices, books and records relating to the use or disclose the minimum and disclosure of PHI necessary to perform functions, activitiesreceived from, or services for, created or received by Business Associate on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, Covered Entity available to the Secretary for purposes of determining Business Associatethe Secretary’s and/or DOM's determination of Covered Entity’s compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310HIPAA.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. In the event Business Associate creates, receives, maintains, or transmits Covered Entity’s Protected Health Information, Business Associate agrees to not Use to:
(a) Not use or Disclose PHI disclose Protected Health Information other than as permitted or required by the Service this Agreement or as Required required by Lawlaw.
b. Business Associate shall use (b) Use appropriate safeguards safeguards, and comply with Subpart C of 45 C.F.R. Part 164 the HIPAA Security Rule with respect to electronic PHI (ePHI) Electronic Protected Health Information, to prevent Use the use or Disclosure disclosure of PHI Protected Health Information other than as provided for by this Agreement. Business Associate will retain Protected Health Information in accordance with the agreed upon services and its record retention procedures.
c. Business Associate agrees (c) Report to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, Covered Entity any use or disclosure of any Use or Disclosure of PHI Protected Health Information not provided for by this Agreement of which it becomes aware, including breaches of Unsecured Protected Health Information as required by 45 C.F.R. 164.410, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate; provided, to however, the extent practicable, any harmful effect Parties acknowledge and agree that is known to Business Associate of a Use or Disclosure of PHI this Section constitutes notice by Business Associate in Violation to Covered Entity of the requirements ongoing existence and occurrence of this Agreement attempted, but Unsuccessful Security Incidents, for which further notice to Covered Entity shall be required only upon Covered Entity’s written request. Unsuccessful Security Incidents include, but are not limited to, pings and take prompt steps to prevent the recurrence other broadcast attacks on Business Associate’s firewall, port scans, and unsuccessful log-on attempts, so long as no such incident results in unauthorized access, use, or disclosure of any Incident, including any action required by applicable federal and state laws and regulations.
e. Protected Health Information. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two must report any use or disclosure that constitutes a Breach within fifteen (7215) hours after discovery calendar days of any actual or suspected Breach the date the Business Associate becomes aware of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410the Breach. The Business Associate’s notification shall include, to the extent possible and subsequently as the information becomes available, will include the identification of all Individuals each Individual whose Unsecured PHI Protected Health Information has been or is reasonably believed by Business Associate to have been Breached along with accessed, acquired, used, or disclosed during the Breach, and any other available information that is required particulars regarding the Breach Covered Entity would need to be included include in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements as set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOMC.F.R. 164.404. To the extent commercially practicable, Business Associate agrees will work cooperatively with Covered Entity to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that mitigate any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt harmful effect of any administrative, civil, use or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to disclosure not provided for by this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actionsthe Privacy Regulations.
k. (d) In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to if applicable, ensure that any subcontractors Subcontractors that create, receive, maintain, or transmit protected health information Protected Health Information on behalf of the Business Associate for services provided to Covered Entity agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information. Business Associate agrees is expressly authorized to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate this Agreement to any Subcontractors it uses in its work for Covered Entity for purposes of obtaining the Subcontractor’s agreement to the terms and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) conditions of this Agreement. .
(e) To the extent Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI has Protected Health Information maintained in a Designated Record Set, make available such information to DOM or, the Covered Entity as directed by XXX, necessary to satisfy Covered Entity’s obligations under 45 C.F.R. 164.524 within ten (10) business days of Business Associate’s receipt of a written request from Covered Entity. If an Individual in order makes a request for access pursuant to meet 45 C.F.R. 164.524 directly to Business Associate, Business Associate will direct the requirements under 45 CFR § 164.524Individual to Covered Entity.
m. (f) To the extent Business Associate agrees to has Protected Health Information maintained in a Designated Record Set, make any amendment(s) to PHI in a Designated Record Set that DOM directs such information as directed or agrees agreed to by the Covered Entity pursuant to 45 CFR § C.F.R. 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. 164.526 at within ten (10) business days of Business Associate’s receipt of a written request from Covered Entity. If an Individual makes a request for amendment pursuant to 45 C.F.R. 164.526 directly to Business Associate, Business Associate will direct the request of DOM or an Individual, and in the time and manner designated by XXXIndividual to Covered Entity.
n. Business Associate agrees (g) Maintain and make available the information required to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for provide an accounting of Disclosures disclosures to Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. 164.528 within ten (10) business days of PHI in accordance with Business Associate’s receipt of a written request from Covered Entity. If an Individual makes a request for accounting pursuant to 45 CFR § 164.528. C.F.R. 164.528 directly to Business Associate, Business Associate agrees will direct the Individual to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of terminationCovered Entity.
o. (h) To the extent the Business Associate agrees is to provide carry out one or more of Covered Entity's obligation(s) under the Privacy Rule pursuant to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) the terms of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM the Covered Entity in the performance of such obligationobligation(s).
r. Business Associate agrees to make (i) Make its internal practices, books, and recordsrecords relating to Business Associate’s use and disclosure of Protected Health Information received from, including policies and proceduresor created or received by Business Associate on behalf of, Covered Entity available to the Secretary Department of Health and Human Services (HHS), the Office for Civil Rights (OCR), or their agents for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310HIPAA Rules.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. (a) Provider represents and warrants to Business Associate that its Notice of Privacy (a) Business Associate agrees to not Use use or Disclose further disclose PHI other than as specifically Practices permits Provider to disclose PHI to Business Associate and that the Notice permitted or required by the Service this Agreement or as Required required by Law.
b. law. of Privacy Practices used by Provider incorporates the terms and statements required (b) Business Associate shall agrees to use appropriate safeguards Administrative, Technical and comply with Subpart C of 45 C.F.R. Part 164 with respect Physical by the Privacy Rule. Safeguards to electronic PHI (ePHI1) to prevent Use use or Disclosure disclosure of PHI other than as provided for by this Agreement.
c. (b) Provider shall not request that Business Associate agrees to notify DOM without unreasonable delay use or disclose PHI in any manner Agreement; and no later than seventy-two (722) hours after discoveryreasonably and appropriately protect the Confidentiality, Integrity that would not be permissible under the Privacy Rule or Security Rule if done by Provider and Availability of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes awareElectronic PHI. except the uses specifically permitted under Section IV above, and any Security Incident of which it becomes aware.
d. where Business Associate (c) Business Associate agrees to mitigate, to the extent practicable, any harmful effect may use or disclose PHI for data aggregation or management and administrative that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate activities of Business Associate. in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Agreement. VI. TERM AND TERMINATION (d) Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery report to Provider if it becomes aware of any actual (1) use (a) TERM The Term of this Agreement shall be effective as of the date set forth above, or suspected Breach disclosure of Unsecured PHI not provided for by this Agreement; (2) unauthorized access of and shall remain effective so long as a relationship between the Provider and the Business Electronic PHI; (3) unauthorized destruction or modification of Electronic PHI; or (4) Associate shall persist. This Agreement shall terminate when all of the PHI provided by unauthorized interference with the systems operations of Business Associate’s electronic Provider to Business Associate, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed or created or received by Business Associate on behalf information systems containing Electronic PHI. of Provider, is destroyed or returned to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, andProvider or, if the CAP it is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees infeasible to promptly notify DOM upon notification return or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions destroy (“Actions”e) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that createagent, receiveincluding a subcontractor, maintainto PHI, protections are extended to such information in accordance with the termination whom it provides PHI received from or transmit protected health information created or received by Business Associate on provisions in Section VI (c)(2). behalf of the Business Associate agree Provider, agrees to the same restrictions, conditions, restrictions and requirements conditions that apply through (b) TERMINATION FOR CAUSE Upon Provider’s knowledge of a material breach of this this Agreement to Business Associate with respect to such information, including, Agreement by Business Associate, Provider shall provide written notice to Business without limitation, implementation of appropriate safeguards to protect the security of Electronic PHI. Associate identifying the breach, and permit Business Associate agrees twenty (20) days to ensure that any Subcontractors that create(f) Upon the written request of Provider, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at access cure the request of XXX, and in breach; if Business Associate does not cure the time and manner designated by XXX, breach or end the violation to Provider to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. that Business Associate agrees to make any amendment(s) to PHI maintains in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and (if in within the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activitiesspecified, or services forif cure is not possible, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply Provider may immediately terminate fact its arrangements with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Provider require Business Associate to accessmaintain Designated this Agreement. Record Sets on behalf of Provider), store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond order for Provider to meet the boundaries Patient access and jurisdiction of the United States without express written authorization from DOM(c) EFFECT OF TERMINATION copying requirements under 45 CFR 164.524.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use use or Disclose PHI disclose Protected Health Information other than as permitted or required by the Service this Agreement or as Required by By Law.
b. Business Associate shall agrees use appropriate safeguards and comply comply, where applicable, with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) Electronic Protected Health Information, to prevent Use use or Disclosure disclosure of PHI the Protected Health Information other than as provided for by this Agreement.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, report to the Covered Entity any use or disclosure of any Use or Disclosure of PHI Protected Health Information not provided for by this Agreement Agreement, including, without limitation, Breaches of which it becomes awareUnsecured Protected Health Information as required at 45 C.F.R. 164.410, and any Security Incident of which it becomes aware.
d. . The parties acknowledge and agree that this Section 2(c) constitutes notice by Business Associate agrees to mitigateCovered Entity of the ongoing existence and occurrence of attempted but unsuccessful Security Incidents for which no additional notice to Covered Entity shall be required. Unsuccessful Security Incidents shall include, but not be limited to, pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as such incidents do not result, to the extent practicable, any harmful effect that is known to Business Associate is aware, in unauthorized access, use or disclosure of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsElectronic Protected Health Information.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. d. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that createif applicable, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) Protected Health Information on behalf of Business Associate will agree in writing to comply with the applicable same restrictions, conditions, and requirements of the Security Rule and Privacy Rule by entering into a that apply to Business Associate under this Agreement and Business Associate shall provide DOM with a copy of all respect to such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreementsProtected Health Information.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. e. Business Associate agrees to make any amendment(s) to PHI available Protected Health Information in a Designated Record Set that DOM directs or agrees to pursuant Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR C.F.R. § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX164.524.
n. f. Business Associate agrees to maintain and make available the information required to provide an accounting of disclosures to Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. § 164.528. Accounting. VeraMental Inc. acknowledges and agrees to document such Disclosures disclosures of PHI and information related to such Disclosures as would be required for DOM to Covered Entity To respond to a request by an Individual for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6C.F.R. §164.528 and, if required by and upon the effective date of, Section 13405(c) years after of the date of disclosure or provide a full accounting HITECH Act and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to related regulatory guidance; and provide to DOM or an Individual, in a time and manner designated by DOM, Customer information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a Section. In the event an individual delivers the initial request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528directly to Veramental Inc., VeraMental Inc. shall forward such request to Covered Entity.
p. g. To the extent that Business Associate agrees that it shall only use is to carry out one or disclose the minimum PHI necessary to perform functionsmore of Covered Entity’s obligations under Subpart E of 45 C.F.R. Part 164, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule Subpart E that apply to DOM Covered Entity in the performance of such obligationobligations.
r. h. Business Associate agrees to make internal practices, books, and recordsrecords relating to the use and disclosure of Protected Health Information received from, including policies and proceduresor created or received by Business Associate on behalf of, Covered Entity available to the Secretary Secretary, for purposes of the Secretary determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310Rule.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. General Rule of PHI Use and Disclosure. The Business Associate agrees to not Use or Disclose PHI other than as permitted or required by the Service Agreement or as Required by Law.
b. Business Associate shall use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use or Disclosure of PHI other than as provided for by this Agreement.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only may use or disclose PHI it creates for, receives from or on behalf of, the minimum PHI necessary Department to perform functions, activities, activities or services for, or on behalf of, DOM the Department in accordance with the specifications set forth in this BAA, provided that such use or disclosure would not violate the HIPAA Standards if done by the Department; or as specified Required By Law. Any disclosures made by the Business Associate of PHI must be made in accordance with HIPAA Standards and other applicable laws. Notwithstanding any other provision herein to the contrary, the Business Associate shall limit uses and disclosures of PHI to the "minimum necessary," as set forth in the Service AgreementsHIPAA Standards. The Business Associate agrees to comply with any guidance issued use or disclose only a "limited data set" of PHI as defined in the HIPAA Standards while conducting the authorized activities herein and, except where a "limited data set" is not practicable in order to accomplish those activities. Except as otherwise limited by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rulethis BAA, Business Associate will comply with may use PHI for the requirements proper management and administration of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees or to make internal practicescarry out the legal responsibilities of the Business Associate. Except as otherwise limited by this BAA, booksBusiness Associate may disclose PHI for the proper management and administration of the Business Associate provided that the disclosures are Required By Law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as Required By Law or for the purpose for which it was disclosed to the person, and recordsthe person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached. Business Associate may use PHI to report violations of law to appropriate federal and state authorities, including policies and procedures, available consistent with 45 CFR § 164.5020). Business Associate may use PHI to provide Data Aggregation services to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with Department as permitted by the Privacy Rule pursuant to 45 C.F.R. § 160.310HIPAA Standards.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. (Privacy Rule)
2.1. Business Associate agrees to fully comply with the requirements under the Privacy Rule applicable to "business associates," as that term is defined in the Privacy Rule and not Use use or Disclose PHI further disclose Protected Health Information other than as permitted or required by the this Agreement, Service Agreement Contracts , or as Required required by Lawlaw. In case of any conflict between this Agreement and Service Contracts, this Agreement shall govern.
b. 2.2. Business Associate shall use appropriate agrees to implement administrative, physical, and technical safeguards , including policies, that reasonably and comply with Subpart C appropriately protect the confidentiality, integrity, and availability of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) any PHI, including EPHI, that it creates, receives, maintains, or that it transmits on behalf of Covered Entity, to prevent Use the use or Disclosure disclosure of PHI other than as provided for by this Agreement. Said safeguards shall include, but are not limited to, requiring employees to agree to use or disclose PHI only as permitted or required by this Agreement and taking related disciplinary actions for inappropriate use or disclosure of PHI, as necessary.
c. 2.3. Business Associate agrees shall, following a Breach of Unsecured Protected Health Information, as defined in the HITECH Act, immediately notify the Covered Entity pursuant to notify DOM the terms of 45 C.F.R. § 164.410 and cooperate in the Covered Entity's analysis procedures, including risk assessment, if requested. A Breach shall be treated as discovered by the Business Associate as of the first day on which such Breach is known, or should have been known, or, by exercising reasonable diligence, would have been known to Business Associate. Business Associate will provide notification to the Covered Entity without unreasonable delay and in no event later than seventy-two five (725) hours after discovery, business days of any Use suspected or Disclosure actual Breach of PHI security, intrusion, or unauthorized use or disclosure. Such notification will contain the elements required in 45 C.F.R. § 164.410.
2.4. Business Associate shall, pursuant to the HITECH Act and its implementing regulations, comply with all additional applicable requirements of the Privacy Rule, includi ng those contained in 45 C.F.R. §§ 164.502(e) and 164.504(e)(1)(ii), at such time as the requirements become applicable to business associates. Business Associate will not provided accept payment in exchange for by PHI, subject to the exceptions contained in the HITECH Act, without a valid authorization from the applicable patient/Individual. Business Associate shall not engage in any communication which might be considered marketing under the HITECH Act. Further, Business Associate shall, pursuant to the HITECH Act and its implementing regulations, comply with applicable requirements of the Security Rule, contained in 45 C.F.R. §§ 164.308, 164.310, 164.312, and 164.316, at such time as the requirements are applicable to business associates.
2.5. Business Associate shall within ten (10) business days of a written request from the Covered Entity and its agents or subcontractors allow the Covered Entity to conduct a reasonable inspection of the facility, systems, books, records agreements, policies, and procedures relating to the use or disclosure of Protected Health Information pursuant to this Agreement for the purpose of which it becomes aware, and any Security Incident monitoring compliance with the terms of which it becomes awarethis Agreement.
d. 2.6. Business Associate shall require any agent, including a subcontractor, to whom it provides PHI received from, created, or received by Business Associate on behalf of Covered Entity or that carries out any duties for the Business Associate involving the use, custody, disclosure, creation of, or access to PHI, to agree, by written contract with Business Associate, to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information.
2.7. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission agrees to require its employees, agents, and subcontractors to immediately report, to Business Associate, any use or disclosure of their Subcontractors’ Protected Health Information in violation of this Agreement, and to report to Covered Entity any use or disclosure of PHI not provided by or agreed upon in this Agreement.
2.8. If Business Associate Agreement(s) to DOM does not constitute DOM approval of any kindreceives PHI from Covered Entity in a Designated Reco rd Set, including of the use of such Subcontractors or of the adequacy of such agreements.
l. then Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXXCovered Entity, to PHI in a Designated Record Set, Set to DOM Covered Entity or, as directed by XXXCovered Entity, to an Individual in order to meet the requirements under 45 CFR C.F.R. § 164.524, provided that Business Associate shall have at least thirty (30) days from Covered Entity's notice to provide access to or deliver such information.
m. 2.9. If Business Associate receives Protected Health Information from Covered Entity in a Designated Record Se t, then Business Associate agrees to make any amendment(s) amendments to PHI Protected Health Information in a Designated Record Set that DOM the Covered Entity directs or agrees to pursuant to 45 CFR C.F.R. § 164.526 at the request of DOM Covered Entity or an Individual, and in the time and manner designated by XXXCovered Entity, provided that Business Associate shall have at least thirty (30) days from Covered Entity notice to make an amendment.
n. 2.10. Business Associate agrees to make its internal practices, books, and records , including policies and procedures and Protected Health Information, relating to the use and disclosure of PHI received from, created by , or received by Business Associate on behalf of Covered Entity, available to the Covered Entity or to the Secretary, in a time and manner designated by the Covered Entity or the Secretary, for purposes of determining Covered Entity's or Business Associate's compliance with the Privacy Rule.
2.11. Business Associate agrees to document such Disclosures disclosures of PHI and information related to such Disclosures disclosures as would be required for DOM Covered Entity to respond to a request by an Individual for an accounting of Disclosures disclosure of PHI in accordance with 45 CFR C.F.R. § 164.528.
2.12. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM Covered Entity or an Individual, in a time and manner designated by DOMCovered Entity, information collected in accordance with section (III)(h) of this Agreement, to permit XXX Covered Entity to respond to a request by an Individual for an and accounting of Disclosures disclosures of PHI Protected Health Information in accordance with 45 CFR C. F.R. § 164.528, provided that Business Associate shall have at least thirty (30) days from Covered Entity notice to provide access to, or deliver such information which shall include, at minimum, (a) date of the disclosure; (b) name of the third party to whom the Protected Health Information was disclosed and, if known, the address of the third party; (c) a brief description of the disclosed information; and (d) a brief explanation of the purpose and basis for such disclosure.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements2.13. Business Associate agrees it must use reasonable efforts to comply limit any use, disclosure, or request for use or disclosure of PHI to the minimum amount necessary to accomplish the intended purpose of the use, disclosure, or request in accordance with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes requirements of the Privacy Rule.
2.14. Covered Entity may, and pursuant to the Privacy Rule, reasonably rely on any requested disclosure as the minimum necessary policies and procedures communicated to for the stated purpose when the information is requested by Business Associate.
2.15. Business Associate by DOM.
q. acknowledges that if Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under is also a covered entity, as defined by the Privacy Rule, Business Associate is required, independent of Business Associate's obligations under this Agreement, to comply with the Privacy Rule's minimum necessary requirements when making any request fo r PHI from Covered Entity.
2.16. Business Associate agrees to adequately and properly maintain all Protected Health Information received from, or created or received on behalf of, Covered Entity, document subsequent uses and disclosures of such information by Business Associate, and upon request, provide Covered Entity with reasonable access to examine and copy such records and documents during normal business hours of Business Associate.
2.17. Business Associate agrees that Covered Entity may at any time review Busi ness Associate's privacy policies and procedures to determine whether they are consistent with Covered Entity's policies, procedures, and privacy practices, and shall promptly notify Business Associate in writing regarding any modifications Covered Entity may reasonably believe are needed in order to meet Covered Entity’s requirements.
2.18. If Business Associate receives a request from an Individual for a copy of the Individual's Protected Health Information, and the Protected Health Information is in the sole possession of the Business Associate, Business Associate will comply provide the requested copies to the Individual and notify the Covered Entity of such action. If Business Associate receives a request for PHI in the possession of the Covered Entity, or receives a request to exercise other Individual rights as set forth in the Privacy Rule, Business Associate shall notify Covered Entity of such request and forward the request to Covered Entity. Business Associate shall then assist Covered Entity in responding to the request.
2.19. Business Associate agrees to fully cooperate in good faith with and to assist Covered Entity in complying with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.Rule
Appears in 1 contract
Obligations and Activities of Business Associate. a. 3.1 Business Associate acknowledges and agrees that all Protected Health Information that is created, received, stored or transmitted by the Covered Entity and disclosed or made available in any form, including paper record, oral communication, audio recording, and electronic display by Covered Entity or its operating units to Business Associate or created, received, stored or transmitted by Business Associate on Covered Entity’s behalf shall be subject to this Agreement.
3.2 Business Associate agrees to not Use use or Disclose PHI further disclose Protected Health Information other than as permitted or required by the Service Services Agreement or as Required required by Lawlaw.
b. 3.3 Business Associate shall agrees to use appropriate safeguards to prevent any use or disclosure of Protected Health Information other than as provided by this Agreement, and to comply with Subpart C of 45 C.F.R. CFR Part 164 with respect to electronic PHI (ePHI) and HITECH Standards to prevent Use use or Disclosure disclosure of PHI Protected Health Information other than as provided for by this Agreement.
c. 3.4 Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, report to Covered Entity any use or disclosure of any Use or Disclosure of PHI Protected Health Information not provided for by this Agreement of which it becomes aware, including breaches of Unsecured Protected Health Information as required by at 45 CFR § 164.410, and any Security Incident of which it becomes aware. Business Associate will make this report to the Covered Entity’s Privacy Officer and Security Officer within twenty-four (24) hours after discovery. This report will include at least the following information (a) nature of the non-permitted or violating use or disclosure or Security Incident; and (b) the PHI used or disclosed (c) the identification of each individual whose unsecured PHI has been, or is reasonably believed by the Business Associate to have been accessed, acquired, used, or disclosed during the breach (d) any other information requested by Covered Entity that must be included in the notification to the individual pursuant to at 45 CFR § 164.404.
d. 3.5 In the event of a potential or actual Breach, Business Associate agrees shall cooperate with the Covered Entity to mitigateinvestigate, perform risk analyses, notify appropriate government , regulatory authorities, media, or individuals as required by law or generate statute and to the extent practicable, mitigate any harmful effect that is known to Business Associate and the Covered Entity as a result of a Use use or Disclosure disclosure of PHI Protected Health Information by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Agreement. The Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery shall be responsible for the direct costs of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, implementing these efforts to the extent possible and subsequently as that the information becomes availableactual or potential Breach is caused by the willful neglect, material breach or violation of the identification of all Individuals whose Unsecured PHI is reasonably believed Agreement by the Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410Associate.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. 3.6 In accordance with 45 C.F.R. §CFR § 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, Business Associate agrees may disclose protected health information to ensure a downstream business associate that any subcontractors that is an agent or subcontractor and may allow the agent or subcontractor to create, receive, maintain, or transmit protected health information Protected Health Information on its behalf of only if the Business Associate agree enters and maintains a written agreement with the agent or subcontractor pursuant to which the agent or subcontractor agrees to the same restrictions, conditions, and requirements that apply through this Agreement to Business Associate with respect to such information. This requirement applies to any person or entity who performs functions or activities that involve access to information created, received, maintained, or transmitted by the Business Associate. Nothing in this Section shall be deemed to permit a Business Associate to use an agent or subcontractor not approved by Covered Entity to perform work as may be provided in the Services Agreement.
3.7 Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree make available Protected Health Information in a designated record set to comply with the applicable requirements of Covered Entity to the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, extent and in the time and manner designated required by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. 3.8 Business Associate agrees to make any amendment(s) to PHI Protected Health Information in a Designated Record Set that DOM directs designated record set as directed or agrees agreed to by the Covered Entity pursuant to 45 CFR § 164.526 at the request of DOM 164.526; or an Individual, and in the time and manner designated by XXXtake other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR § 164.526.
n. 3.9 Business Associate agrees to document such Disclosures of PHI maintain and make available the information related required to such Disclosures as would be required for DOM to respond to a request by an Individual for provide an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees disclosures to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation Covered Entity as necessary to DOM at satisfy the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with Covered Entity’s obligations under 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. 3.10 Business Associate agrees to make internal practices, books, and recordsrecords relating to the use and disclosure of Protected Health Information created, including policies and proceduresreceived, maintained, or transmitted by Business Associate on behalf of, Covered Entity available to the Covered Entity, or at the request of the Covered Entity to the Secretary of Health and Human Services.
3.11 Business Associate agrees to document any disclosures of and make Protected Health Information available for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to accounting of disclosures, as required under 45 C.F.R. CFR § 160.310164.528.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. (a) Business Associate agrees to not Use use or Disclose further disclose PHI other than as required by law, the Agreement, or as permitted or required by the Service Agreement or as Required by Lawthis BAA.
b. (b) Business Associate shall agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) PHI, to prevent Use use or Disclosure disclosure of the PHI other than as provided for by this AgreementBAA.
c. (c) Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of report to Covered Entity any Use use or Disclosure disclosure of PHI not provided for by this Agreement BAA of which it becomes aware, including Breaches of Unsecured PHI as required at 45 C.F.R § 164.410, and any Security Incident of which it becomes aware.
d. . The Parties agree this section constitutes notice by Business Associate agrees to Covered Entity of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined below) for which no additional notice to Covered Entity shall be required. “Unsuccessful Security Incidents” shall include, but not be limited to, pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as no such incident results in unauthorized access, use or disclosure of PHI.!
(d) In the event of a Breach of any Unsecured PHI that Business Associate accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds or uses on behalf of Covered Entity, Business Associate shall provide notice of such Breach to Covered Entity immediately, but in any event not more than 7 business days after discovering the Breach or, by exercising reasonable diligence would have discovered the Breach. Notice of a Breach shall include, to the extent known to Business Associate: (i) the identification of each individual whose PHI has been, or is reasonably believed to have been, accessed, acquired, or disclosed during the Breach, (ii) the date of the Breach, if known, (iii) a description of the types of unsecured PHI that were involved in the Breach, (iv) the scope of the Breach, (v) a description of the Business Associate’s response to the Breach, and (vi) and steps Business Associate is taking to protect against any further breaches. In the event of a Breach, Business Associate shall, in consultation with Covered Entity, mitigate, to the extent practicable, any harmful effect of such Breach that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsAssociate.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72e) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any agents and subcontractors that create, receive, maintain, or transmit protected health information PHI on behalf of the Business Associate agree to the same substantially similar restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. (f) Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make its internal practices, books, and records, including policies and procedures, records available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant HIPAA Regulations.
(g) Business Associate agrees to maintain and make available to Covered Entity, within ten (10) business days following a written request, information necessary to permit Covered Entity to respond to a request by an individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 160.310164.528.
s. (h) If Business Associate maintains information in a Designated Record Set, it agrees that nothing to make available to Covered Entity, within ten (10) business days following a written request, PHI in this Agreement shall permit such Designated Record Set, in order for Covered Entity to respond to individuals’ requests for access to information about them in accordance with 45 C.F.R § 164.524. If Business Associate maintains, on behalf of Covered Entity, information in an electronic Designated Record Set, Business Associate shall provide such information in the electronic format to accessCovered Entity upon request, storeor, shareif directed by the Covered Entity, maintaindirectly to a requesting individual.
(i) If Business Associate maintains information in a Designated Record Set, transmit it agrees to make any amendments or use or disclose corrections to PHI in any form via any medium such Designated Record Set within ten (10) business days following a written request by the Covered Entity in accordance with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM45 C.F.R. § 164.526.
Appears in 1 contract
Samples: Business Associate Addendum
Obligations and Activities of Business Associate. a. a) Business Associate agrees to not Use use or Disclose disclose PHI other than as permitted or required by this Agreement, any underlying agreement between the Service Agreement parties, or as Required by By Law.
b. b) Business Associate shall will limit requests for and the use and disclosure of PHI to the minimum necessary PHI to accomplish the intended purpose of such use, disclosure or request, and as applicable, in accordance with the regulations and guidance issued by the Secretary on what constitutes the minimum necessary for Business Associate to perform its obligations to Covered Entity under this Agreement, any underlying agreement, or as Required By Law.
c) Business Associate agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use the use or Disclosure disclosure of PHI other than as provided for by this Agreement.
c. d) Business Associate agrees to notify DOM without unreasonable delay implement administrative, physical and no later than seventy-two (72) hours after discoverytechnical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of any Use Electronic PHI that it creates, receives, maintains or Disclosure transmits on behalf of PHI not provided for by this Agreement Covered Entity. Business Associate shall comply with all requirements of which it becomes aware, and any the Security Incident of which it becomes awareRule.
d. e) Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsAgreement.
e. f) Business Associate agrees to report to Covered Entity any use or disclosure of PHI not provided for by this Agreement of which it becomes aware as soon as practicable, and in no event later than thirty (30) calendar days. To the extent that Business Associate creates, receives, maintains or transmits Electronic PHI, Business Associate agrees to report as soon as practicable, and in no event later than thirty (30) calendar days, to Covered Entity any Security Incident, as determined by Business Associate, involving PHI of which Business Associate becomes aware. Notwithstanding the foregoing, Business Associate and Covered Entity acknowledge the ongoing existence and occurrence of attempted but unsuccessful Security Incidents that are trivial in nature, such as pings and port scans, and Covered Entity acknowledges and agrees that no additional notification to Covered Entity of such unsuccessful Security Incidents is required.
g) Following Business Associate’s discovery of a Breach of Unsecured PHI, Business Associate shall notify DOM Covered Entity of the Breach without unreasonable delay, and in no event later than seventy-two thirty (7230) hours calendar days after discovery Business Associate, or any of any actual its employees or suspected Breach of Unsecured PHIagents, all in accordance with 45 C.F.R. § 164.410discovered the Breach. The Such notification shall include, to the extent possible and subsequently as the information becomes availablepossible, the identification of all Individuals each Individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been Breached along with been, accessed, acquired, used, or disclosed during the Breach and any other information available information that to Business Associate about the Breach which is required to be included in the notification of the Breach provided to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all Individual in accordance with 45 C.F.R. § 164.410§164.404(c).
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15h) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii164.308(b)(2) and 164.308(b)(2164.502(e)(1)(ii), Business Associate agrees to ensure obtain satisfactory assurances that any subcontractors that create, receive, maintain, or transmit protected health information PHI on behalf of the Business Associate agree in writing to the same restrictions, conditions, restrictions and requirements conditions that apply through this Agreement to Business Associate with respect to such information; such assurances shall be documented in a Business Associate Agreement entered into by Business Associate and each subcontractor that creates, receives, maintains, or transmits PHI of behalf of Business Associate. Moreover, Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, such agent or transmit electronic PHI (ePHIsubcontractor agrees to implement reasonable and appropriate safeguards to protect Covered Entity’s Electronic PHI.
i) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXXCovered Entity, and in the a time and manner designated by XXXmutually acceptable to Business Associate and Covered Entity, to PHI in a Designated Record SetSet to Covered Entity, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR C.F.R. § 164.524, to the extent applicable to Business Associate.
m. j) Business Associate agrees to make any amendment(s) to PHI in its possession contained in a Designated Record Set that DOM Covered Entity directs or agrees to pursuant to 45 CFR C.F.R. § 164.526 at the request of DOM or an IndividualCovered Entity, and in the a time and manner designated by XXXmutually acceptable to Business Associate and Covered Entity and to the extent applicable to Business Associate.
n. k) Business Associate agrees to document such Disclosures disclosures of PHI and information related to such Disclosures disclosures as would be required for DOM Covered Entity to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR C.F.R. § 164.528. Business Associate agrees , and shall provide such information to retain such documentation Covered Entity if needed to respond to an individual’s request for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individualaccounting, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated mutually acceptable to Business Associate by DOM.
q. Business Associate agrees that and Covered Entity and to the extent that applicable to Business Associate.
l) Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to shall make its internal practices, books, and records, including policies and procedures, relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of Covered Entity, available to the Secretary for purposes of determining Covered Entity’s or Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310Rule.
s. m) To the extent Business Associate agrees that nothing in this Agreement shall permit is to carry out Covered Entity’s obligations under the Privacy Rule, Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium shall comply with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction requirements of the United States without express written authorization from DOMPrivacy Rule that apply to Covered Entity in the performance of such delegated obligation.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. A. Business Associate agrees to shall not Use use or Disclose disclose PHI other than as permitted or required by the Service Agreement this Addendum or as Required required by Lawlaw.
b. B. Business Associate shall agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of the PHI other than as provided for by this Agreement.
c. Addendum. Business Associate agrees to notify DOM without unreasonable delay implement administrative, physical and no later than seventy-two (72) hours after discoverytechnical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of any Use EPHI that Business Associate creates, receives, maintains or Disclosure transmits on behalf of Covered Entity, as provided for in the Security Rule.
C. Business Associate shall report to Covered Entity any use or disclosure of PHI not provided for by this Agreement Addendum of which it becomes aware, including breaches of unsecured PHI as required at 45 CFR 164.410, and any Security Incident security incident of which it becomes aware. Notice is hereby given that Business Associate may, from time to time, experience unsuccessful security incidents that do not result in unauthorized access to or use of PHI and are associated with ordinary network traffic, including broadcast attacks on firewalls or edge servers, port scans, unsuccessful log‐on attempts, denial of service attacks, packet sniffing (or other unauthorized access to traffic data that does not result in access beyond headers), or similar incidents. Covered Entity acknowledges that Business Associate has satisfied its obligation to provide notice of the above-described unsuccessful security incidents to Covered Entity.
d. D. Following the discovery of a Breach of unsecured PHI, Business Associate agrees to mitigate, to shall notify the extent practicable, any harmful effect that is known to Business Associate Covered Entity in writing of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM such Breach without unreasonable delay, delay and in no event later than seventy-two thirty (7230) hours calendar days after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410the discovery. The Such notification shall include, to the extent possible and subsequently as the information becomes available, include the identification of all Individuals each individual whose Unsecured unsecured PHI has been, or is reasonably believed to have been, accessed, acquired or disclosed during the Breach. A Breach shall be treated as discovered as of the first day on which such Breach is known or reasonably should have been known by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410Associate.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. E. In accordance with 45 C.F.R. §§ CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, Business Associate agrees to shall ensure that any subcontractors that create, receive, maintain, or transmit protected health information PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and .
F. Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to make available PHI in a Designated Record Set, designated record set to DOM or, the Individual or the Individual’s designee as directed by XXX, necessary to an Individual in order to meet the requirements satisfy Covered Entity’s obligations under 45 CFR § 164.524.
m. G. To the extent applicable, Business Associate agrees to shall make any amendment(s) to PHI in a Designated Record Set that DOM directs designated record set as directed or agrees agreed to by the Covered Entity pursuant to 45 CFR § 164.526 at the request of DOM 164.526, or an Individual, and in the time and manner designated by XXXtake other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526.
n. H. Business Associate agrees shall maintain and make available the information required to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for provide an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees disclosures to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI Covered Entity as necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOMsatisfy Covered Entity’s obligations under 45 CFR 164.528
I. To the Privacy Ruleextent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under Subpart E of 45 CFR Part 164, Business Associate will shall comply with the requirements of the Privacy Rule Subpart E that apply to DOM the Covered Entity in the performance of such obligation.obligation(s);
r. J. Business Associate agrees to shall make its internal practices, books, and records, including policies and procedures, records available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310HIPAA Rules.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Professional Services
Obligations and Activities of Business Associate. a. (a) Business Associate agrees to not Use or Disclose PHI Protected Health Information other than as permitted or required by the Service Agreement or this BA Agreement, as Required by Law, or as contemplated by the Terms of Use.
b. (b) Business Associate shall agrees to use appropriate safeguards and comply safeguards, including compliance with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) Protected Health Information, to prevent Use or Disclosure of PHI the electronic Protected Health Information other than as provided for permitted by this BA Agreement.
c. (c) Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of report to Covered Entity's Privacy Official any Use or Disclosure of PHI Protected Health Information not provided for by this BA Agreement of which it becomes aware, including Breaches of Unsecured Protected Health Information as required by 45 C.F.R. §164.410, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate. For reports of incidents constituting a Breach, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification report shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals each individual whose Unsecured PHI Protected Health Information has been, or is reasonably believed by Business Associate to have been Breached along been, accessed, acquired, or Disclosed during such Breach. Security Incidents that do not result in any unauthorized access, use, disclosure, modification, destruction of information or interference with any other available information that is required to system operations will be included reported in the notification aggregate upon written request of Covered Entity in a manner and frequency mutually acceptable to the Individualparties. Business Associate hereby reports to Covered Entity that incidents including, HHSbut not limited to, and/or the mediaping sweeps or other common network reconnaissance techniques, all attempts to log on to a system with an invalid password or username, and denial of service attacks that do not result in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410a server being taken off line, may occur from time to time.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10d) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ §164.502(e)(1)(ii) and 164.308(b)(2), if applicable, Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information Protected Health Information on behalf of the Business Associate agree to the same restrictions, conditions, conditions and requirements that apply through this BA Agreement to Business Associate with respect to such information. .
(e) To the extent Business Associate has Protected Health Information in a Designated Record Set, and only to the extent required by HIPAA, Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI make available Protected Health Information in a Designated Record Set, to DOM or, Covered Entity as directed by XXX, necessary to an Individual in order to meet the requirements satisfy Covered Entity's obligations under 45 CFR § C.F.R. §164.524. The Parties agree and acknowledge that it is Covered Entity's responsibility to respond to all such requests.
m. (f) Business Associate agrees to make Protected Health Information available for purposes of any amendment(s) to PHI Protected Health Information in its possession contained in a Designated Record Set that DOM directs or agrees as agreed to by Covered Entity pursuant to 45 CFR § C.F.R. §164.526 at the request of DOM or an Individual, take other measures as necessary to satisfy Covered Entity's obligations under 45 C.F.R. §164.526. The Parties agree and in the time and manner designated by XXXacknowledge that it is Covered Entity's responsibility to respond to all such requests.
n. (g) Business Associate agrees to document such Disclosures maintain and make available the information required to provide an accounting of PHI disclosures to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 C.F.R. §164.528. The Parties agree and information related to such Disclosures as would be required for DOM acknowledge that it is Covered Entity's responsibility to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. all such requests.
(h) To the extent Business Associate agrees is to retain such documentation for at least six (6) years after carry out one or more of Covered Entity's obligations under Subpart E of 45 C.F.R. Part 164 of the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an IndividualHIPAA Rules, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule Subpart E that apply to DOM Covered Entity in the performance of such obligationobligation(s).
r. (i) Business Associate agrees to make its internal practices, books, and records, including policies records related to Business Associate's use and procedures, disclosure of Protected Health Information received from Covered Entity available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310HIPAA Rules.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to will:
a. not Use use or Disclose PHI disclose Protected Health Information that it receives from or on behalf of Athena or that it creates on behalf of Athena (collectively “PHI”) other than as permitted or required by the Service Agreement this Appendix, or as Required required by Law.law;
b. Business Associate shall not use or disclose PHI in a manner that would violate the requirements of the Privacy Rule when done by Athena, except as permitted by Section 3, below;
c. use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of the PHI other than as provided for by this Agreement.
c. Business Associate agrees Appendix and shall, after the compliance date of the HIPAA Final Rule, comply with the Security Rule with respect to notify DOM without unreasonable delay and no later Electronic PHI, to prevent use or disclosure of such information other than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not as provided for by the Agreement and this Agreement of which it becomes awareAppendix;
d. implement administrative, physical, and any Security Incident technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of which it becomes aware.PHI (including electronic PHI);
d. Business Associate agrees to e. mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Appendix;
f. report to Athena as soon as practicable and as required by HIPAA and the HITECH Act, as implemented by the HIPAA Omnibus Final Rule (“HIPAA Final Rule”) and any subsequent amendment thereto, or any subsequent rule or regulation interpreting or modifying HIPAA or the HITECH Act, any use or disclosure of PHI by Business Associate other than as provided for by this Agreement and take prompt steps any Security Incident (as defined in the Security Rule) with respect to prevent the recurrence electronic PHI;
g. upon discovery of any IncidentBreach involving Unsecured PHI, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM Athena of that Breach without unreasonable delay; provided, however, that the parties acknowledge and agree that this Section constitutes notice by Business Associate to Athena of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined below) for which notice to Athena by Business Associate shall be required only upon request. “Unsuccessful Security Incidents” shall include, but not be limited to, pings and other broadcast attacks on Business Associate's firewall, port scans, unsuccessful log-on attempts, denials of service, and any combination of the above, so long as no later than seventy-two such incident results in unauthorized access, use, or disclosure of PHI. Business Associate's notification to Athena shall include (72i) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall includeidentification, to the extent possible and subsequently as the information becomes availablepossible, the identification of all Individuals each individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been Breached along with accessed, used, or disclosed through the Breach; (ii) any other available information known to Business Associate that Athena is required to include in its notice to affected individuals; and (iii) any other information that is required would need to be included in Athena's accounting of disclosures under HIPAA or the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business AssociateHITECH Act, as applicable, demonstrates there is a low probability implemented by the PHI has been compromised HIPAA Final Rule and any subsequent amendment thereto or one of any subsequent rule or regulation interpreting or modifying HIPAA or the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.HITECH Act;
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to h. ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incidentagent, including costs associated with mitigation of the Incident and preparation and delivery of notices a subcontractor, to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate whom it provides PHI agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, restrictions and requirements conditions that apply through this Agreement to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.;
l. Business Associate agrees to i. provide access, at the request of XXX, and in the time and manner designated by XXXAthena, to PHI in a Designated Record Set, to DOM Athena or, as directed by XXXAthena, to an Individual in order to meet the requirements under 45 CFR § 164.524.;
m. Business Associate agrees to j. make any amendment(s) each amendment to PHI in a Designated Record Set that DOM Athena directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM Athena or an Individual;
k. make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary, in the a time and manner designated by XXX.the Secretary, for purposes of the Secretary determining Athena's compliance with the Privacy Rule;
n. Business Associate agrees to l. document such Disclosures disclosures of PHI and information related to such Disclosures disclosures as would be required for DOM Athena to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.;
o. Business Associate agrees to m. provide to DOM Athena or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX Athena to respond to a request by an that Individual for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528.;
n. establish and enforce appropriate clearance procedures and supervision to assure that its workforce follows requirements consistent with HIPAA;
o. act immediately and effectively to terminate access to PHI of any of its staff upon such staff member's termination or reassignment;
p. Business Associate agrees provide appropriate training for its staff to assure that it shall only use or disclose its staff complies with its obligations consistent with the minimum PHI necessary requirements of HIPAA; and
q. implement appropriate (i) disposal and reuse procedures with respect to perform functionsdocuments and equipment, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule(ii) authentication and access controls, and any minimum necessary policies and procedures communicated (iii) appropriate encryption to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply protect PHI consistent with the requirements of the Privacy Rule that apply to DOM in the performance of such obligationSecurity Rule.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Obligations and Activities of Business Associate. a. (a) Business Associate agrees to not Use use or Disclose further disclose PHI other than as required by law, or as permitted or required by the Service Agreement or as Required by Lawthis Agreement.
b. (b) Business Associate shall agrees to use appropriate safeguards safeguards, and comply comply, where applicable with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) protected health information, to prevent Use use or Disclosure disclosure of the PHI other than as provided for by this Agreement.
c. (c) Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of report to Covered Entity any Use use or Disclosure disclosure of PHI not provided for by this Agreement of which it becomes aware, including Breaches of Unsecured PHI as required at 45 C.F.R § 164.410, and any Security Incident of which it becomes aware. The Parties acknowledge and agree that this section constitutes notice by Business Associate to Covered Entity of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined below) for which no additional notice to Covered Entity shall be required. “Unsuccessful Security Incidents” shall include, but not be limited to, pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as no such incident results in unauthorized access, use or disclosure of PHI. The Parties agree that this Section satisfies any notice requirements of Business Associate to Covered Entity of the ongoing existence and occurrence of such attempted but Unsuccessful Security Incidents.
d. (d) In the event of a Breach of any Unsecured PHI that Business Associate agrees accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds or uses on behalf of Covered Entity, Business Associate shall provide notice of such Breach to Covered Entity immediately, but in any event not more than ten (10) days after discovering the Breach. Notice of a Breach shall include, at a minimum: (i) the identification of each individual whose PHI has been, or is reasonably believed to have been, accessed, acquired, or disclosed during the Breach, (ii) the date of the Breach, if known, (iii) the scope of the Breach, and (iv) a description of the Business Associate’s response to the Breach. In the event of a Breach, Business Associate shall, in consultation with Covered Entity, mitigate, to the extent practicable, any harmful effect of such Breach that is known to Business Associate of a Use or Disclosure of PHI by Associate. In the event that Business Associate lacks any information required to be disclosed in Violation of the requirements of initial notice required under this Agreement and take prompt steps to prevent the recurrence of any IncidentSection, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, provide regular updates to the extent possible and subsequently notice as the such information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10e) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any agents and subcontractors that create, receive, maintain, or transmit protected health information PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. (f) Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make its internal practices, books, and records, including policies and procedures, records available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310HIPAA Regulations.
s. (g) Business Associate agrees that nothing in this Agreement shall permit Business Associate to accessmaintain and make available to Covered Entity, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.within thirty
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. (a) Business Associate agrees to not Use use or Disclose further disclose PHI other than as permitted or required by this Agreement, the Service Agreement Services Agreement, or as Required permitted or required by Lawlaw.
b. (b) Business Associate shall agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of the PHI other than as provided for by this Agreement.
c. (c) In accordance with the HIPAA Standards, Business Associate shall implement Administrative, Physical and Technical Safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of ePHI that it creates, receives, maintains or transmits on behalf of the Covered Entity. Specifically, Business Associate shall comply with the Security Standards.
(d) Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of report to Covered Entity any Use use or Disclosure disclosure of PHI not provided for by this Agreement of which it Business Associate becomes aware. Additionally, and Business Associate shall report to Covered Entity any Security Incident resulting in an unauthorized use or disclosure of ePHI of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two becomes aware within twenty (7220) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410business days. The notification shall include, to the extent possible parties acknowledge and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed agree that this Section 2(d) constitutes notice by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one Covered Entity of the exceptions ongoing existence and occurrence or attempts of Unsuccessful Security Incidents for which no additional notice to the definition of Breach appliesCovered Entity shall be required. “Unsuccessful Security Incidents” means, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperatewithout limitation, coordinate with, pings and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to other broadcast attacks on Business Associate’s conduct or status as a business associate for DOMfirewall, regardless port scans, unsuccessful log-on attempts, denial of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Ruleservice attacks, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements combination of the Privacy Rule that apply to DOM above, so long as no such incident results in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to unauthorized access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction disclosure of the United States without express written authorization from DOMPHI.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. A. Business Associate agrees not to not Use use or Disclose disclose PHI other than as permitted or required by the Service Agreement Agreement, this Agreement, or as Required required by Law.
b. law. Business Associate shall use appropriate safeguards and will comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use or Disclosure of PHI other than as provided for by this Agreement.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements provisions of this Agreement related to privacy and take prompt steps security of PHI and the Regulations, as they may be modified from time to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delaytime, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, that are applicable to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM Covered Entity or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to To the extent that Business Associate carries out DOMperforms any of Covered Entity’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM Covered Entity in the performance of such obligation.
r. B. Business Associate agrees to use appropriate administrative, physical and technical safeguards, and comply with the Security Rule with respect to electronic PHI, to prevent the use or disclosure of the PHI other than as provided for by this Agreement. Business Associate acknowledges and agrees that under the HITECH Act (i) the requirements of Sections 164.308 (administrative safeguards), 164.310 (physical safeguards), 164.312 (technical safeguards) and 164.316 (policies and procedures and documentation requirements) of the Security Rule apply to Business Associate in the same manner that such sections apply to Covered Entity, and (ii) the additional requirements of the HITECH Act that relate to security and that are made applicable to Covered Entity shall also be applicable to Business Associate (with such security requirements in (i) and (ii) above collectively referred to as the “HITECH Act Security Requirements”). Business Associate shall comply with the HITECH Act Security Requirements which shall be, by this reference, incorporated into this BA Agreement. Unless Covered Entity agrees, in writing, that this requirement is infeasible with respect to particular data, Business Associate shall secure all Protected Health Information by a technology standard that renders Protected Health Information unusable, unreadable, or indecipherable to unauthorized individuals consistent with guidance issued by the Secretary, including the use of standards developed under Section 3002(b)(2)(B)(vi) of the Public Health Service Act, as added by the HITECH Act. Business Associate shall ensure that any agents and subcontractors that create, receive, maintain or transmit PHI on behalf of Business Associate agree to comply with the same restrictions, conditions, and requirements that apply through this Agreement or otherwise to Business Associate with respect to such information. Business Associate shall enter into written agreements with any subcontractors, and the terms of such agreements shall incorporate the applicable requirements of, and otherwise comply with, the Regulations. Business Associate will make available during normal business hours at Business Associate’s offices all records, books, agreements, internal practices, policies and procedures relating to the use or disclosure of PHI to the Secretary, in a time and manner designated by the Secretary, for purposes of determining compliance with the Regulations, subject to attorney-client and other applicable legal privileges. Business Associate will provide documentation regarding any disclosures by Business Associate that would be required for an accounting of disclosures to an Individual under 45 CFR § 164.528 and the HITECH Act, within a reasonable amount of time of receipt of a request from Covered Entity. Any request under § 164.528 from an Individual made directly to Business Associate will be referred within five (5) business days to Covered Entity. To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate agrees to make internal practicesPHI available for amendment and incorporate any amendments to PHI in accordance with the requirements of 45 C.F.R. § 164.526. Any request under § 164.526 from an Individual made directly to Business Associate will be referred within five (5) business days to Covered Entity. To the extent Business Associate maintains PHI in a Designated Record Set, books, and records, including policies and procedures, Business Associate agrees to make PHI available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with extent and in the Privacy Rule pursuant to manner required by 45 C.F.R. § 160.310.
s. 164.524. Any request under § 164.524 from an Individual made directly to Business Associate will be referred within five (5) business days to Covered Entity. Business Associate agrees that nothing to comply with any requests for restrictions on certain disclosures of PHI to which Covered Entity has agreed in accordance with 45 C.F.R. § 164.522 and the Regulations and of which Business Associate has been notified by Covered Entity. Business Associate will mitigate, to the extent practicable, any harmful effects from any use or disclosure of PHI by Business Associate not permitted by this Agreement Agreement. Business Associate agrees to notify within five (5) business days the designated Privacy Official of the Covered Entity of any use or disclosure of PHI by Business Associate not permitted by this Agreement, any Security Incident, and any Breach of Unsecured Protected Health Information of which Business Associate becomes aware. Business Associate shall permit provide the following information to Covered Entity within ten (10) business days of discovery of a breach of unsecured PHI except when despite all reasonable efforts by Business Associate to accessobtain the information required, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, circumstances beyond the boundaries and jurisdiction control of the United States Business Associate necessitate additional time. Under such circumstances Business Associate shall provide to Covered Entity the following information as soon as possible and without express written authorization unreasonable delay, but in no event later than thirty (30) calendar days from DOM.the date of discovery of a breach: the date of the breach; the date of the discovery of the breach;
Appears in 1 contract
Samples: Purchase Order Terms and Conditions
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use or Disclose PHI Protected Health Information other than as permitted or required by the Service this Agreement or as Required by By Law.
b. Business Associate shall agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use or Disclosure of PHI Protected Health Information other than as provided for by this Agreement. Business Associate further agrees to implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of any electronic Protected Health Information, as provided for in the Security Rule and as mandated by Section 13401 of the HITECH Act, as amended from time to time.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI Protected Health Information by Business Associate in Violation violation of the requirements of this Agreement. Business Associate further agrees to report to Covered Entity any Use or Disclosure of Protected Health Information not provided for by this Agreement of which it becomes aware, and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsin a manner as prescribed herein.
e. d. Business Associate agrees to notify DOM report to Covered Entity if it becomes aware of any use or disclosure of PHI not provided for by this Agreement, including any Breach of Unsecured PHI as required by 45 CFR 164.410, and any Security Incident of which it becomes aware. Notwithstanding anything herein to the contrary, the parties acknowledge and agree that this Agreement shall constitute notice to Covered Entity that Business Associate may periodically experience broadcast attacks on its firewall, port scans, unsuccessful log-on attempts, denials of service and similar unsuccessful security incidents, and Business Associate need not further report such incidents to Covered Entity so long as such incidents do not result in unauthorized access, use or disclosure of PHI.
e. If the Breach, as discussed in Part II(d), pertains to Unsecured Protected Health Information, then Business Associate agrees to report any such data Breach to Covered Entity without unreasonable delay, and but in no later event more than seventy-two sixty (7260) hours after days of discovery of said Breach; unless it receives a request to delay such notification from a law enforcement official pursuant to 45 CFR 164.412. Business Associate further agrees, consistent with Section 13402 of the HITECH Act, to provide Covered Entity with information necessary for Covered Entity to meet the requirements of said section, and in a manner and format to be specified by Covered Entity.
f. If Business Associate is an Agent of Covered Entity, then Business Associate agrees that any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification Protected Health Information shall include, be reported to Covered Entity immediately after the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with becomes aware of said Breach, and under no circumstances later than one (1) business days thereafter. Business Associate further agrees that any compromise of Protected Health Information, other available information that is required to than a Breach of Unsecured Protected Health Information as specified in Part II(e) of this Agreement, shall be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable Covered Entity within ten (10) working days. An impermissible Use or Disclosure business days of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410discovering said compromise.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident areSubcontractor, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. whom Business Associate provides Protected Health Information, agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, restrictions and requirements conditions that apply through this Agreement to Business Associate with respect to such information. Business Associate further agrees that restrictions and conditions analogous to those contained herein shall be imposed on said Subcontractors via a written agreement that complies with all the requirements specified in §164.504(e)(2). Further, Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI provide copies of said written agreements to Covered Entity within ten (ePHI10) on behalf business days of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business AssociateCovered Entity’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreementsrequest for same.
l. h. Business Associate agrees to provide access, at the request of XXX, Covered Entity and in the time and manner designated by XXXduring normal business hours, to PHI Protected Health Information in a Designated Record Set, Set to DOM Covered Entity or, as directed by XXXCovered Entity, to an Individual Individual, in order to meet the Covered Entity’s requirements under 45 CFR § §164.524, provided that Covered Entity delivers to Business Associate a written notice at least three (3) business days in advance of requesting such access. Business Associate further agrees, in the case where Business Associate controls access to Protected Health Information in an Electronic Health Record, or controls access to Protected Health Information stored electronically in any format, to provide similar access in order for Covered Entity to meet its requirements the HIPAA Rules and under Section 13405(c) of the HITECH Act. These provisions do not apply if Business Associate and its employees or Subcontractors have no Protected Health Information in a Designated Record Set of Covered Entity.
m. i. Business Associate agrees to make any amendment(s) to PHI Protected Health Information in a Designated Record Set that DOM Covered Entity directs or agrees to pursuant to 45 CFR § 164.526 §164.526, at the request of DOM Covered Entity or an Individual, . This provision does not apply if Business Associate and in the time and manner designated by XXXits employees or Subcontractors have no Protected Health Information from a Designated Record Set of Covered Entity.
n. j. Business Associate agrees to document make its internal practices, books and records relating to the use and disclosure of PHI available at the request of the Covered Entity to the Secretary, for purposes of determining Covered Entity's compliance with the Privacy Rule, subject to attorney-client or other applicable legal privileges, for purposes of the Secretary determining Covered Entity's compliance with the HIPAA Rules and the HITECH Act. Business Associate further agrees, at the request of Covered Entity, to provide Covered Entity with demonstrable evidence that its Compliance Information ensures Business Associate’s compliance with this Agreement over time. Business Associate shall have a reasonable time within which to comply with requests for such access and/or demonstrable evidence, consistent with this Agreement. In no case shall access, or demonstrable evidence, be required in less than five (5) business days after Business Associate’s receipt of such request, unless otherwise designated by the Secretary.
k. Business Associate agrees to maintain necessary and sufficient documentation of Disclosures of PHI and information related to such Disclosures Protected Health Information as would be required for DOM Covered Entity to respond to a request by an Individual for an accounting of Disclosures of PHI such Disclosures, in accordance with 45 CFR § 164.528. Business Associate agrees §164.528 as may be amended from time to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of terminationtime.
o. l. On request of Covered Entity, Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected Covered Entity documentation made in accordance with section (III)(h) of this Agreement, Agreement to permit XXX Covered Entity to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI Protected Health Information in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary C.F.R. §164.528 as may be amended from time to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreementstime. Business Associate agrees shall provide said documentation in a manner and format to be specified by Covered Entity. Business Associate shall have a reasonable time within which to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, such a request from Covered Entity and any minimum necessary policies and procedures communicated to in no case shall Business Associate by DOMbe required to provide such documentation in less than three (3) business days after Business Associate's receipt of such request.
q. m. Except as provided for in this Agreement, in the event Business Associate agrees that receives an access, amendment, accounting of disclosure, or other similar request directly from an Individual, Business Associate shall redirect the Individual to the Covered Entity.
n. To the extent that Business Associate carries out DOMone or more of Covered Entity’s obligations under the Privacy RuleHIPAA Rules, the Business Associate will must comply with the all requirements of the Privacy Rule HIPAA Rules that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available would be applicable to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310Covered Entity.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. (a) Business Associate agrees to not Use or Disclose PHI Protected Health Information other than as permitted or required by the Service Agreement or this BA Agreement, as Required by Law, or as contemplated by the Service Agreement.
b. (b) Business Associate shall agrees to use appropriate safeguards and comply safeguards, including compliance with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) Protected Health Information, to prevent Use or Disclosure of PHI the electronic Protected Health Information other than as provided for permitted by this BA Agreement.
c. (c) Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of report to Covered Entity's Privacy Official any Use or Disclosure of PHI Protected Health Information not provided for by this BA Agreement of which it becomes aware, including Breaches of Unsecured Protected Health Information as required by 45 C.F.R. §164.410, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate. For reports of incidents constituting a Breach, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification report shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals each individual whose Unsecured PHI Protected Health Information has been, or is reasonably believed by Business Associate to have been Breached along been, accessed, acquired, or Disclosed during such Breach. Security Incidents that do not result in any unauthorized access, use, disclosure, modification, destruction of information or interference with any other available information that is required to system operations will be included reported in the notification aggregate upon written request of Covered Entity in a manner and frequency mutually acceptable to the Individualparties. Business Associate hereby reports to Covered Entity that incidents including, HHSbut not limited to, and/or the mediaping sweeps or other common network reconnaissance techniques, all attempts to log on to a system with an invalid password or username, and denial of service attacks that do not result in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410a server being taken off line, may occur from time to time.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10d) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ §164.502(e)(1)(ii) and 164.308(b)(2), if applicable, Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information Protected Health Information on behalf of the Business Associate agree to the same restrictions, conditions, conditions and requirements that apply through this BA Agreement to Business Associate with respect to such information. .
(e) To the extent Business Associate has Protected Health Information in a Designated Record Set, and only to the extent required by HIPAA, Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI make available Protected Health Information in a Designated Record Set, to DOM or, Covered Entity as directed by XXX, necessary to an Individual in order to meet the requirements satisfy Covered Entity's obligations under 45 CFR § C.F.R. §164.524. The Parties agree and acknowledge that it is Covered Entity's responsibility to respond to all such requests.
m. (f) Business Associate agrees to make Protected Health Information available for purposes of any amendment(s) to PHI Protected Health Information in its possession contained in a Designated Record Set that DOM directs or agrees as agreed to by Covered Entity pursuant to 45 CFR § C.F.R. §164.526 at the request of DOM or an Individual, take other measures as necessary to satisfy Covered Entity's obligations under 45 C.F.R. §164.526. The Parties agree and in the time and manner designated by XXXacknowledge that it is Covered Entity's responsibility to respond to all such requests.
n. (g) Business Associate agrees to document such Disclosures maintain and make available the information required to provide an accounting of PHI disclosures to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 C.F.R. §164.528. The Parties agree and information related to such Disclosures as would be required for DOM acknowledge that it is Covered Entity's responsibility to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. all such requests.
(h) To the extent Business Associate agrees is to retain such documentation for at least six (6) years after carry out one or more of Covered Entity's obligations under Subpart E of 45 C.F.R. Part 164 of the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an IndividualHIPAA Rules, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule Subpart E that apply to DOM Covered Entity in the performance of such obligationobligation(s).
r. (i) Business Associate agrees to make its internal practices, books, and records, including policies records related to Business Associate's use and procedures, disclosure of Protected Health Information received from Covered Entity available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310HIPAA Rules.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to agrees: To not Use use or Disclose disclose PHI other than as permitted or required by the Service Agreement this Agreement, applicable State Laws, or as Required by Law.
b. Business Associate shall use . To implement appropriate safeguards administrative, physical and technical safeguards, and comply with Subpart C of 45 C.F.R. CFR Part 164 with respect to electronic PHI (ePHI) Electronic PHI, to prevent Use the use or Disclosure disclosure of PHI other than as provided for by this Agreement.
c. Business Associate agrees . Pursuant to notify DOM the HITECH Act and its implementing regulations, to comply with all applicable requirements of the Privacy Rule. To not directly or indirectly receive remuneration in exchange for any PHI, nor engage in any communication involving PHI which might be deemed to be Marketing under the HIPAA Rules, without unreasonable delay and no later than seventy-two (72) hours after discoverythe express written consent of the Covered Entity. To report to Covered Entity any use or disclosure of PHI, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, which is not in compliance with the terms of this Agreement, including but not limited to Breaches of Unsecured PHI or personal information, and any Security Incident security incident of which it becomes aware.
d. . Following the discovery of a Breach of PHI, to notify the Covered Entity of such Breach pursuant to the terms of 45 CFR §164.410, and cooperate in the Covered Entity’s Breach analysis procedures and risk assessment, if requested. A Breach shall be treated as discovered by Business Associate agrees as of the first day on which such Breach is known to Business Associate or its workforce or, by exercising reasonable diligence, would have been known to Business Associate or its workforce. Business Associate will provide such notification to Covered Entity without unreasonable delay and in no event later than five (5) calendar days after discovery of the Breach. Such notification shall contain the information required by 45 C.F.R. §164.410. To mitigate, to the extent practicable, any the harmful effect that caused by Business Associate’s use or disclosure of PHI which is known to Business Associate in violation of a Use this Agreement or Disclosure by any Breach of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any IncidentAssociate, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delayits employees, agents or subcontractors, and no later than seventy-two (72) hours after discovery to provide notice to Covered Entity of any actual or suspected Breach such mitigation efforts. To make its internal practices, books, and records relating to the use and disclosure of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, available to the extent possible Secretary of Health and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describingHuman Services, at a minimumreasonable time and in a reasonable manner or as designated by the Secretary, for purposes of the measures Secretary determining Covered Entity’s compliance with the HIPAA Rules. To ensure that its employees and agents are aware of and agree to the same restrictions and conditions which apply to Business Associate has taken and intends with respect to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. . In accordance with 45 C.F.R. §§ 164.502(e)(1)(iiCFR 164.502(e)1)(ii) and 164.308(b)(2), Business Associate agrees to if applicable, ensure that any subcontractors that create, receive, maintain, or transmit protected health information PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information. To the extent the Business Associate agrees is to ensure that any Subcontractors that create, receive, maintain, carry out one or transmit electronic PHI (ePHImore of Covered Entity’s obligation(s) on behalf under Subpart E of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an IndividualPart 164, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule Subpart E that apply to DOM the Covered Entity in the performance of such obligationobligation(s).
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. (a) Business Associate agrees to not Use or Disclose PHI Protected Health Information other than as permitted or required by the Service Agreement or this BAA, as Required by Law, or as contemplated by the Terms of Use.
b. (b) Business Associate shall agrees to use appropriate safeguards and comply safeguards, including compliance with Subpart C of 45 C.F.R. Part 164 164, with respect to electronic PHI (ePHI) Protected Health Information to prevent Use or Disclosure of PHI the electronic Protected Health Information other than as provided for permitted by this AgreementBAA.
c. (c) Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of report to Covered Entity’s Privacy Official any Use or Disclosure of PHI Protected Health Information not provided for by this Agreement BAA of which it becomes aware, including Breaches of Unsecured Protected Health Information as required by 45 C.F.R. §164.410, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate. For reports of incidents constituting a Breach, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall report will include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals each individual whose Unsecured PHI Protected Health Information has been, or is reasonably believed by Business Associate to have been Breached along been, accessed, acquired, or Disclosed during such Breach. Security Incidents that do not result in any unauthorized access, Use, Disclosure, modification, destruction of information, or interference with any other available information that is required to system operations will be included reported in the notification aggregate upon written request of Covered Entity in a manner and frequency mutually acceptable to the IndividualParties. Business Associate hereby reports to Covered Entity that incidents such as ping sweeps or other common network reconnaissance techniques, HHSattempts to log on to a system with an invalid password or user name, and/or the media, all and denial of service attacks that do not result in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410a server being taken off line may occur from time to time.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10d) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ §164.502(e)(1)(ii) and 164.308(b)(2), if applicable, Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information Protected Health Information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply under this BAA to Business Associate with respect to such information. .
(e) To the extent Business Associate has Protected Health Information in a Designated Record Set, and only to the extent required by HIPAA, Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI make available Protected Health Information in a Designated Record Set, to DOM or, Covered Entity as directed by XXX, necessary to an Individual in order to meet the requirements satisfy Covered Entity’s obligations under 45 CFR § C.F.R. §164.524. The Parties agree and acknowledge that it is Covered Entity’s responsibility to respond to all such requests.
m. (f) Business Associate agrees to make Protected Health Information available for purposes of any amendment(s) amendment to PHI Protected Health Information in its possession contained in a Designated Record Set that DOM directs or agrees as agreed to by Covered Entity pursuant to 45 CFR § C.F.R. §164.526 at the request of DOM or an Individual, take other measures as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. §164.526. The Parties agree and in the time and manner designated by XXXacknowledge that it is Covered Entity’s responsibility to respond to all such requests.
n. (g) Business Associate agrees to document such Disclosures maintain and make available the information required to provide an accounting of PHI disclosures to Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. §164.528. The Parties agree and information related to such Disclosures as would be required for DOM acknowledge that it is Covered Entity’s responsibility to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. all such requests.
(h) To the extent Business Associate agrees is to retain such documentation for at least six (6) years after carry out one or more of Covered Entity’s obligations under Subpart E of 45 C.F.R. Part 164 of the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an IndividualHIPAA Rules, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule Subpart E that apply to DOM Covered Entity in the performance of such obligationobligation(s).
r. (i) Business Associate agrees to make its internal practices, books, and records, including policies records related to Business Associate’s Use and procedures, Disclosure of Protected Health Information received from Covered Entity available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310HIPAA Rules.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Business Associate Addendum
Obligations and Activities of Business Associate. a. The Business Associate agrees to not Use to:
(a) Not use or Disclose disclose PHI other than as permitted or required by the Service this Agreement or as Required by By Law.;
b. Business Associate shall use (b) Use appropriate safeguards safeguards, and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) PHI, to prevent Use use or Disclosure disclosure of PHI other than as provided for by this Agreement.;
c. Business Associate agrees (c) Immediately report to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of the Covered Entity any Use use or Disclosure disclosure of PHI not provided for by this Agreement of which it becomes aware, but in no case later than three (3) business days, including Breaches of Unsecured PHI as required at 45 C.F.R. §164.410, and any Security Incident of which it becomes aware.;
d. (ii) Upon discovery a Breach of Protected Health Information, Business Associate agrees shall provide immediate verbal notification of the Breach to mitigate, an appropriate representative of the Covered Entity such as the Covered Entity’s signatory to this agreement or to the extent practicableRutgers University Director of Privacy within the Office of Enterprise Risk Management, any harmful effect that is known to Ethics and Compliance. Business Associate of a Use or Disclosure of PHI by Business Associate in Violation shall also provide written notification of the requirements of this Agreement and take prompt steps Breach to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and Covered Entity no later than seventy-two five (725) hours days after discovery of any actual or suspected Breach the Breach, and the content of Unsecured PHI, all in accordance such notice shall be consistent with 45 C.F.R. CFR § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by If Business Associate to have has been Breached along with requested orally or in writing by law enforcement officials that notification of affected individuals may impede a criminal investigation, Business Associate shall so inform the Covered Entity. Notwithstanding any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOMprovision of this Agreement, Business Associate agrees to provide a written assessment reimburse the Covered Entity for any and all reasonable expenses (e.g., cost of mailing, media, credit monitoring, etc.) incurred by the Covered Entity in carrying out the obligations of the Covered Entity under the HIPAA Rules to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be notify individuals affected by a Breach unless of Business Associate or its Subcontractor. In the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one alternative and upon agreement of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2)Parties, Business Associate agrees to ensure that any subcontractors that create, receive, maintain, may directly undertake all or transmit protected health information on behalf parts of such obligations and expenses in lieu of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreementsherein provided reimbursement.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Hipaa Business Associate Agreement
Obligations and Activities of Business Associate. a. a) Business Associate agrees to shall not Use use or Disclose PHI disclose Protected Health Information other than as permitted or required by the Service Agreement this BAA or as permitted or Required by By Law.
b. Business Associate shall use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHIb) to prevent Use or Disclosure of PHI other than as provided for by this Agreement.
c. Business Associate agrees to notify DOM without unreasonable delay provide those physical, technical and no later than seventy-two (72) hours after discoveryadministrative safeguards described in the Agreement, including those safeguards and services selected by you and described in an Order. If Business Associate agrees as part of any Use or Disclosure this BAA to carry out an obligation of PHI not provided for by this Agreement yours under the Privacy Rule, then Business Associate will comply with the requirements of which it becomes aware, and any Security Incident of which it becomes awarethe Privacy Rule applicable to such obligation.
d. c) Business Associate agrees to mitigate, to the extent commercially reasonable and reasonably practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI Protected Health Information by Business Associate or its agents or subcontractors in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsBAA.
e. d) Within five Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery Days of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOMbecoming aware, Business Associate agrees to provide a written assessment report to determine whether you (i) Security Incidents (as defined in 45 C.F.R. §164.304 and as further described below), (ii) the incident is reportable within ten Breach of unsecured PHI (10as defined in 45 CFR §164.402), or (iii) working days. An impermissible Use an access, acquisition, use or Disclosure disclosure of protected health information is presumed PHI in violation of this BAA.
e) Both parties acknowledge that there are likely to be a Breach unless significant number of meaningless or unsuccessful attempts to access the DOM or Services, which make a real-time reporting requirement impractical for both parties. The parties acknowledge that Business Associate’s ability to report on system activity, as applicableincluding Security Incidents, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applieslimited by, all in accordance with 45 C.F.R. § 164.410and to, Customer’s specific Services and instances thereof, and does not include User Devices.
g. f) Business Associate undertakes no obligation to report unsuccessful security incidents or to report network security related incidents which occur on Ativion’s managed network or systems but do not directly involve Customer Data. The parties agree that the following are illustrative examples of unsuccessful security incidents which, when they do not result in the Unauthorised access, use, disclosure, modification or destruction of PHI need not be reported by Business Associate: pings against network devices, port scans, attempts to log on to a system or database with an invalid password or username, malware.
g) Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that obtain from any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incidentagent, including costs associated with mitigation of the Incident and preparation and delivery of notices a subcontractor to affected individuals and government agencies.
i. With respect to an Incidentwhom it provides Protected Health Information, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure reasonable assurances that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree it will adhere to the same restrictions, conditions, restrictions and requirements conditions that apply to Business Associate under this BAA with respect to such information. .
h) All Protected Health Information maintained by Business Associate agrees for you will be available to ensure you in a time and manner that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree reasonably allows you to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524. Business Associate shall not be obligated to provide any such information directly to any Individual or person other than you.
m. i) All Protected Health Information and other information maintained by Business Associate for you will be available to you in a time and manner that reasonably allows you to comply with the requirements under 45 CFR § 164.526.
j) Business Associate agrees to make any amendment(s) internal practices, books, and records available to PHI the Secretary, in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXXthe Secretary, for purposes of the Secretary’s determining your compliance with the Privacy Rule; provided, however, that time incurred by Business Associate in complying with any such request that exceeds its normal customer service parameters shall be charged to you at Business Associate’s then current hourly rate for additional services.
n. k) You acknowledge that Business Associate agrees is not required by this BAA to make disclosures of Protected Health Information to Individuals or any person other than you, and that Business Associate does not, therefore, expect to maintain documentation of such disclosure as described in 45 CFR § 164.528. In the event that Business Associate does make such disclosure, it shall document such Disclosures of PHI and information related to such Disclosures the disclosure as would be required for DOM you to respond to a request by an Individual for an accounting of Disclosures of PHI disclosures in accordance with 45 CFR § 164.528. Business Associate agrees to retain §164.504(e)(2)(ii)(G) and §164.528 and shall provide such documentation for at least six (6) years after to you promptly on your request. In the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to event that a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated is made directly to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy RuleAssociate, Business Associate will comply with the requirements of the Privacy Rule that apply shall, within 2 Business Days, forward such request to DOM in the performance of such obligationCustomer.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Ativion Services Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to perform the obligations and activities described in this Section.
2.1 Business Associate understands that pursuant to the HITECH Amendment, it is subject to the HIPAA Privacy and Security Rules in a similar manner as the rules apply to Covered Entity. As a result, Business Associate shall take all actions necessary to comply with the HIPAA Privacy and Security Rules for business associates as revised by the HITECH Amendment, including, but not Use limited to, the following: (a) Business Associate shall appoint a HIPAA privacy officer and a HIPAA security officer; (b) Business Associate shall establish policies and procedures to ensure compliance with the Privacy and Security Rules; (c) Business Associate shall train its workforce regarding the Privacy and Security Rules; (d) Business Associate shall enter into a privacy/security agreement with Covered Entity; (e) Business Associate shall enter into privacy/security agreements with its subcontractors that perform functions relating to Covered Entity involving PHI; and (f) Business Associate shall conduct a security risk analysis.
2.2 Business Associate shall not use or Disclose disclose PHI other than as permitted or required by the Service this Agreement or as Required required by Lawlaw.
b. 2.3 Business Associate shall use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of the PHI. Business Associate shall implement administrative, physical, and technical safeguards (including written policies and procedures) that reasonably and appropriately protect the confidentiality, integrity, and availability of PHI other than that it creates, receives, maintains, or transmits on behalf of Covered Entity as provided for required by this Agreementthe Security Rule.
c. 2.4 Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to shall mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of law or this Agreement.
2.5 Business Associate shall report to Covered Entity any known Security Incident or any known use or disclosure of PHI not permitted by this Agreement.
2.6 Effective September 23, 2009 or the requirements of date this Agreement and take prompt steps to prevent the recurrence of any Incidentis signed, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOMif later, Business Associate agrees to provide a written assessment to determine whether shall do the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining breach notification requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.HITECH Amendment:
Appears in 1 contract
Samples: Professional Services
Obligations and Activities of Business Associate. a. (1) Business Associate agrees to not Use use or Disclose disclose PHI of Covered Entity other than as permitted or required by the Service this Agreement or as Required required by Lawlaw.
b. (2) Business Associate shall agrees to use appropriate safeguards and to comply with Subpart C of 45 C.F.R. Part 164 the Security Rule with respect to electronic PHI (ePHI) EPHI to prevent Use use or Disclosure disclosure of the PHI other than as provided for by this Agreement.
c. (3) In the event that Business Associate agrees transmits EPHI on behalf of Covered Entity via electronic mail over the Internet, Business Associate agrees, to notify DOM without unreasonable delay the extent deemed reasonable and no later than seventy-two (72) hours after discoveryappropriate by Business Associate, that such EPHI shall be secured by an encryption technology that renders EPHI unusable, unreadable, or indecipherable to unauthorized individuals in accordance with the guidance of any Use or Disclosure of PHI not provided for a standards developing organization that is accredited by this Agreement of which it becomes awarethe American National Standards Institute, and any Security Incident of which it becomes awareunless otherwise required by the Secretary to meet an alternative standard.
d. (4) Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate Associate, or a Subcontractor of Business Associate, in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsAgreement.
e. (5) Business Associate agrees to report to Covered Entity:
(i) Within ten (10) days, any use or disclosure of PHI by the Business Associate not provided for by this Agreement of which it becomes aware.
(ii) Within ten (10) days, any Security Incident of which it becomes aware that results in an unauthorized access, use modification, destruction, or disclosure of EPHI or interference with information systems for EPHI.
(iii) Within ten (10) days of receipt of a written request from Covered Entity, any Security Incident of which it becomes aware that was an unsuccessful attempt to obtain unauthorized access, use modification, destruction, or disclosure of EPHI or interference with information systems for EPHI.
(iv) If Business Associate makes a Discovery of a Breach of Covered Entity’s Unsecured PHI that is created, received, maintained, transmitted, used, or disclosed by Business Associate in any manner arising out of this Agreement, Business Associate shall timely notify DOM Covered Entity as provided in Clause (6) of this Subsection (b) of Section 5 of Paragraph A of Article 29 of the Agreement.
(6) Following Discovery of a Breach of Covered Entity’s Unsecured PHI, Business Associate, without unreasonable delay, and but in no case later than seventy-two thirty (7230) hours after discovery of any actual or suspected Breach of Unsecured PHIdays, all in accordance with 45 C.F.R. § 164.410. The notification shall include, provide written notice to the extent possible and subsequently as Covered Entity setting forth the information becomes available, described in Clause (7) of this Subsection (b) of Section 5 of Paragraph A of Article 29 of the identification of all Individuals whose Unsecured PHI is reasonably believed by Agreement. In the event that Business Associate to have been Breached along with any other available information that is required to discovers what may be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, considered a “breach,” Business Associate agrees shall use business care and prudence to provide a written assessment to determine whether satisfy itself based upon reasonable diligence that the incident is reportable within ten (10) working days. An impermissible Use acquisition, access, use, or Disclosure disclosure of protected health information is presumed to be a Breach unless the DOM PHI was not unintentional or inadvertent and that Business Associate, as applicable, demonstrates Associate cannot affirmatively demonstrate that there is a low probability that the security or privacy of the PHI has been compromised or one compromised.
(i) Notwithstanding any other provision of this Agreement, Business Associate agrees, within thirty (30) days of receipt of documentation from Covered Entity, to reimburse Covered Entity for any and all reasonable expenses, (i.e., cost of mailing, media, credit monitoring, etc.), incurred by Covered Entity in carrying out the obligations of Covered Entity under the HIPAA Regulations to notify individuals affected by a Breach of Business Associate. In the alternative and upon agreement of the exceptions to parties, Business Associate may directly undertake such obligations and expenses in lieu of the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410herein provided reimbursement.
g. (7) Business Associate agrees Associate’s written notification shall provide the following information:
(i) To the extent possible, the names of each individual whose Unsecured PHI has been, or is reasonably believed to fully cooperatehave been accessed, coordinate withacquired, used, or disclosed during the Breach;
(ii) A brief description of what happened, including the date of the Breach and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with date of the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the IncidentBreach, if known;
(iii) A description of the types of unsecured PHI that were involved in the breach, (such as whether full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved);
(iv) Any steps individuals should take to protect themselves from potential harm resulting from the Breach;
(v) A brief description of what the Business Associate is doing to investigate the Breach, to mitigate harm to individuals, and perform such notifications if so required by DOM in its sole discretionto protect against any further Breaches; and,
(vi) Contact procedures for individuals to ask questions or learn additional information, which shall include a toll free telephone number, an email address, website, or postal address.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures 8) If Business Associate has taken and intends to take to halt been requested, orally or contain the Incident and mitigate the effects in writing, by law enforcement officials that notification of the Incidentaffected individuals may impede a criminal investigation, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAPBusiness Associate shall so inform Covered Entity.
j. Business Associate agrees to promptly notify DOM upon notification (9) Reporting a Security Incident or receipt a use or disclosure of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to PHI not provided for in this Agreement or PHI, or relating to shall not discharge Business Associate’s conduct or status as obligations under this Agreement to report a business associate for DOM, regardless Breach unless such reporting fully and completely satisfies all of whether DOM and/or Business Associate are named as parties to such Actionsthe Breach reporting requirements of this Agreement.
k. (10) In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and §164.308(b)(2), Business Associate agrees to ensure that any subcontractors that createif applicable, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of the Business Associate agree to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. With respect to EPHI, Business Associate will ensure that any Subcontractor of Business Associate that creates, receives, maintains, or transmits EPHI on behalf of Business Associate will agree agrees to use appropriate safeguards and comply with the applicable requirements Security Rule with respect to EPHI to prevent use or disclosure of the Security Rule and Privacy Rule PHI other than as provided for by entering into a this Agreement.
(11) When Business Associate Agreement and Business Associate shall provide DOM with maintains PHI in a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior Designated Record Set, including but not limited to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kindDesignated Record Set, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide accessaccess to and copies of PHI maintained in any Designated Record Set to Covered Entity or, at when requested in writing by Covered Entity, to an individual in order for Covered Entity to meet the request requirements of XXX45 C.F.R. §164.524., Business Associate shall provide access to and copies of PHI in a reasonable time, not to exceed fifteen (15) days, unless Business Associate and Covered Entity reasonably agree otherwise in writing, and in a reasonable manner.
(12) Business Associate agrees to make its internal practices, books, and records relating to the use and disclosure of PHI received from or created, transmitted, or received by Business Associate on behalf of Covered Entity, available to the Secretary, in the time and manner designated by XXXthe Secretary, for purposes of the Secretary determining Covered Entity’s compliance with the HIPAA Regulations. Upon receipt of a request from the Secretary, Business Associate shall notify Covered Entity in writing, unless such notification would be contrary to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524law.
m. (13) Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees Covered Entity determines is required to pursuant enable Covered Entity to comply with 45 CFR § 164.526 at the C.F.R. §164.526. Except for good cause shown in writing to Covered Entity, Business Associate shall act upon Covered Entity’s request for an amendment within fifteen (15) days of DOM or an Individual, and in the time and manner designated by XXXreceipt of Covered Entity’s request.
n. (14) Business Associate agrees to identify, track, and document such Disclosures disclosures of PHI and information related to such Disclosures disclosures as would be required for DOM Covered Entity to respond to a request by an Individual individual for an accounting of Disclosures disclosures of PHI Protected Health Information in accordance with 45 CFR § C.F.R. §164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. (15) Business Associate agrees to provide to DOM Covered Entity or to an Individualindividual, in writing and not later than thirty (30) days after receiving a time and manner designated by DOMrequest under this Clause (15), information collected in accordance with section the foregoing Clause (III)(h14) of this Subsection (b) of Section 5 of Paragraph A of Article 29 of the Agreement, to permit XXX Covered Entity to respond to a request by an Individual individual for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § C.F.R. §164.528.
p. (16) To the extent the Business Associate agrees that it shall only use is to carry out one or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes more of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations Covered Entity's obligation(s) under the Privacy Rule, Business Associate will agrees to comply with the requirements of the Privacy Rule that apply to DOM the Covered Entity in the performance of such obligationobligation(s).
r. (17) Business Associate agrees to make internal practicesshall only request, booksuse, and recordsdisclose the minimum amount of PHI necessary to reasonably accomplish the purpose of the request, including policies and proceduresuse, available or disclosure in accordance with 45 C.F.R. §164.502(b). Further, Business Associate will restrict PHI to the Secretary for purposes those employees of determining Business Associate’s and/or DOM's compliance with , or other workforce members under the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including control of Business Associate’s Subcontractors, beyond who are actively and directly participating in providing goods and/or services under the boundaries and jurisdiction Agreement of the United States without express written authorization from DOMParties and who need to know such information in order to fulfill such responsibilities.
Appears in 1 contract
Obligations and Activities of Business Associate. a. Business Associate agrees to:
A. Not use or disclose Protected Health Information (PHI to not Use or Disclose PHI hereinafter include electronic PHI) other than as permitted or required by the Service Agreement or as required by law; Except as otherwise limited in this Agreement, Business Associates may use or disclose PHI to perform functions, activities, or services for, or on behalf of BGA, provided that each use or disclosure would not violate the Privacy Rule. Business Associate must obtain reasonable assurances from any person to whom the information is disclosed that it will remain confidential and used or further disclosed only as Required by LawBy Law or for the purpose for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.
b. Business Associate shall use B. Use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of PHI other than as provided for by this the Agreement. Business Associate shall implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of that it creates, receives, maintains or transmits on behalf of BGA.
c. Business Associate agrees C. Report to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of BGA immediately any Use use or Disclosure disclosure of PHI not provided for by this the Agreement of which it becomes aware, including breaches of unsecured PHI as required at 45 CFR 164.410, and any Security Incident security incident of which it becomes aware.
d. D. Business Associate agrees shall orally notify BGA of a Breach of Unsecured PHI within 24 hours of Business Associate’s (or Business Associate’s employee, officer, or agent) discovery of such Breach, followed by a report in writing, except where a law enforcement official determines that a notification would impede a criminal investigation or cause damage to mitigatenational security. Business Associate’s written notification to BGA hereunder shall:
1. Be made to BGA within 48 hours of the initial oral report, and
2. Include the individual whose Unsecured PHI has been, or is reasonably believed to have been, the subject of a Breach.
E. In the event of an unauthorized use or disclosure of PHI or a Breach of unsecured PHI or ePHI, Business Associate shall mitigate to the extent practicable, practicable any harmful effect effects of said disclosure that is are known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.it;
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. F. In accordance with 45 C.F.R. §§ CFR 164.502(e)(1)(ii) ), 164.504(e), and 164.308(b)(2), Business Associate agrees to if applicable, ensure that any subcontractors that create, receive, maintain, or transmit protected health information PHI, on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create;
G. Within 7 days of request, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. Business Associate agrees to make any amendment(s) to available PHI in a Designated Record Set that DOM directs to BGA as necessary to satisfy BGA’s obligations under 45 CFR 164.524;
H. Make any amendment to PHI or agrees in a Designated Record Set as directed or agreed to by BGA pursuant to 45 CFR § 164.526 at the request of DOM 164.526, or an Individualtake other measures as necessary to satisfy BGA’s obligations under 45 CFR 164.526;
I. Maintain and make available, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to within 7 days after a request by an Individual for such information, the information required to provide an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees disclosures to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI BGA as necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOMsatisfy BGA’s obligations under 45 CFR 164.528;
J. To the Privacy Rule, extent the Business Associate will is to carry out one or more of BGA’s obligation(s) under Subpart E of 45 CFR Part 164, comply with the requirements of the Privacy Rule Subpart E that apply to DOM BGA in the performance of such obligation.obligation(s);
r. K. With respect to any use, disclosure or request for PHI described in 45 CFR 502(b) (1), Business Associate agrees shall limit the PHI to make the extent practicable to the limited data set as defined in 45 CFR 164.514(e)(2) or, if needed, to the minimum necessary to accomplish the intended purpose of such use, disclosure or request;
L. Make its internal practices, books, and records, including policies and procedures, records available to the Secretary BGA for purposes of determining Business Associate’s and/or DOM's compliance with the HIPAA Rules; and
M. Business Associate shall be directly responsible for full compliance with the relevant requirements of the Privacy Rule pursuant and as required by law, to 45 C.F.R. § 160.310the same extent as BGA.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. (a) Business Associate agrees to shall not Use use or Disclose disclose Covered Entity’s PHI other than as permitted or required by the Service Agreement this Addendum or as Required by By Law.
b. (b) Business Associate shall use appropriate safeguards safeguards, and comply with Subpart C of 45 C.F.R. Part 164 the Security Rule with respect to electronic PHI (ePHI) , to prevent Use use or Disclosure disclosure of Covered Entity’s PHI other than as provided for by this AgreementAddendum.
c. (c) Business Associate agrees shall comply with all laws, rules and regulations (including, without limitation, all Privacy Laws) relating to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, the use or disclosure of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes awareCovered Entity’s PHI.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72d) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. CFR §§ 164.502(e)(1)(ii164.308(b)(2) and 164.308(b)(245 CFR §164.502(e)(1)(ii), Business Associate agrees to shall ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate Downstream Subcontractors agree to the same restrictions, conditions, conditions and requirements that apply to Business Associate with respect to such informationCovered Entity’s PHI. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply Such agreements shall be documented in writing in accordance with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and HIPAA Rules.
(e) Business Associate shall provide DOM with a copy make available to Covered Entity PHI of all such executed agreements between Covered Entity maintained by Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, Set as necessary to DOM or, as directed by XXX, to an Individual in order to meet the requirements satisfy Covered Entity’s obligations under 45 CFR § §164.524. Such information and access shall be provided by Business Associate within ten (10) Business Days of receiving a request from Covered Entity. If Business Associate receives from an Individual a request for access to Covered Entity’s PHI, Business Associate shall notify Covered Entity of such request as soon as practicable, and no event more than five (5) Business Days after receiving such request.
m. (f) Business Associate agrees shall make available Covered Entity’s PHI for amendment and incorporate any amendments to make any amendment(s) to Covered Entity’s PHI in a Designated Record Set that DOM directs as directed or agrees agreed to by Covered Entity pursuant to 45 CFR § 164.526 at the §164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR §164.526. If Business Associate receives from an Individual a request to amend Covered Entity’s PHI then Business Associate shall notify Covered Entity of DOM or an Individualsuch request as soon as practicable, and in the time and manner designated by XXXno event more than five (5) Business Days after receiving such request.
n. (g) Business Associate agrees shall maintain and make available to document Covered Entity such Disclosures information required in order to provide an accounting of PHI and disclosures by or on behalf of Business Associate or any Downstream Subcontractor as necessary to satisfy Covered Entity’s obligations under 45 CFR §164.528. Such information related to such Disclosures as would shall be required for DOM to respond to provided by Business Associate within ten (10) Business Days of receiving a request by from Covered Entity. If Business Associate receives from an Individual a request for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. disclosures then Business Associate agrees to retain shall notify Covered Entity of such documentation for at least six request as soon as practicable, and in no event more than five (65) years Business Days after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of terminationreceiving such request.
o. Business Associate agrees to provide to DOM or an Individual(h) To the extent, in a time and manner designated by DOMif any, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries is to carry out DOMone or more of Covered Entity’s obligations under the Privacy Rule, Business Associate will shall comply with the requirements of the Privacy Rule HIPAA Rules that apply to DOM Covered Entity in the performance of such obligationobligations.
r. (i) Business Associate agrees to shall make Business Associate’s internal practices, books, books and records, including policies and procedures, records available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with HIPAA Rules. From time to time upon reasonable notice and during business hours, Covered Entity may inspect the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit relevant facilities, systems, books and records of Business Associate to monitor compliance with this Addendum.
(j) Business Associate shall notify Covered Entity without unreasonable delay, and in no case later than ten (10) Business Days after becoming aware of or otherwise Discovering, any of the following events (“Notification Events”): (i) any Security Incident relating to Covered Entity’s PHI, (ii) any use or disclosure of Covered Entity’s PHI that is not provided for by this Addendum or Required By Law, (iii) any Security Breach relating to Unsecured PHI of Covered Entity, or (iv) any access, store, share, maintain, transmit or use or disclose disclosure of Covered Entity’s PHI in any form via any medium with any third partyviolation of this Addendum or the Privacy Rule. Such notification shall include, including at a minimum, the following, to the extent possible:
1. The date and time of each Notification Event;
2. The date each Notification Event was Discovered;
3. Identification of the PHI accessed, used or disclosed;
4. Identification of each Individual whose Unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used or disclosed
5. Description of the Notification Event;
6. Description of the mitigation steps taken to contain the Notification Event and an assessment of the level of compromise to PHI;
7. Description of the plan to correct the compromises and to prevent reoccurrences of the Notification Event in the future;
8. Such information as required in order to satisfy breach reporting obligations of Covered Entity or Business Associate; and
9. Such other information as Covered Entity may reasonably request. Business Associate shall cooperate with Covered Entity to investigate the applicable Notification Event, mitigate or take corrective action to cure any Notification Events, and inform affected Individuals in compliance with applicable law, including, without limitation, Privacy Laws.
(k) If Business Associate receives a subpoena, court or administrative order or other discovery request or mandate for release of Covered Entity’s SubcontractorsPHI, beyond the boundaries and jurisdiction Business Associate shall immediately notify Covered Entity, in writing, of the United States without express written authorization from DOMrequest, so that Covered Entity may seek a protective order or other appropriate remedy, and Business Associate shall cooperate fully with Covered Entity should Covered Entity seek such protective order or other remedy. Business Associate shall, to the extent possible, consult with Covered Entity prior to responding and shall advise Covered Entity of how it intends to respond as soon as such determination is made.
Appears in 1 contract
Samples: Business Associate Addendum
Obligations and Activities of Business Associate. a. (a) Business Associate agrees to not Use use or Disclose PHI disclose Protected Health Information other than than
(i) for purposes of performing its obligations under the Services Agreement,
(ii) as otherwise permitted or required by the Service Agreement or this BA Agreement, or
(iii) as Required by By Law.
b. (b) Business Associate shall agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of PHI the Protected Health Information other than as provided for by this BA Agreement.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72c) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI Protected Health Information by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsBA Agreement.
e. (d) Business Associate agrees to notify DOM without unreasonable delayreport to Covered Entity any use or disclosure of Protected Health Information not provided for by this BA Agreement of which it becomes aware, and no later than seventy-two (72) hours after discovery of any actual or suspected including a Breach of Unsecured PHIProtected Health Information or a Security Incident.
(e) Business Associate agrees to report to Covered Entity any Security Incident without unreasonable delay , all and in accordance with 45 C.F.R. § 164.410no event later than ten (10) calendar days , after becoming aware that such Security Incident affects Covered Entity’s information, except that, for purposes of this Security Incident reporting requirement, the term “Security Incident” shall not include inconsequential incidents that occur on a daily basis, such as scans, “pings” or other unsuccessful attempts to penetrate computer networks or servers containing electronic PHI maintained by Business Associate.
(f) Business Associate agrees to report to Covered Entity any Breach of Unsecured Protected Health Information without unreasonable delay and in no case later than thirty (30) calendar days after becoming aware that such Breach affects Covered Entity’s Protected Health Information. The notification Such notice shall include, to the extent possible and subsequently as the information becomes available, include the identification of all Individuals each Individual whose Unsecured PHI Protected Health Information has been, or is reasonably believed by Business Associate Associate, to have been Breached along been, accessed, acquired, or disclosed in connection with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOMsuch Breach. In addition, Business Associate agrees to shall provide a written assessment to determine whether any information reasonably requested by Covered Entity for purposes of making the incident is reportable within ten (10notifications required by 45 CFR 164.404(c) working days. An impermissible Use or Disclosure of protected health as soon as such information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating available to Business Associate. Business Associate’s conduct or status as notification of a business associate for DOMBreach under this section shall comply in all respects with each applicable provision of 45 CFR Part 164, regardless of whether DOM and/or Business Associate are named as parties Subpart D and related guidance issued by the Secretary from time to such Actions.
k. time. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2)addition, if delegated in writing by Covered Entity, Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree shall provide such notices to the same restrictions, conditions, media and requirements that apply to Business Associate with respect to such informationIndividuals affected by the Breach as required by 45 CFR 164.404 and 45 CFR 164.406. Business Associate agrees shall provide Covered Entity with advance copies of such notices prior to ensure that distribution. In all cases, Covered Entity shall be responsible for submitting reports of Breaches directly to the Secretary.
(g) Business Associate shall require any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) Protected Health Information on behalf of Business Associate will to agree in writing to comply restrictions and conditions that are no less protective than those that apply through this BA Agreement to BusinessAssociate with the applicable requirements of the Security Rule respect to such information, in accordance with 45 CFR 164.502(e)(1)(ii) and Privacy Rule by entering into a Business Associate Agreement and 164.308(b)(2), if applicable.
(h) Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior access directly to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide accessIndividual, at the request of XXX, Covered Entity or an Individual and in a prompt and reasonable manner, including in the time and manner designated electronic form or format requested by XXXthe Individual, to PHI Protected Health Information in a Designated Record Set, subject to DOM or, as directed by XXX, to an Individual in order to meet and consistent with the requirements under timing and other provisions of 45 CFR § 164.524.
m. (i) Business Associate agrees to make any amendment(s) to PHI Protected Health Information in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM Covered Entity or an Individual, subject to and in consistent with the time timing and manner designated by XXXother provisions of 45 CFR 164.526.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6j) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make (i) internal practices, books, and records, including policies and procedures, relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity, and (ii) policies,procedures, and documentation relating to the safeguarding of Electronic Protected Health Information available to the Secretary Secretary, in a time and manner designated by the Secretary, for purposes of the Secretary determining Covered Entity’s or Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310and Security Rules.
s. (k) Business Associate agrees to document disclosures of Protected Health Information and information related to such disclosures as would berequired for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information, subject to and consistent with 45 CFR 164.528.
(l) Business Associate agrees to provide to an Individual, at the request of Covered Entity or an Individual, an accounting of disclosures of ProtectedHealth Information subject to and consistent with the timing and other provisions of 45 CFR 164.528.
(m) With respect to Electronic Protected Health Information, Business Associate shall implement and comply with the administrative safeguards set forth at 45 CFR 164.308, the physical safeguards set forth at 00 XXX 000, the technical safeguards set forth at 45 CFR 164.312, and the policies and procedures set forth at 45 CFR 164.316 to reasonably and appropriately protect the confidentiality, integrity, and availability of the Electronic Protected Health Information that nothing it creates, receives, maintains, or transmits on behalf of Covered Entity. Business Associate acknowledges that (i) the foregoing safeguards, policies and procedures requirements shall apply to Business Associate in the same manner that such requirements apply to Covered Entity, and (ii) Business Associate shall be subject to HIPAA enforcement provisions, as amended from time to time, for failure to comply with the Security Rule safeguards, policies and procedures requirements and any guidance issued by the Secretary from time to time with respect to such requirements.
(n) If Business Associate conducts any Standard Transactions on behalf of Covered Entity, Business Associate shall comply with, and require any Subcontractor to comply with, the applicable requirements of 45 CFR Parts 160-162.
(o) Business Associate acknowledges that it shall be subject to the HIPAA enforcement provisions, as amended from time to time, for
(i) impermissible uses and disclosures,
(ii) failure to provide breach notification to Covered Entity,
(iii) failure to provide access to a copy of Electronic Protected Health Information to either Covered Entity or the Individual, or the Individual's designee, (iv) failure to disclose Protected Health Information where required by the Secretary to investigate or determine Covered Entity’s compliance with HIPAA, and
(v) failure to provide the accounting of disclosures required in this BA Agreement.
(p) To the extent under the Services Agreement shall permit or this BA Agreement Business Associate is to accesscarry out one or more of Covered Entity’s obligation(s) under Subpart E of 45 CFR Part 164, store, share, maintain, transmit or use or disclose PHI Business Associate shall comply with the requirements of Subpart E that apply to Covered Entity in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction performance of the United States without express written authorization from DOMsuch obligation(s).
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. (a) Business Associate agrees to not Use use or Disclose further disclose PHI other than as permitted or required by the Service this Agreement or as Required by Law.
b. . Business Associate shall also comply with any further limitations on uses and disclosures of PHI by Covered Entity in accordance with 45 C.F.R. § 164.522, provided that Covered Entity communicates such limitations to Business Associate.
(b) Business Associate agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of PHI other than as provided for by this Agreement.
c. (c) Business Associate shall use appropriate safeguards and comply with 45 C.F.R. Part 164, Subpart C with respect to ePHI that it creates, receives, maintains or transmits on behalf of Covered Entity.
(d) Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of report to Covered Entity any Use use or Disclosure disclosure of PHI not provided for by this Agreement of which it Business Associate becomes aware. Additionally, and Business Associate shall report immediately to Covered Entity any Security Incident of which it Business Associate becomes aware. At the request of Covered Entity, Business Associate shall identify the date, nature, and scope of the Security Incident, Business Associate’s response to the Security Incident, and the identification of the party responsible for causing the Security Incident, if known. Notwithstanding the foregoing, the parties acknowledge and agree that this Section 3(d) constitutes notice by Business Associate to Covered Entity of the ongoing existence and occurrence or attempts of Unsuccessful Security Incidents for which no additional notice to Covered Entity shall be required. Unsuccessful Security Incidents means, without limitation, pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denial of service attacks, and any combination of the above, so long as no such incident results in unauthorized access, use or disclosure of Covered Entity’s electronic PHI.
d. (e) Business Associate shall notify Covered Entity upon discovery of any Breach of Unsecured Protected Health Information. Without undue delay and within thirty (30) days of the date Business Associate discovers the Breach, Business Associate shall provide such information to Covered Entity as required by the Breach Notification Standards.
(f) Business Associate shall obtain and maintain an agreement with each agent or subcontractor that creates, receives, maintains, or transmits Covered Entity’s PHI on behalf of Business Associate. Under the agreement, such agent or subcontractor shall agree to the same restrictions and conditions that apply to Business Associate pursuant to this Agreement with respect to such PHI.
(g) Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent or the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsHIPAA Standards.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72h) hours after discovery Upon request of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOMCovered Entity, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, access to PHI in a Designated Record Set, to DOM or, as directed by XXXdefined in 45 C.F.R. § 164.501, to an Individual in order for Covered Entity to meet comply with the requirements under 45 CFR C.F.R. § 164.524.
m. . Further, if the PHI that is the subject of a request for access is maintained in one or more Designated Record Sets electronically and if the Individual requests an electronic copy of such information, Business Associate shall provide access to the PHI in the electronic form and format requested, if it is readily producible in such form and format; or, if not, in a readable electronic form and format as agreed to by Covered Entity and the Individual. Business Associate further agrees to make available PHI for amendment and incorporate any amendment(s) amendments to PHI in a Designated Record Set that DOM directs in order for Covered Entity to comply with 45 C.F.R. § 164.526. If Business Associate provides copies or agrees summaries of PHI to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, it may impose a reasonable, cost-based fee in accordance with 45 C.F.R. § 164.524(c)(4), provided that the fee includes only the cost of labor for copying the PHI requested by the Individual, whether in paper or electronic form, and in supplies for creating the time and manner designated by XXXpaper copy or electronic media if the Individual requests that the electronic copy be provided on portable media.
n. (i) Business Associate agrees to make its internal practices, books, and records, including policies and procedures relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of, Covered Entity, available to the Secretary of the U.S. Department of Health and Human Services determining Covered Entity's compliance with the Privacy Standards.
(j) Business Associate agrees to document such Disclosures and make available information required to respond to provide an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528 and the HITECH Act. Business Associate further agrees to provide Covered Entity such information related upon request to such Disclosures as would be required for DOM permit Covered Entity to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI PHI, in accordance with 45 CFR C.F.R. § 164.528. 164.528 and the HITECH Act.
(k) Business Associate acknowledges that it will make reasonable efforts to limit the use or disclosure of PHI to perform or fulfill a function required or permitted under this Agreement to the minimum necessary to accomplish the intended purpose of such use or disclosure, as specified by the HIPAA Standards and any relevant guidance issued by the U.S. Department of Health and Human Services.
(l) In the event that Business Associate agrees to retain such documentation for at least six (6) years after the date carry out an obligation of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an IndividualCovered Entity under 45 C.F.R. Part 164, in a time and manner designated by DOMSubpart E, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule 45 C.F.R. Part 164, Subpart E that apply to DOM Covered Entity in the performance of such obligationobligations.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. A. General Rule of PHI Use and Disclosure. The Business Associate agrees to not Use or Disclose PHI other than as permitted or required by the Service Agreement or as Required by Law.
b. Business Associate shall use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use or Disclosure of PHI other than as provided for by this Agreement.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only may use or disclose PHI it creates for, receives from or on behalf of, the minimum PHI necessary Department to perform functions, activities, activities or services for, or on behalf of, DOM the Department in accordance with the specifications set forth in this BAA, provided that such use or disclosure would not violate the HIPAA Standards if done by the Department; or as specified Required By Law.
1. Any disclosures made by the Business Associate of PHI must be made in accordance with HIPAA Standards and other applicable laws.
2. Notwithstanding any other provision herein to the contrary, the Business Associate shall limit uses and disclosures of PHI to the "minimum necessary," as set forth in the Service AgreementsHIPAA Standards.
3. The Business Associate agrees to comply with any guidance issued by use or disclose only a "limited data set" of PHI as defined in the Secretary on what constitutes “minimum necessary” for purposes of HIPAA Standards while conducting the Privacy Ruleauthorized activities herein and, and any minimum necessary policies and procedures communicated except where a "limited data set" is not practicable in order to Business Associate by DOMaccomplish those activities.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule4. Except as otherwise limited by this BAA, Business Associate will comply with may use PHI for the requirements proper management and administration of the Privacy Rule that apply Business Associate or to DOM in carry out the performance legal responsibilities of such obligationthe Business Associate.
r. 5. Except as otherwise limited by this BAA, Business Associate agrees may disclose PHI for the proper management and administration of the Business Associate provided that the disclosures are Required By Law, or Business Associate obtains reasonable assurances from the person to make internal practices, bookswhom the information is disclosed that it will remain confidential and used or further disclosed only as Required By Law or for the purpose for which it was disclosed to the person, and recordsthe person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.
6. Business Associate may use PHI to report violations of law to appropriate federal and state authorities, including policies and procedures, available consistent with 45 CFR § 164.5020).
7. Business Associate may use PHI to provide Data Aggregation services to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with Department as permitted by the Privacy Rule pursuant to 45 C.F.R. § 160.310HIPAA Standards.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Request for Proposals
Obligations and Activities of Business Associate. a. Business Associate (PRIVACY RULE) Operation on Behalf of FHKC The BA shall use and disclose Protected Health Information (“PHI”) only as shall be permitted by the Contract and this Agreement. BA shall have the same duty to protect FHKC’s PHI as such term is defined in the Contract, and in furtherance of the duties therein. BA agrees to fully comply with the requirements under the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”) applicable to "business associates," as that term is defined in the Privacy Rule, and not Use use or Disclose further disclose PHI other than as permitted or required by the Service Contract, this Agreement or as Required required by Law.
b. Business Associate law. BA shall create and/or adopt policies and procedures to periodically audit BA’s adherence to all HIPAA regulations. BA acknowledges and promises to perform such audits pursuant to the terms and conditions set out herein. BA shall make such audit policies and procedures available to FHKC for review. BA agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of PHI other than as provided for by the Contract, any Ancillary Agreement(s), this Agreement.
c. Business Associate , or as required by law. BA agrees to notify DOM inform FHKC without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate BA of a Use use or Disclosure disclosure of PHI by Business Associate in Violation BA, or by a subcontractor or agent of BA, resulting from a violation of the requirements of this Agreement. BA will report to FHKC any use or disclosure of FHKC’s Protected Health Information not permitted by this Agreement or in writing by FHKC. In addition, BA will report, following discovery and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and but in no event later than seventy-two seven (727) hours after discovery business days following discovery, any "Breach" of "Unsecured Protected Health Information" as these terms are defined by the HITECH Act and any actual or suspected implementing regulations. BA shall cooperate with FHKC in investigating the Breach and in meeting FHKC’s obligations under the HITECH Act and any other security breach notification laws. In the event of Unsecured PHIa breach, all in accordance BA and FHKC will work together to comply with 45 C.F.R. § 164.410any required regulatory filings. The notification Any such report shall include, to the extent possible and subsequently as the information becomes available, include the identification (if known) of all Individuals each individual whose Unsecured unsecured PHI has been, or is reasonably believed by Business Associate BA to have been Breached along with any other available information that is required been, accessed, acquired, or disclosed during such Breach. BA will make the report to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case FHKC’s Privacy Officer not more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen seven (157) business days after discovery BA learns of an Incident a written corrective action plan (“CAP”) describing, such non-permitted use or disclosure. Any items not known at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects time of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees initial report will be subsequently reported to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status FHKC as a business associate for DOM, regardless of whether DOM and/or Business Associate answers are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such informationdetermined. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate All elements will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar be reported no later than 30 days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activitiesinitial report, or services foras soon as feasible, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOMwhichever is sooner.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Standard Services Contract
Obligations and Activities of Business Associate. a. (a) Business Associate agrees to not Use use or Disclose further disclose PHI other than as permitted or required by the Service this Agreement or as Required required by Lawlaw.
b. (b) Business Associate agrees to comply with the HIPAA Rules, the Part 2 Rule, and state privacy and security laws, to the extent applicable to Business Associate.
(c) Business Associate shall use implement and maintain reasonable and appropriate administrative, technical and physical safeguards to prevent the use or disclosure of the PHI other than as permitted by this Agreement and to comply with the HIPAA Security Rule (Subpart C of 45 C.F.R. CFR Part 164 with respect to electronic PHI (ePHI) to prevent Use or Disclosure of PHI other than as provided for by this Agreement164).
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72d) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect effects that is are known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate or any of its Subcontractors in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsAgreement.
e. (e) Business Associate agrees to notify DOM without unreasonable delayreport to Covered Entity any use or disclosure of PHI not permitted by this Agreement of which it becomes aware, and no later than seventy-two (72) hours after discovery of any actual or suspected including a Breach of Unsecured PHIPHI as required by 45 CFR 164.410, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working daysbusiness days from the date that Business Associate discovers such impermissible use or disclosure. An Business Associate shall presume that any impermissible Use use or Disclosure disclosure of protected health information PHI is presumed a potential Breach and shall not delay in reporting the occurrence thereof to be Covered Entity to determine whether a Breach unless the DOM or Business Associatehas occurred. Covered Entity shall be responsible for making any and all final risk assessment determinations with respect to potential Breaches of Unsecured PHI, as applicable, demonstrates including determining whether there is a “low probability probability” that any potential Breach compromised the PHI has been compromised security or one privacy of the exceptions to the definition of Breach appliesUnsecured PHI.
(f) Business Associate agrees, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, CFR 164.502(e)(1)(ii) and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident 45 CFR 164.308(b)(2) to ensure that any notices sent in connection individual or entity that subcontracts with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintainmaintain or transmit PHI received from, or transmit protected health information created or received by Business Associate on behalf of the Business Associate agree Company agrees to the same restrictions, conditions, restrictions and requirements conditions that apply through the HIPAA Rules and this Agreement to Business Associate with respect to such information. .
(g) To the extent that Business Associate maintains a designated record set on behalf of Covered Entity, Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to promptly provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM orCovered Entity, as directed by XXX, necessary to an Individual in order allow Covered Entity to meet the requirements under 45 CFR § 164.524.
m. (h) To the extent that Business Associate maintains a designated record set on behalf of Covered Entity, Business Associate agrees to promptly make any amendment(s) to PHI in a Designated Record Set that DOM the Covered Entity directs or as necessary for compliance with 45 CFR 164.526.
(i) Business Associate agrees to pursuant make internal practices, books, and records relating to 45 CFR § 164.526 the use and disclosure of PHI received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or at the request of DOM or an Individualthe Covered Entity to the Secretary of the U.S. Department of Health and Human Services (the “Secretary”), and in within a reasonable time of such request for purposes of the time and manner designated by XXXSecretary determining Covered Entity's compliance with the HIPAA Rules.
n. (j) If Business Associate agrees is required to document make a disclosure of information because of a legal requirement, it will track such Disclosures of PHI a disclosure and will promptly provide information related to such Disclosures as Covered Entity that would be required necessary for DOM Covered Entity to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. (k) Business Associate agrees that it shall only will use or disclose only the minimum minimal amount of PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in accomplish the Service Agreements. intended purpose.
(l) Business Associate agrees to comply with alert Covered Entity of any guidance issued by Security Incident of which it becomes aware.
(m) To the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to extent Business Associate by DOM.
q. Business Associate agrees that is to the extent that Business Associate carries carry out DOMone of Covered Entity’s obligations under the Privacy Rule, Business Associate will agrees to comply with the requirements of the Privacy Rule HIPAA Rules that apply to DOM Covered Entity in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Saas License Agreement
Obligations and Activities of Business Associate. a. (a) Business Associate agrees to will not Use use or Disclose PHI disclose Protected Health Information other than as permitted or required by the Service Agreement this BAA or as Required by By Law.
b. (b) Business Associate shall agrees to use appropriate physical, technical, and administrative safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of PHI Protected Health Information other than as provided for by this AgreementBAA or Required By Law. These safeguards shall include, but not be limited to, policies and procedures for reasonably and appropriately protecting the confidentiality, integrity and availability of Electronic Protected Health Information. With respect to such information, Business Associate shall meet the requirements of the Security Rule that apply to business associates.
c. (c) To the extent practicable, Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, mitigate any harmful effect that is known to Business Associate of a Use its use or Disclosure disclosure of PHI by Business Associate Protected Health Information in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsBAA.
e. (d) Business Associate agrees to notify DOM without unreasonable delay, report promptly and no later than seventy-two (72) hours after discovery in writing to Covered Entity any use or disclosure of Protected Health Information not provided for by this BAA or Required by Law and any actual or suspected Breach security incidents within the meaning of Unsecured PHI, all in accordance with 45 C.F.R. CFR § 164.410164.304 of which it becomes aware. The notification Such reports shall include, be made promptly as they occur provided that unsuccessful attempts to access Business Associate’s information systems shall be reported only to the extent possible and subsequently at such times as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Parties mutually agree in writing. Business Associate to have been Breached along with any other available information that is required to be included shall report Xxxxxxxx as described elsewhere in the notification BAA.
(e) To the extent that Business Associate is to carry out Covered Entity’s obligations under the IndividualPrivacy Rule, HHS, and/or the media, all Business Associate shall perform such responsibilities in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410of the Privacy Rule.
f. Once an actual or suspected Breach is reported to DOM, (f) Business Associate agrees to provide a ensure, through written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associateagreement, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate that any Subcontractor agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to substantially the same restrictions, conditions, restrictions and requirements conditions that apply through this BAA to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, may disclose all or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements some of the Security Rule terms of this BAA to any of its Subcontractors to secure its compliance with such restrictions and Privacy Rule conditions.
(g) At Covered Entity’s reasonable and timely request, pursuant to a request by entering into a Business Associate Agreement and an Individual, Business Associate shall provide DOM Covered Entity with a copy of all such executed agreements between Protected Health Information that Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI maintains in a Designated Record Set, Set in a time and manner that reasonably allow Covered Entity to DOM or, as directed by XXX, to an Individual in order to meet comply with the requirements under 45 CFR § 164.524.
m. (h) At Covered Entity’s reasonable and timely request, pursuant to a request by an Individual, Business Associate shall make Protected Health Information that it maintains in a Designated Record Set available to Covered Entity for amendment in a time and manner that reasonably allow Covered Entity to comply with the requirements under 45 CFR § 164.526, and, upon written notice from Covered Entity, Business Associate shall hold such amendments as Covered Entity incorporates into such information in accordance with the requirements of 45 CFR § 164.526.
(i) Business Associate agrees to make any amendment(s) internal practices, books, and records relating to PHI the use and disclosure of Protected Health Information available to the Secretary in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXXthe Secretary, for purposes of the Secretary’s determining Covered Entity’s or Business Associate’s compliance with the Privacy Rule.
n. (j) Business Associate agrees to document such Disclosures disclosures of PHI Protected Health Information and information related to such Disclosures disclosures as would be required for DOM Covered Entity to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI Protected Health Information in accordance with the requirements under 45 CFR § 164.528. Upon Covered Entity’s reasonable and timely request, Business Associate shall provide Covered Entity with such accounting in a time and manner that reasonably allow Covered Entity to comply with the requirements under 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure shall provide Covered Entity with access reports or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, other information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with about disclosures under 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that 164.528 to the extent that Business Associate carries out DOM’s obligations under and only to the Privacy Rule, Business Associate will comply with the requirements extent such section of the Privacy Rule requires.
(k) To the extent required under HIPAA, Business Associate shall: (i) restrict its use and disclosure of an individual’s Protected Health Information relating to a healthcare item or service where the individual or another person acting on the individual’s behalf pays the entire cost of the item or service out of his or her own pocket; (ii) make a reasonable effort to use and disclose only the minimum amount of Protected Health Information necessary to achieve a particular purpose; and (iii) provide Protected Health Information that apply to DOM it maintains electronically in the performance of form requested by Covered Entity pursuant to a request for such obligationinformation in such form by an Individual or, if not readily producible in such form, in another electronic form agreeable to the Individual and Business Associate, or if such agreement cannot be reached, as a readable hard copy.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing (l) Notwithstanding anything in this Agreement shall permit to the contrary, Business Associate to accessshall not receive, storedirectly or indirectly, shareany remuneration in exchange for Protected Health Information unless permitted under HIPAA and HITECH.
(m) Upon the discovery of a Breach of Unsecured Protected Health Information, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction Associate shall notify Covered Entity of the United States without express written authorization from DOMBreach in accordance with the requirements under 45 CFR § 164.410.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use or Disclose PHI other than as permitted or acknowledges that Business Associate is required by the Service Agreement or as Required by Law.
b. Business Associate shall use appropriate safeguards and law to comply with Subpart C sections 164.308, 164.310, 164.312 and 164.316 of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use or Disclosure of PHI other than as provided for by this Agreement.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes awarethe HIPAA Security Rule, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining additional security requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt Health Information Technology for Economic and Clinical Health ("HITECH") Act, Title XIII of any administrative, civil, or criminal claims, demands, causes the American Recovery and Reinvestment Act of action, lawsuits, or governmental enforcement actions 2009 (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2ARRA), Business Associate agrees that are applicable to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such informationCovered Entities. Business Associate agrees to ensure further acknowledges that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree is required by law to comply with the applicable use and disclosure requirements of section 162.504(e) of the HIPAA Privacy Rule and all other privacy requirements of Subtitle D of the HITECH Act that are applicable to Covered Entities. HIPAA compliance requirements include, but are not limited to: Subcontractors: Business Associate represents to Covered Entity that [i] any disclosure it makes will be permitted or required under applicable laws, and [ii] that Business Associate will obtain reasonable written assurances from any person or entity to whom Business Associate discloses the PHI that the PHI will be held confidentially and used or further disclosed only as required and permitted under the HIPAA Security Rule and Privacy Rule and other applicable laws, and [iii] any such person or entity agrees to be governed by entering into a the same restrictions and conditions contained in this Agreement, and will notify Business Associate Agreement and of any breaches of confidentiality of the PHI. Permissible Disclosures: Except as otherwise limited in this Agreement, Business Associate shall provide DOM with a copy of all such executed agreements between may disclose PHI to other Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including Associates of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, Covered Entity [i] as directed by XXXthe plan sponsor, or [ii] to an Individual in order perform its duties under the Service Agreement. Notwithstanding any provision hereof, or any other prior agreement by the Parties, it shall be the Covered Entity’s sole responsibility (and not the responsibility of Business Associate) to meet ensure that the requirements under 45 CFR § 164.524.
m. Covered Entity has entered into the appropriate Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance agreements with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining its Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310’s.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. Business Associate 5.1 BUSINESS ASSOCIATE agrees not to not Use use or Disclose disclose PHI and/or EPHI provided by, made available by, or created or received on behalf of AACOG other than as permitted by this AGREEMENT or required by the Service Agreement or as Required by Lawlaw.
b. Business Associate shall use 5.2 BUSINESS ASSOCIATE agrees to establish and maintain appropriate administrative, physical, and technical safeguards and comply (consistent with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHIthe Implementing Regulations) to prevent Use or Disclosure protect the confidentiality, integrity, and availability of PHI other than as provided for by this Agreementand/or EPHI stored at BUSINESS ASSOCIATE's facility. In providing these safeguards, BUSINESS ASSOCIATE shall pay particular attention to the requirements addressed in the Privacy Rule and the Security Rule.
c. Business Associate 5.3 BUSINESS ASSOCIATE agrees to notify DOM without unreasonable delay establish and no later than seventy-two (72) hours after discoverymaintain policies and procedures for mitigation, to the extent practicable, of any Use harmful effect of a use or Disclosure disclosure of PHI and/or EPHI by BUSINESS ASSOCIATE and its agents in violation of the requirements of this AGREEMENT or the HIPAA Implementing Regulations.
5.4 BUSINESS ASSOCIATE agrees to promptly, but in no case more than one (1) business day, report to AACOG:
a. Any use, disclosure, or breach of PHI and/or EPHI of which it becomes aware that is not provided for by this Agreement of which it becomes aware, and any Security Incident AGREEMENT.
b. Any security incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate 5.5 BUSINESS ASSOCIATE also agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, detailed notification required by 45 CFR 164.410 as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, quickly as practicable and in no case more later than 60 sixty (60) days after discovery of the Incidenta breach, and perform such notifications if so required by DOM as described in its sole discretion45 CFR 164.
h. Business Associate 5.6 BUSINESS ASSOCIATE agrees that it shall not allow storage of AACOG's PHI and/or EPHI with an agent without the advance, express, written permission of AACOG. BUSINESS ASSOCIATE further agrees that, prior to be solely responsible for all costs and expenses incurred as storing AACOG PHI and/or EPHI with another agent, BUSINESS ASSOCIATE will, through a result of an Incidentsubcontract or other appropriate agreement, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree agent agrees to the same restrictionsrestrictions and conditions that apply through this AGREEMENT to BUSINESS ASSOCIATE with respect to AACOG's PHI and/or EPHI. That subcontract or other agreement shall:
a. Be executed prior to allowing use or disclosure to or by the agent.
b. Contain the same terms, conditions, and requirements that apply restrictions on use, disclosure, and safeguard of PHI and/or EPHI as are contained in this AGREEMENT.
c. Be approved as to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that createform, receiveconditions, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule restrictions by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days AACOG prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreementsexecution.
l. Business Associate agrees to provide access5.7 BUSINESS ASSOCIATE agrees, at the request of XXX, AACOG and in the time and manner designated by XXXwith reasonable notice during BUSINESS ASSOCIATE's established business hours, to provide access to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524and/or EPHI.
m. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate 5.8 BUSINESS ASSOCIATE agrees to make internal practices, books, and records, (including policies and procedures, ) relating to safeguard of PHI and/or EPHI received from AACOG available to AACOG or the Secretary Department of Health and Human Services (DHHS) for the purposes of determining Business Associate’s and/or DOM's BUSINESS ASSOCIATE'S compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310and/or Security Rule. AACOG will make these requests during BUSINESS ASSOCIATE'S regular business hours or as directed by DHHS.
s. Business Associate 5.9 BUSINESS ASSOCIATE agrees to return, or properly destroy, all PHI and/or EPHI received from AACOG once BUSINESS ASSOCIATE finishes providing services under this agreement or a succeeding agreement.
a. If BUSINESS ASSOCIATE destroys information, it must certify that nothing destruction to AACOG in this Agreement accordance with procedures and instructions which AACOG shall permit Business Associate provide. Destruction and documentation shall, in all cases, be consistent with the guidelines provided in the Implementing Regulations.
b. BUSINESS ASSOCIATE may not unilaterally elect to accessdestroy information that it must retain under Federal or State law or regulation.
c. BUSINESS ASSOCIATE must maintain required safeguards for all PHI and EPHI received from AACOG for as long as BUSINESS ASSOCIATE has such information.
5.10 BUSINESS ASSOCIATE will develop and implement a procedure for sanctions to address violations, storeby employees or agents, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOMPrivacy Rule, the Security Rule, or any other portion of the Implementing Regulations that deal with safeguard of PHI and EPHI.
Appears in 1 contract
Samples: Vendor Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use or Disclose comply with those provisions of the Security Rule that are set forth at 45 C.F.R. §§ 164.308, 164.310, 164.312, and 164.316, as amended from time to time, with respect the security of PHI, in the same manner that such regulations apply to the Provider. Any additional requirements of the HITECH Act that relate to security of PHI other than as permitted or required and that are made applicable with respect to covered entities shall also be applicable to Business Associate and shall be and by the Service Agreement or as Required by Lawthis reference hereby are incorporated into this Business Associate Agreement.
b. Business Associate shall use appropriate safeguards and agrees to comply with Subpart C of the Privacy Rule at 45 C.F.R. Part 164 § 164.504(e), as amended from time to time, with respect to electronic its use and disclosure of PHI, in the same manner that such regulation applies to Provider. The additional requirements of the HITECH Act that relate to privacy and that are made applicable with respect to covered entities shall also be applicable to Business Associate and shall be and by this reference hereby are incorporated into the Business Associate Agreement.
c. Business Associate agrees to not use or further disclose PHI other than as specifically permitted or required by this Agreement or as required by law.
d. Business Associate agrees to use appropriate Administrative, Technical, and Physical Safeguards to (ePHI1) to prevent Use use or Disclosure disclosure of PHI other than as provided for by this Agreement; and (2) reasonably and appropriately protect the Confidentiality, Integrity and Availability of Electronic PHI.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. e. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsAgreement.
e. f. Business Associate agrees to notify DOM without unreasonable delayreport to Provider if it becomes aware of any (1) use or disclosure of PHI not provided for by this Agreement; (2) unauthorized access of Electronic PHI; (3) unauthorized destruction or modification of Electronic PHI; or (4) Security Incidents which have an impact on Provider’s PHI. Notwithstanding anything herein to the contrary, the parties acknowledge and agree that this Agreement shall constitute notice to Provider that Business Associate may periodically experience broadcast attacks on its firewall, port scans, unsuccessful log-on attempts, denials of service and similar unsuccessful security incidents, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate need not further report such incidents to have been Breached along with any other available information that is required to be included Provider so long as such incidents do not result in the notification to the Individualunauthorized access, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual use or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.PHI..
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that createagent, receiveincluding a sub-contractor, maintain, to whom it provides PHI created or transmit protected health information received by Business Associate on behalf of the Business Associate agree Provider, agrees to substantially the same restrictions, conditions, restrictions and requirements conditions that apply through this Agreement to Business Associate with respect to such information. Business Associate agrees , including, without limitation, implementation of appropriate safeguards to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf protect the security of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreementsElectronic PHI.
l. h. Upon the written request of Provider, Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, access to Provider to PHI that Business Associate maintains in a Designated Record SetSet (if in fact its arrangements with Provider require Business Associate to maintain Designated Record Sets on behalf of Provider), to DOM or, as directed by XXX, to an Individual in order for Provider to meet the Patient access and copying requirements under 45 CFR § 164.524. If Business Associate maintains an electronic health record which contains the PHI, Business Associate shall provide such information produced in accordance with this section 2(h) in electronic format to enable Provider to fulfill its obligations under applicable regulations.
m. i. Upon the written request of Provider, Business Associate agrees to make any amendment(s) to PHI that Business Associate maintains in a Designated Record Set (if in fact its arrangements with Provider require Business Associates to maintain Designated Record Sets on behalf of Provider), that DOM the Provider directs or agrees to pursuant to 45 CFR § 164.526 164.526.
j. Business Associate agrees to make its internal practices, books and records relating to the use and disclosure of PHI available at the request of DOM the Provider to the Secretary, for purposes of determining Provider’s compliance with the Privacy Rule, subject to attorney-client or an Individual, and in the time and manner designated by XXXother applicable legal privileges.
n. k. Business Associate agrees to document such Disclosures disclosures of PHI and information related to such Disclosures disclosures as would be required for DOM Provider to respond to a request by an Individual Patient for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees , as may be amended from time to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of terminationtime.
o. l. Upon written request of Provider, Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, Provider with information collected in accordance with section (III)(h) Section II.i. of this Agreement, Agreement to permit XXX Provider to respond to a request by an Individual Patient for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. m. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rulenotify Provider without unreasonable delay, and any minimum necessary policies and procedures communicated to but in no event more than 60 days after Business Associate becomes aware of an unauthorized use or disclosure by DOMor on behalf of Business Associate which constitutes a Breach of Unsecured PHI. Such notification shall include a list of impacted Patients, describe the Breach in such reasonable detail.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rulen. Upon written request of Provider, Business Associate will comply with a Patient request for restriction of certain disclosures to health plans in accordance with 45 CFR 164.522 and the requirements HITECH Act, if the disclosure is to a health care plan for the purposes of carrying out payment or health care operations and the Privacy Rule PHI pertains solely to a health care item or service for which Patient has paid for out of pocket in full. Except to the extent that apply Provider must agree to DOM in a Patient request for restriction under the performance of such obligation.
r. HITECH Act, Business Associate agrees shall not be required to make internal practices, books, and records, including policies and procedures, available comply with a Patient’s request to restrict the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction disclosure of the United States without express written authorization from DOMPHI.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to take the following actions and any other actions that may be required under the Privacy and Security rules:
A. Business Associate agrees to not Use use or Disclose PHI disclose Protected Health Information other than as permitted or required by the Service this Agreement or as Required by By Law.
b. B. Business Associate shall agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of PHI the Protected Health Information other than as provided for by this Agreement.
c. C. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, report to Covered Entity any use or disclosure of any Use or Disclosure of PHI the Protected Health Information not provided for by this Agreement of which it becomes aware. Pursuant to 45 C.F.R. Sec. 164.410, Business Associate also agrees to provide notice to the Covered Entity of any Breach (as defined herein) of Unsecured PHI to the Covered Entity without unreasonable delay and in no case later than 60 calendar days after discovery of a breach. The notification required by this paragraph shall include, to the extent possible, the identification of each individual whose Unsecured PHI has been, or is reasonably believed by the Business Associate to have been, accessed, acquired, used, or disclosed during the Breach. The Business Associate shall provide the Covered Entity with any other available information that the Covered Entity is required to include in its notification to an individual under 45 C.F.R. Sec. 164.404(c) at the time of the notification required given to the Covered Entity or promptly thereafter as information becomes available. The Business Associate shall bear burden of demonstrating that all notifications to the Covered Entity were made as required by C.F.R. Sec. 164.410 or that the use or disclosure did not constitute a Breach of Unsecured PHI. The Business Associate shall retain the records of its investigation and analysis of any suspected or known Breach of Unsecured PHI and shall make such records available to the Covered Entity or HHS as requested.
D. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity agrees to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information.
E. Business Associate agrees to make available Protected Health Information in accordance with 45 CFR 164.524;
F. Business Associate agrees to make available Protected Health Information for amendment and incorporate any amendments to Protected Health Information in accordance with 45 CFR 164.526;
G. Business Associate agrees to provide to Covered Entity or an Individual, in time and manner agreed upon by the parties, information collected in accordance with this Agreement, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528. In order to fulfill this obligation, Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.
H. Business Associate agrees to make its internal practices, books, and any Security Incident records, including policies and procedures and Protected Health Information, relating to the use and disclosure of which it becomes awareProtected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Secretary, in a time and manner agreed upon by the parties or designated by the Secretary, for purposes of the Secretary determining Covered Entity's compliance with the Privacy Rule.
d. I. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI Protected Health Information by Business Associate in Violation violation of the requirements of this Agreement Agreement.
J. Business Associate agrees that, it has or will timely implement the requirements of the HIPAA Security Rule, as amended by ARRA:
1. Implementing administrative (45 C.F.R. 164.308) , physical (45 C.F.R. 164.310), and technical safeguards (45 C.F.R. 164.312) consistent with (and as required by) the HIPAA Security Rule that reasonably protect the confidentiality, integrity, and availability of e-PHI that it creates, receives, maintains, or transmits on behalf of the Covered Entity. Business Associate also agrees be compliant with the policies and procedures and documentation requirements (45 C.F.R. 164.314) applicable to Business Associates under ARRA, and the guidance issued thereunder;
2. Ensuring that any agent, including a subcontractor, to whom it provides such information, agrees to implement reasonable and appropriate safeguards to protect such information;
3. Reporting and tracking all Security Incidents as described below:
a. Business Associate shall report to the Covered Entity any Security Incident that results in (i) unauthorized access, use, disclosure, modification, or destruction of Covered Entity's e-PHI, or (ii) interference with Business Associate's system operations in Business Associate's information systems or to which Business Associate becomes aware within a reasonable period of time thereafter;
b. For any other Security Incident, Business Associate shall aggregate the data and provide such reports on a quarterly basis or as the Covered Entity and Business Associate otherwise agree; and
4. Making Business Associate's policies and procedures and documentation required by the HIPPA Security Rule related to these safeguards available to the Secretary of U.S. Department of Health and Human Services for purposes of determining Covered Entity's compliance with the HIPAA Security Rule.
K. Business Associate agrees to take prompt all reasonable steps to prevent mitigate, to the recurrence of extent practicable, any harmful effect that is known to Business Associate resulting from a Security Incident, including any action required reasonable steps recommended by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410the Covered Entity. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM the Covered Entity all information concerning such disclosure or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM breach as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued may be reasonably requested by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOMCovered Entity.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. (a) Business Associate agrees to not Use utilize or Disclose distribute PHI other than as permitted or required by the Service Administrative Services Agreement, this Business Associate Agreement or as Required by By Law.
b. (b) Business Associate shall use agrees to utilize appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use or Disclosure of the PHI other than as provided for by the Administrative Services Agreement or this Business Associate Agreement.
c. (c) Business Associate agrees to notify DOM without unreasonable delay and report to Covered Entity any suspected Breach of Unsecured PHI of which Business Associate becomes aware. Such report shall be provided as soon as possible after the occurrence of the suspected Breach, but in no event later than seventy-two (72) hours 60 days after discoverythe Breach would be treated as “discovered” within the meaning of 45 CFR § 164.404, provided that, if a law enforcement official requests a delay in accordance with the standards of 45 CFR § 164.412, Business Associate may delay the report for the applicable period of time. Business Associate’s report shall include identification of the Individuals whose Unsecured PHI has been, or is reasonably believed to have been, the subject of a Breach and a draft letter by which the Covered Entity may notify such Individuals. The report in addition shall include a description, to the greatest extent possible, of the nature of the Breach (including date of occurrence and date of discovery); the types of Unsecured PHI involved in the Breach; any steps the Individuals should take to protect themselves from potential harm resulting from the Breach; what Business Associate is doing to investigate the Breach, mitigate losses, and protect against further Breaches; and contact procedures by which Individuals may obtain additional information regarding the Breach. The draft letter shall reflect the information provided in the report. Business Associate shall also promptly supplement the report with any other information regarding the Breach that Covered Entity reasonably requests or that becomes available subsequently.
(d) Business Associate agrees to report to Covered Entity as soon as possible upon discovery but in no event later that 60 days any Use or Disclosure of the PHI not provided for by this Agreement of which it becomes awareBusiness Associate Agreement, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72e) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that createagent, receiveincluding a subcontractor, maintain, to whom it provides PHI received from or transmit protected health information created or received by Business Associate on behalf of the Business Associate agree Covered Entity agrees to the same restrictions, conditions, restrictions and requirements conditions that apply through this Business Associate Agreement to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreementsPHI.
l. (f) Business Associate agrees to provide access, at the request of XXXCovered Entity, and in the a reasonable time and manner designated by XXXmanner, to PHI in a Designated Record Set, to DOM Covered Entity or, as directed by XXXCovered Entity, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. (g) Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM the Covered Entity directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM Covered Entity or an Individual, and in the time and manner reasonably specified to Business Associate by Covered Entity.
(h) Business Associate agrees to make internal practices, books, and records, including policies and procedures and PHI, relating to the Use and Disclosure of PHI received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Secretary, in a time and manner reasonably specified by Covered Entity or designated by XXXthe Secretary, for purposes of the Secretary determining Covered Entity’s compliance with the Privacy Rule.
n. (i) Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures and to maintain such documentation as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX Covered Entity to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. (j) Business Associate agrees to provide Covered Entity or an Individual, in a time and manner reasonably specified by Covered Entity, documentation collected in accordance with Section 2(i) of this Business Associate Agreement, to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
(k) Data Security.
(1) Business Associate agrees to implement appropriate administrative, physical, technical service and technical security measures to protect the integrity, confidentiality and availability of any PHI that it may receive or maintain as a result of Business Associate’s relationship to Covered Entity.
(2) Business Associate agrees that it shall only use or disclose all such security measures will be consistent with 45 CFR 164 subpart C (the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified “HIPAA Security Rule”) and in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply compliance with the requirements of the Privacy HIPAA Security Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction as of the United States without express written authorization from DOMeffective date of the regulation.
Appears in 1 contract
Samples: Master Transaction Agreement (American International Group Inc)
Obligations and Activities of Business Associate. a. Business Associate agrees to not to:
a. Not Use or Disclose PHI other than as permitted or required by this Addendum to perform its services under the Service Agreement Business Associate Addendum or as Required required by Lawlaw.
b. Business Associate shall use Use appropriate safeguards administrative, technical and physical safeguards, and comply with Subpart C of 45 C.F.R. CFR Part 164 with respect to electronic PHI (ePHI) PHI, to preserve the integrity and confidentiality of electronic PHI, and to prevent Use or Disclosure of electronic PHI other than as provided for by the HIPAA Rules and this Agreement.
c. Business Associate agrees Report to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of Participant any Use or Disclosure of PHI not provided for by this the Agreement of which it becomes awareaway, including Breaches of Unsecured PHI as required by 45 CFR 164.410, and any Security Incident of which it becomes aware.
d. . Such incidents shall be reported to the Participant without delay, but in no event later than five (5) business days from the date the incident was discovered by the Business Associate. Notification from Business Associate agrees to mitigateParticipant must include the identity of individuals affected and number of individuals affected, to description of the extent practicableBreach or situation, any harmful effect that is known to Business Associate of a Use or Disclosure types of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt involved, steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed taken by Business Associate to have been Breached along with any other available investigate, mitigate and protect against similar future incidents, and contact information that for the individual who is required reporting the incident to be included in the notification Participant. Participant may make further inquiries or request further action related to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working daysincident. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or As between Participant and Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions all breach notification requirements related to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410incident shall be handled by the Participant.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. d. In accordance with 45 C.F.R. §§ CFR 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to shall ensure that any subcontractors Subcontractor that createcreates, receivereceives, maintainmaintains, or transmit protected health information transmits PHI on behalf of the Business Associate agree agrees in writing to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such informationPHI. The Business Associate agrees to ensure is not in compliance with the HIPAA Rules if it knew of a pattern of activity or practice of a Subcontractor that any Subcontractors that create, receive, maintain, constitutes a material breach or transmit electronic PHI (ePHI) on behalf violation of the subcontractor’s obligation under its HIPAA Subcontractor Agreement with Business Associate will agree to comply with or other arrangement, unless the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement took reasonable steps to cure the breach or end the violation, and Business Associate shall provide DOM with a copy of all if such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written steps were unsuccessful terminated the Subcontract or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kindarrangement, including of the use of such Subcontractors or of the adequacy of such agreementsif feasible.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to e. Make available PHI in a Designated Record Set, Set to DOM or, as directed by XXX, to an Individual Participant in order to timely meet the requirements applicable Covered Entity’s obligations under 45 CFR § 164.524. Any request received by the Business Associate from an Individual who is requesting access to a Designated Record Set shall be promptly forwarded to Participant.
m. Business Associate agrees to f. Promptly make any amendment(s) to PHI in a Designated Record Set that DOM directs as directed or agrees agreed to pursuant to 45 CFR § 164.526 at 164.526, or take other measures as necessary to satisfy the applicable Covered Entity’s obligations timely under 45 CFR 164.526. Any request of DOM or received by the Business Associate from an Individual, and in the time and manner designated by XXXIndividual who is requesting amendment to a Designated Record Set shall be promptly forwarded to Participant.
n. Business Associate agrees g. Maintain a system of documentation to document such Disclosures of PHI and make available the information related required to such Disclosures as would be required for DOM to respond to a request by an Individual for provide an accounting of Disclosures of PHI in accordance with disclosures to Participant as necessary to satisfy the applicable Covered Entity’s obligations under 45 CFR § 164.528. Any request received by the Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by from an Individual for who is requesting an accounting of Disclosures disclosures shall be promptly forwarded to Participant.
h. To the extent Business Associate is to carry out one or more of PHI in accordance with a Covered Entity’s obligations under Subpart E of 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose Part 164, the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the HIPAA Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule Subpart E that apply to DOM the Covered Entity in the performance of such obligation.
r. Business Associate agrees to make i. Make its internal practices, books, and records, including policies and procedures, records available to the Secretary of the Department of Health and Human Services or his or her designee, in a reasonable time and manner for purposes the purpose of determining Business Associate’s and/or DOM's permitting the Secretary to determine compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310HIPAA Rules.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Participation Agreement
Obligations and Activities of Business Associate. a. a) Business Associate agrees to not Use use or Disclose disclose PHI other than as permitted or required by this Agreement, any underlying agreement between the Service Agreement parties, or as Required by Law.
b. b) Business Associate shall will make reasonable efforts, to the extent practicable, to limit requests for and the use and disclosure of PHI to a Limited Data Set (as defined in 45 C.F.R. § 164.514(e)(2)) or, if needed by Business Associate, to the minimum necessary PHI to accomplish the intended purpose of such use, disclosure or request, and as applicable, in accordance with the regulations and guidance issued by the Secretary on what constitutes the minimum necessary for Business Associate to perform its obligations to Covered Entity under this Agreement, any underlying agreement, or as Required By Law.
c) Business Associate agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use the use or Disclosure disclosure of PHI other than as provided for by this Agreement.
c. d) Business Associate agrees to notify DOM without unreasonable delay implement administrative, physical and no later than seventy-two (72) hours after discoverytechnical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of any Use Electronic PHI that it creates, receives, maintains or Disclosure transmits on behalf of PHI not provided for by this Agreement Covered Entity. Business Associate shall comply with the applicable requirements of which it becomes aware, and any the Security Incident of which it becomes awareRule in the same manner such provisions apply to Covered Entity.
d. e) Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsAgreement.
e. f) Business Associate agrees to report to Covered Entity any use or disclosure of PHI not provided for by this Agreement of which it becomes aware. To the extent that Business Associate creates, receives, maintains or transmits Electronic PHI, Business Associate agrees to report as soon as practicable to Covered Entity any Security Incident, as determined by Business Associate, involving PHI of which Business Associate becomes aware. Notwithstanding the foregoing, Business Associate and Covered Entity acknowledge the ongoing existence and occurrence of attempted but unsuccessful Security Incidents that are trivial in nature, such as pings and port scans, and Covered Entity acknowledges and agrees that no additional notification to Covered Entity of such unsuccessful Security Incidents is required. However, to the extent that Business Associate becomes aware of an unusually high number of such unsuccessful Security Incidents due to the repeated acts of a single party, Business Associate shall notify DOM Covered Entity of these attempts and provide the name, if available, of said party. At the request of Covered Entity, Business Associate shall identify the date of the Security Incident, the scope of the Security Incident, Business Associate’s response to the Security Incident, and the identification of the party responsible for causing the Security Incident, if known.
g) Following Business Associate’s discovery of a Breach of Unsecured PHI, Business Associate shall notify Covered Entity of the Breach without unreasonable delay, and in no event later than seventy-two ten (7210) hours calendar days after discovery Business Associate, or any of any actual its employees or suspected Breach of Unsecured PHIagents, all in accordance with 45 C.F.R. § 164.410discovered the Breach. The Such notification shall include, to the extent possible and subsequently as the information becomes availablepossible, the identification of all Individuals each Individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been Breached along with been, accessed, acquired, used, or disclosed during the Breach and any other information available information that to Business Associate about the Breach which is required to be included in the notification of the Breach provided to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all Individual in accordance with 45 C.F.R. § 164.410§164.404(c). A Breach of Unsecured PHI shall be treated as discovered as of the first day on which such Breach is known to Business Associate or should have be known to Business Associate by exercising reasonable diligence.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15h) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii164.308(b)(2) and 164.308(b)(2164.502(e)(1)(ii), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information PHI on behalf of the Business Associate agree in writing to the same restrictions, conditions, restrictions and requirements conditions that apply through this Agreement to Business Associate with respect to such information. Moreover, Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, such agent or transmit electronic PHI (ePHIsubcontractor agrees to implement reasonable and appropriate safeguards to protect Covered Entity’s Electronic PHI.
i) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXXCovered Entity, and in the a time and manner designated by XXXmutually acceptable to Business Associate and Covered Entity, to PHI in a Designated Record SetSet to Covered Entity, to DOM or, as directed by XXXCovered Entity, to an Individual or another person properly designated by the Individual, in order to meet the requirements under 45 CFR C.F.R. § 164.524. If Business Associate maintains PHI electronically in a Designated Record Set and if the Individual requests an electronic copy of such information, Business Associate must provide Covered Entity, or the Individual or person properly designated by the Individual, as directed by Covered Entity, access to the PHI in the electronic form and format requested by the Individual, if it is readily producible in such form and format; or, if not, in a readable electronic form and format as agreed to by Covered Entity and the Individual. Any fee that Business Associate may charge for such electronic copy shall not be greater than Business Associate’s labor and supply costs in responding to the request.
m. j) Business Associate agrees to make any amendment(s) to PHI in its possession contained in a Designated Record Set that DOM Covered Entity directs or agrees to pursuant to 45 CFR C.F.R. § 164.526 at the request of DOM Covered Entity or an Individual, and in the a time and manner designated by XXXmutually acceptable to Business Associate and Covered Entity.
n. k) Business Associate agrees to document such Disclosures disclosures of PHI and information related to such Disclosures disclosures as would be required for DOM Covered Entity to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR C.F.R. § 164.528. As of the compliance date set forth in the regulations promulgated under HITECH or as otherwise determined by the Secretary, in addition to the accounting of disclosure obligations required under 45 C.F.R. § 164.528, Business Associate agrees to retain such documentation shall account for at least six (6) years after all disclosures of PHI made through an Electronic Health Record in accordance with the date of disclosure or provide a full accounting HITECH Standards and relevant documentation to DOM at the time of terminationany future regulations promulgated thereunder.
o. l) Within ten (10) business days (or such other date that Business Associate and Covered Entity may reasonably agree upon) of receiving written notice from Covered Entity that Covered Entity has received a request for an accounting of disclosures of PHI, Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, Covered Entity information collected in accordance with section (III)(h) of this Agreement, to permit XXX Covered Entity to respond to a request by an Individual for an make the accounting of Disclosures of PHI required in accordance with 45 CFR C.F.R. § 164.528.
p. m) Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make its internal practices, books, and records, including policies and procedures, relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of Covered Entity, available to the Secretary for purposes of determining Covered Entity’s or Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310Rule.
s. n) To the extent Business Associate agrees that nothing in this Agreement shall permit is to carry out Covered Entity’s obligations under the Privacy Rule, Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium shall comply with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction requirements of the United States without express written authorization from DOMPrivacy Rule that apply to Covered Entity in the performance of such delegated obligation.
Appears in 1 contract
Samples: School Staffing Agreement
Obligations and Activities of Business Associate. a. (a) Business Associate agrees to not Use use or Disclose PHI further disclose Protected Health Information other than as permitted or required by the Service Agreement this BAA or as Required by Law.
b. . Business Associate shall also comply with any further limitations on uses and disclosures agreed by Covered Entity in accordance with 45 C.F.R. 164.522 provided that such agreed upon limitations have been communicated to Business Associate in accordance with Section 4.1(c) of this BAA.
(b) Business Associate agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of PHI the Protected Health Information other than as provided for by this AgreementBAA, including but not limited to the safeguards described in Section 2(m) of this BAA.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72c) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI Protected Health Information by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsBAA.
e. (d) Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two promptly report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this BAA of which it becomes aware.
(72e) hours after discovery of Business Associate agrees to report to Covered Entity any actual or suspected Breach of Unsecured PHI, all Protected Health Information without unreasonable delay and in accordance with 45 C.F.R. § 164.410no case later than two (2) calendar days after Discovery of a Breach. The notification Such notice shall include, to the extent possible and subsequently as the information becomes available, include the identification of all Individuals each Individual whose Unsecured PHI Protected Health Information has been, or is reasonably believed by Business Associate Associate, to have been Breached along been, accessed, acquired, or disclosed In connection with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOMsuch Breach. In addition, Business Associate agrees to shall provide a written assessment to determine whether any additional information reasonably requested by Covered Entity for purposes of investigating the incident is reportable within ten (10) working daysBreach. An impermissible Use or Disclosure Business Associate’s notification of protected health information is presumed to be a Breach unless under this section shall comply in all respects with each applicable provision of Section 13400 of Subtitle D (Privacy) of XXXX, 00 XXX 164.410, and related guidance issued by the DOM Secretary from time to time. Without limiting Covered Entity’s remedies under Section 6 or any other provision of this BAA, in the event of a Breach involving Unsecured Protected Health Information maintained, used or disclosed by Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees shall reimburse Covered Entity for the cost of providing any legally required notice to fully cooperate, coordinate with, affected Individuals and assist XXX in gathering information the cost of credit monitoring for such Individuals to extent deemed necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM Covered Entity in its sole reasonable discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15f) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information Protected Health Information on behalf of the Business Associate agree in writing to the same restrictions, conditions, restrictions and requirements conditions that apply through this BAA to Business Associate with respect to such information. In no event shall Business Associate, without Covered Entity’s prior written approval, provide Protected Health Information received from, or created or received by Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree Covered Entity, to comply with any employee or agent, including a subcontractor, if such employee, agent or subcontractor receives, processes or otherwise has access to the applicable requirements Protected Health Information outside of the Security Rule and Privacy Rule by entering into a Business Associate United States. Upline Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty 2015 53
(30g) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXXCovered Entity, and in within ten (10) business days of the time and manner designated by XXXrequest from Covered Entity, to PHI Protected Health Information in a Designated Record Set, to DOM Covered Entity or, as directed by XXXCovered Entity, to an Individual in order to meet the requirements under 45 CFR § C.F.R. 164.524. Covered Entity’s determination of what constitutes “Protected Health Information” or a “Designated Record Set” shall be final and conclusive. If Business Associate provides copies or summaries of Protected Health Information to an Individual it may impose a reasonable, cost-based fee in accordance with 45 C.F.R. 164.524 (c)(4).
m. (h) Business Associate agrees to make any amendment(s) to PHI Protected Health Information in a Designated Record Set that DOM the Covered Entity directs or agrees to pursuant to 45 CFR § C.F.R. 164.526 at the request of DOM Covered Entity or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures within ten (10 ) business days of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528Covered Entity. Business Associate agrees shall not charge any fee for fulfilling requests for amendments. Covered Entity’s determination of what Protected Health Information is subject to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting amendment pursuant to 45 C.F.R. 164.526 shall be final and relevant documentation to DOM at the time of terminationconclusive.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(hi) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make (i) internal practices, books, and records, including policies and procedures, relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity, and (ii) policies, procedures, and documentation relating to the safeguarding of Electronic Protected Health Information available to the Secretary Covered Entity, or at the request of the Covered Entity to the Secretary, in a time and manner designated by the Covered Entity or the Secretary, for purposes of the Secretary determining Covered Entity’s or Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310and Security Rules.
s. (j) Business Associate agrees that nothing to document such disclosures of Protected Health Information as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in this Agreement shall permit accordance with 45 C.F.R. 164.528.
(k) Business Associate agrees to accessprovide to Covered Entity, storein the time and manner described below, sharethe information collected in accordance with Section 2(j) of this BAA, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 C.F.R. 164.528. Business Associate agrees to provide such information to Covered Entity within thirty (30) business days of receipt of a request from Covered Entity.
(l) Business Associate acknowledges that it shall request from the Covered Entity and so disclose to its affiliates, agents and subcontractors or other third parties, (i) the information contained in a “limited data set,” as such term is defined at 45 C.F.R. 164.514(e)(2), or, (ii) if needed by Business Associate, to the minimum necessary to accomplish the intended purpose of such requests or disclosures. In all cases, Business Associate shall request and disclose Protected Health Information only in a manner that is consistent with guidance issued by the Secretary from time to time
(m) With respect to Electronic Protected Health Information, Business Associate shall implement and comply with (and ensure that its subcontractors implement and comply with) the administrative safeguards set forth at 45 C.F.R. 164.308, the physical safeguards set forth at 45 C.F.R. 310, the technical safeguards set forth at 45 C.F.R. 164.312, and the policies and procedures set forth at 45 C.F.R. 164.316 to reasonably and appropriately protect the confidentiality, integrity, and availability of the Electronic Protected Health Information that it creates, receives, maintains, or transmits on behalf of Covered Entity. Business Associate acknowledges that, (i) the foregoing safeguard, policies and procedures requirements shall apply to Business Associate in the same manner that such requirements apply to Covered Entity, and (ii) Business Associate shall be liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. 1320d-5 and 1320d-6, as amended from time to time, for failure to comply with the safeguard, policies and procedures requirements and any guidance issued by the Secretary from time to time with respect to such requirements. Upline Agreement 2015 54
(n) With respect to Electronic Protected Health Information, Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit or use or disclose PHI in Electronic Protected Health Information on behalf of Business Associate, agree to comply with the applicable requirements of Subpart C of 45 C.F.R. Part 164 by entering into a contract that complies with 45 C.F.R. Section 164.314.
(o) Business Associate shall report to Covered Entity any form via any medium with any third partySecurity Incident of which it becomes aware, including Breaches of Unsecured Protected Health Information as required by 45 C.F.R. Section 164.410.
(p) If Business Associate conducts any Standard Transactions on behalf of Covered Entity, Business Associate shall comply with the applicable requirements of 45 C.F.R. Parts 160-162.
(q) During the term of this BAA, Business Associate may be asked to complete a security survey and/or attestation document designed to assist Covered Entity in understanding and documenting Business Associate’s Subcontractorssecurity procedures and compliance with the requirements contained herein. Business Associate’s failure to complete either of these documents within the reasonable timeframe specified by Covered Entity shall constitute a material breach of this BAA.
(r) Business Associate acknowledges that, beyond the boundaries and jurisdiction as of the United States without express written authorization Effective Date of this BAA, it shall be liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. 1320d-5and 1320d- 6, as amended from DOMtime to time, for failure to comply with any of the use and disclosure requirements of this BAA and any guidance issued by the Secretary from time to time with respect to such use and disclosure requirements.
(s) To the extent Business Associate is to carry out one or more of Covered Entity’s obligation(s) under Subpart E of 45 CFR Part 164, Business Associate shall comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligation(s).
(t) To the extent that Business Associate provides services to Covered Entity relating to individuals enrolled in state or federal programs (e.g., Medicare or Medicaid), Business Associate shall comply with any additional restrictions or requirements related to the use, disclosure, maintenance, and protection of Protected Health Information of individuals enrolled in such programs through Covered Entity. With respect to the Protected Health Information of Medicare enrollees, Business Associate shall report privacy and security incidents and/or Breaches immediately, but not later than one (1) day, to Covered Entity and include the information required under this Section 2 of this Addendum
Appears in 1 contract
Samples: Aetna Marketing Agreement
Obligations and Activities of Business Associate. a. A. Business Associate agrees to not Use or Disclose PHI other than as permitted or required by the Service this Agreement or as Required by By Law.
b. B. Business Associate shall agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use or Disclosure of PHI other than as provided for by this Agreement. Business Associate further agrees to implement administrative physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of any electronic PHI, as provided for in the Security Rule and as mandated by Section 1304 of the HITECH Act.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. C. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement. Business Associate further agrees to report to Covered Entity any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsin a manner as prescribed herein.
e. D. If the Breach, as discussed in paragraph 2(C), pertains to Unsecured PHI, then Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of report any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the such data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable Covered Entity within ten (10) working daysbusiness days of discovery of said Breach; all other compromises of PHI shall be reported to Covered Entity within twenty (20) business days of discovery. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business AssociateAssociate further agrees, as applicable, demonstrates there is a low probability the PHI has been compromised or one consistent with Section 13402 of the exceptions HITECH Act, to provide Covered Entity, via email or phone call, with information necessary for Covered Entity to meet the definition requirements of Breach applies, all in accordance with 45 C.F.R. § 164.410said section.
g. E. If Business Associate is an Agent of Covered Entity, then Business Associate agrees that any Breach of Unsecured PHI shall be reported to fully cooperate, coordinate withCovered Entity immediately after the Business Associate becomes aware of said Breach, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure under no circumstances later than one (1) business day thereafter. Business Associate further agrees that any notices sent compromise of PHI, other than a Breach of Unsecured PHI as specified in connection with the Incident are2(C) of this Agreement, subject shall be reported to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM Covered Entity within fifteen ten (1510) business days after discovery of an Incident a written corrective action plan (“CAP”) describingdiscovering said compromise, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAPattempted compromise.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), F. Business Associate agrees to ensure that any subcontractors that createSubcontractor, receive, maintain, or transmit protected health information on behalf of the to whom Business Associate agree provides PHI, agrees to the same restrictions, conditions, restrictions and requirements conditions that apply through this Agreement to Business Associate with respect to such information. Business Associate further agrees that restrictions and conditions analogous to ensure those contained herein shall be imposed on said Subcontractors via a written agreement that any Subcontractors complies with all the requirements specified in Section 164.504(e)(2), and that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall only provide DOM said Subcontractors PHI consistent with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f13405(b) of this Agreementthe HITECH Act. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kindFurther, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the copies of said written agreements to Covered Entity within ten (10) business days of a Covered Entity’s request of XXX, and in the time and manner designated by XXXfor same.
G. Business Associate agrees to provide access via in-app export, to PHI in a Designated Record Set, Set to DOM Covered Entity or, as directed by XXXCovered Entity, to an Individual Individual, in order to meet the Covered Entity’s requirements under 45 CFR § Section 164.524.
m. . Business Associate agrees further agrees, in the case where Business Associate controls access to make PHI in an Electronic Health Record, or controls access to PHI stored electronically in any amendment(sformat, to provide similar access in order for Covered Entity to meet its requirements of the HIPAA Rules and under Section 13405(c) to of the HITECH Act. These provisions do not apply if Business Associate and its employees or Subcontractors have no PHI in a Designated Record Set that DOM directs or of Covered Entity.
H. Business Associate agrees to make PHI in a Designated Record Set available to the Covered Entity for the purpose of making amendments and incorporate such amendments in the Designated Record Set pursuant to 45 CFR § 164.526 at the request Section164.526. This provision does not apply if Business Associate and its employees or Subcontractors have no PHI from a Designated Record Set of DOM or an Individual, and in the time and manner designated by XXXCovered Entity.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request I. Unless otherwise protected or prohibited from discovery or disclosure by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individuallaw, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and proceduresprocedures (collectively “Compliance Information”), relating to the Use or Disclosure of PHI and the protection of same, available to the Covered Entity or to the Secretary for purposes of the Secretary determining Business Associate’s and/or DOMCovered Entity's compliance with the Privacy Rule pursuant HIPAA Rules and the HITECH Act. Business Associate further agrees, at the request of Covered Entity, to 45 C.F.R. § 160.310provide Covered Entity with demonstrable evidence that its Compliance Information ensures Business Associate’s compliance with this Agreement over time. Business Associate shall have a reasonable time within which to comply with requests for such access and/or demonstrable evidence, consistent with this Agreement. In no case shall access, or demonstrable evidence, be required in less than ten (10) business days after Business Associate’s receipt of such request, unless otherwise designated by the Secretary.
s. J. Business Associate agrees that nothing to maintain necessary and sufficient documentation of Disclosures of PHI as would be required for Covered Entity to respond to a request by an Individual for an accounting of such Disclosures, in accordance with 45 CFR Section164.528.
K. On request of Covered Entity, Business Associate agrees to provide to Covered Entity documentation made in accordance with this Agreement to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. Section 164.528. Business Associate shall provide said documentation in a manner and format to be specified by Covered Entity. Business Associate shall have a reasonable time within which to comply with such a request from Covered Entity and in no case shall Business Associate be required to provide such documentation in less than five (5) business days after Business Associate's receipt of such request.
L. Except as provided for in this Agreement shall permit Agreement, in the event Business Associate to receives an access, storeamendment, shareaccounting of disclosure, maintainor other similar request directly from an Individual, transmit Business Associate shall redirect the Individual to the Covered Entity.
M. To the extent that Business Associate carries out one or use more of Covered Entity’s obligations under the HIPAA Rules, the Business Associate must comply with all requirements of the HIPAA Rules that would be applicable to the Covered Entity.
N. A Business Associate must honor all restrictions consistent with 45 CFR Section 164.522 that the Covered Entity or disclose PHI in any form via any medium with any third partythe Individual makes the Business Associate aware of, including Business Associatethe Individual’s Subcontractorsright to restrict certain disclosures of PHI to a health plan where the individual pays out of pocket in full for the healthcare item or service, beyond the boundaries and jurisdiction of the United States without express written authorization from DOMin accordance with HITECH Act Section] 13405(a).
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. a) Business Associate agrees to shall not Use or Disclose PHI Protected Health Information other than as permitted or required by the Service Agreement or as Required by Lawthis Agreement.
b. b) Business Associate shall agrees to use appropriate administrative, physical, and technical safeguards and comply comply, where applicable, with Subpart C the Security Standards for Protection of Electronic Protected Health Information, 45 C.F.R. CFR Part 164 with respect to electronic PHI Subpart 164, to: (ePHIi) to prevent Use or Disclosure of PHI the Protected Health Information other than as provided for by this Agreement; and (ii) reasonably and appropriately protect the confidentiality, integrity, and availability of the Electronic Protected Health Information that it creates, receives, maintains or transmits on behalf of Covered Entity.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72c) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI Protected Health Information by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent shall cooperate with Covered Entity in the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsmitigation process.
e. d) Business Associate agrees to notify DOM report to Covered Entity, without unreasonable delay, delay and no later than seventywithin forty-two eight (7248) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.discovery:
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10i) working days. An impermissible Any Use or Disclosure of protected health information is presumed Protected Health Information not provided for by this Agreement, including Breaches of Unsecured Protected Health Information as required by 45 CFR Section 164.410; and/or
(ii) Any Security Incident provided that any Security Incidents that are “unsuccessful” and do not represent risks to Protected Health Information, such as “pings” on a firewall, may be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410reported through routine reports.
g. e) Business Associate agrees shall not Disclose Protected Health Information to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required third party except as expressly permitted by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHIthe Underlying Contracts, as expressly permitted by Covered Entity based on prior written approval, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Required By Law. Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information Protected Health Information on Business Associate’s behalf of the Business Associate agree in writing to the same restrictions, conditions, restrictions and requirements conditions that apply through this Agreement to Business Associate with respect to such Protected Health Information. Business Associate shall ensure that any subcontractors to whom it provides Electronic Protected Health Information agree in writing to implement reasonable and appropriate safeguards to protect such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintainshall not Disclose Protected Health Information, or transmit electronic PHI (ePHI) on behalf permit an agent or subcontractor to Disclose Protected Health Information, to any person outside the United States of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreementsAmerica.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. f) Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make its internal practices, books, and recordsrecords relating to the Use and Disclosure of Protected Health Information received from, including policies and proceduresor created or received by Business Associate on behalf of Covered Entity, available to Covered Entity and to the Secretary of the Department of Health and Human Services (“Secretary”) for the purposes of the Secretary determining compliance with HIPAA, and Covered Entity’s determining Business Associate’s and/or DOM's compliance with this Agreement. Nothing in this section shall be construed as a waiver of any legal privilege or of any protections for trade secrets or confidential commercial information. Business Associate shall immediately notify Covered Entity of such request from the Secretary pertaining to an investigation of Covered Entity’s compliance with HIPAA.
g) Business Associate, upon request by Covered Entity, will make Protected Health Information in a Designated Record Set available to Covered Entity or, at the request of Covered Entity, the Individual, within ten (10) days of Covered Entity’s request, as necessary to allow Covered Entity to comply with its obligations to provide access to Individuals of their health information as required by 45 CFR Section 164.524. Any denial of access to Protected Health Information will be the responsibility of Covered Entity. In the event any Individual requests access to Protected Health Information directly from Business Associate, Business Associate shall forward such request to Covered Entity within two (2) business days.
h) Business Associate, upon request by Covered Entity, will make Protected Health Information in a Designated Record Set available to Covered Entity and will incorporate any amendments to such information as instructed by Covered Entity within ten (10) days of a request, as necessary to allow Covered Entity to comply with its amendment obligations as required by 45 CFR Section 164.526. Any denial of amendment of Protected Health Information will be the responsibility of Covered Entity. In the event any Individual requests amendment to Protected Health Information directly from Business Associate, Business Associate shall forward such request to Covered Entity within two (2) business days.
i) Business Associate will maintain and, upon request by Covered Entity, within ten (10) days provide Covered Entity with the information necessary for Covered Entity to provide an Individual with an accounting of Disclosures and/or access report as required by 45 CFR Section 164.528. Nothing in this section shall require Business Associate to maintain or provide an access report of Protected Health Information unless such action is required by amendments to 45 CFR Section 000.000.Xx the event any Individual requests an accounting of Disclosure of Protected Health Information directly from Business Associate, Business Associate shall forward such request to Covered Entity within two (2) business days.
j) To the extent that Business Associate is to carry out one or more of Covered Entity’s obligations under the Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. Part 164 Subpart E, including but not limited to the provision of a notice of privacy practices on behalf of Covered Entity, Business Associate shall comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligations.
k) Business Associate shall not directly or indirectly receive remuneration in exchange for Protected Health Information unless such remuneration is permissible under HIPAA.
l) Business Associate will comply with federal and state law and will not act or fail to act in a manner that would cause Covered Entity to not be in compliance with federal and state law including, but not limited to, the Privacy Rule pursuant to 45 C.F.R. § 160.310and Security Laws.
s. m) Business Associate (or its agents or subcontractors) will request, Use and Disclose only the minimum amount of Protected Health Information necessary to accomplish the purpose of the request, Use or Disclosure.
n) Business Associate agrees that nothing in this Agreement shall permit Business Associate to accessindemnify and hold harmless Covered Entity, storeits employees, shareofficers, maintaintrustees, transmit or use or disclose PHI in agents, and contractors from any form via any medium with any third partyand all liability, including attorneys’ fees, costs of defense, and costs of mitigation and/or notification, that may arise from: (i) Business Associate’s Subcontractorstransmission, beyond access, storage, Use, or Disclosure of Protected Health Information or(ii) any misrepresentation, breach of warranty, breach, or non-fulfillment of any undertaking on the boundaries part of Business Associate under this Agreement and jurisdiction the Underlying Contracts.
o) No limitations of liability, limitations of remedy, or disclaimers by Business Associate contained in the United States without express written authorization from DOMUnderlying Contracts shall apply to the obligations and subject matter of this Agreement or to remedies sought by Covered Entity with respect to a breach of this Agreement by Business Associate or any of Business Associate’s workforce, agents, or subcontractors.
p) The parties acknowledge that the Use or Disclosure of Protected Health Information in a manner inconsistent with this Agreement or the Underlying Contracts will cause Covered Entity irreparable damage and that Covered Entity shall have the right to equitable and injunctive relief to prevent the unauthorized Use or Disclosure and to such damages as are occasioned by such unauthorized Use or Disclosure in addition to other remedies available at law or in equity. Covered Entity’s remedies under this Agreement and the Underlying Contracts shall be cumulative, and the exercise of any remedy shall not preclude the exercise of any other.
q) The Parties agree that the Protected Health Information is, and shall remain, the property of Covered Entity.
r) Business Associate shall maintain appropriate and adequate insurance coverage to cover Business Associate’s obligations pursuant to this Agreement and the Underlying Contracts.
Appears in 1 contract
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use or Disclose comply with those provisions of the Security Rule that are set forth at 45 C.F.R. §§ 164.308, 164.310, 164.312, and 164.316, as amended from time to time, with respect the security of PHI, in the same manner that such regulations apply to the Provider. Any additional requirements of the HITECH Act that relate to security of PHI other than as permitted or required and that are made applicable with respect to covered entities shall also be applicable to Business Associate and shall be and by the Service Agreement or as Required by Lawthis reference hereby are incorporated into this Business Associate Agreement.
b. Business Associate shall use appropriate safeguards and agrees to comply with Subpart C of the Privacy Rule at 45 C.F.R. Part 164 § 164.504(e), as amended from time to time, with respect to electronic its use and disclosure of PHI, in the same manner that such regulation applies to Provider. The additional requirements of the HITECH Act that relate to privacy and that are made applicable with respect to covered entities shall also be applicable to Business Associate and shall be and by this reference hereby are incorporated into the Business Associate Agreement.
c. Business Associate agrees to not use or further disclose PHI other than as specifically permitted or required by this Agreement or as required by law.
d. Business Associate agrees to use appropriate Administrative, Technical, and Physical Safeguards to (ePHI1) to prevent Use use or Disclosure disclosure of PHI other than as provided for by this Agreement; and (2) reasonably and appropriately protect the Confidentiality, Integrity and Availability of Electronic PHI.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. e. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsAgreement.
e. f. Business Associate agrees to notify DOM without unreasonable delayreport to Provider if it becomes aware of any (1) use or disclosure of PHI not provided for by this Agreement; (2) unauthorized access of Electronic PHI; (3) unauthorized destruction or modification of Electronic PHI; or (4) unauthorized interference with the systems operations of Business Associate’s electronic information systems containing Electronic PHI. Notwithstanding anything herein to the contrary, the parties acknowledge and agree that this Agreement shall constitute notice to Provider that Business Associate may periodically experience broadcast attacks on its firewall, port scans, unsuccessful log-on attempts, denials of service and similar unsuccessful security incidents, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate need not further report such incidents to have been Breached along with any other available information that is required to be included Provider so long as such incidents do not result in the notification to the Individualunauthorized access, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual use or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410PHI.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident areagent, subject including a sub-contractor, to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required whom it provides PHI created or received by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree Provider, agrees to substantially the same restrictions, conditions, restrictions and requirements conditions that apply through this Agreement to Business Associate with respect to such information. Business Associate agrees , including, without limitation, implementation of appropriate safeguards to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf protect the security of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreementsElectronic PHI.
l. h. Upon written request of Provider, Business Associate agrees to provide access, at the request of XXX, and Provider with information collected in the time and manner designated by XXX, accordance with this Agreement to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM permit Provider to respond to a request by an Individual Patient for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528. .
i. Business Associate agrees to retain such documentation for at least six (6) years notify Provider without unreasonable delay, but in no event more than 60 days after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or becomes aware of an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only unauthorized use or disclose the minimum PHI necessary to perform functions, activities, or services for, disclosure by or on behalf of, DOM as specified in the Service Agreements. of Business Associate agrees to comply with any guidance issued by which constitutes a Breach of Unsecured PHI. Such notification shall include a list of impacted Patients and describe the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOMBreach in such reasonable detail.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Master Services Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use use or Disclose PHI disclose Protected Health Information other than as permitted or required by the Service Agreement or as Required required by Lawlaw.
b. Business Associate shall agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of PHI the Protected Health Information other than as provided for by this Agreement.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, report to Covered Entity any use or disclosure of any Use or Disclosure of PHI the Protected Health Information not provided for by this Agreement of which it becomes aware, and any Security Incident including breaches of which it becomes awareunsecured protected health information, as required at 45 C.F.R. 164.410.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to if applicable, ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information.
e. Report to the Covered Entity any security incident of which it becomes aware.
f. Business Associate shall notify the Covered Entity of a breach of unsecured PHI on the first day on which such breach is known by Business Associate or an employee, officer or agent of Business Associate other than the person committing the breach, or as soon as possible following the first day on which Business Associate or an employee, officer or agent of Business Associate other than the person committing the breach should have known by exercising reasonable diligence of such breach. Notification shall include, to the extent possible, the identification of each individual whose unsecured PHI has been, or is reasonably believed by the Business Associate to have been, accessed, acquired, used or disclosed during the breach. Business Associate agrees to ensure that shall also provide the Covered Entity with any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of other available information at the time Business Associate will agree makes notification to comply with the applicable requirements Covered Entity or promptly thereafter as information becomes available. Such additional information shall include (i) a brief description of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kindwhat happened, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.breach;
Appears in 1 contract
Samples: Memorandum of Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to will:
a. not Use use or Disclose PHI disclose Protected Health Information that it receives from or on behalf of Athena or that it creates on behalf of Athena (collectively “PHI”) other than as permitted or required by the Service Agreement this Appendix, or as Required required by Law.law;
b. Business Associate shall not use or disclose PHI in a manner that would violate the requirements of the Privacy Rule when done by Athena, except as permitted by Section 3, below;
c. use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of the PHI other than as provided for by this Agreement.
c. Business Associate agrees Appendix and shall, after the compliance date of the HIPAA Final Rule, comply with the Security Rule with respect to notify DOM without unreasonable delay and no later Electronic PHI, to prevent use or disclosure of such information other than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not as provided for by the Agreement and this Agreement of which it becomes awareAppendix;
d. implement administrative, physical, and any Security Incident technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of which it becomes aware.PHI (including electronic PHI);
d. Business Associate agrees to e. mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Appendix;
f. report to Athena as soon as practicable and as required by HIPAA and the HITECH Act, as implemented by the HIPAA Omnibus Final Rule (“HIPAA Final Rule”) and any subsequent amendment thereto, or any subsequent rule or regulation interpreting or modifying HIPAA or the HITECH Act, any use or disclosure of PHI by Business Associate other than as provided for by this Agreement and take prompt steps any Security Incident (as defined in the Security Rule) with respect to prevent the recurrence electronic PHI;
g. upon discovery of any IncidentBreach involving Unsecured PHI, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM Athena of that Breach without unreasonable delay; provided, however, that the Parties acknowledge and agree that this Section constitutes notice by Business Associate to Athena of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined below) for which notice to Athena by Business Associate shall be required only upon request. “Unsuccessful Security Incidents” shall include, but not be limited to, pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service, and any combination of the above, so long as no later than seventy-two such incident results in unauthorized access, use, or disclosure of PHI. Business Associate’s notification to Athena shall include (72i) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall includeidentification, to the extent possible and subsequently as the information becomes availablepossible, the identification of all Individuals each individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been Breached along with accessed, used, or disclosed through the Breach; (ii) any other available information known to Business Associate that Athena is required to include in its notice to affected individuals; and (iii) any other information that is required would need to be included in Athena’s accounting of disclosures under HIPAA or the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business AssociateHITECH Act, as applicable, demonstrates there is a low probability implemented by the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security HIPAA Final Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written subsequent amendment thereto or an electronic copy to DOM’s Privacy Officer at any subsequent rule or regulation interpreting or modifying HIPAA or the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.HITECH Act;
Appears in 1 contract
Obligations and Activities of Business Associate. a. (i) Business Associate agrees to shall not Use use or Disclose disclose PHI or Patient Identifying Information other than as permitted or required under this Agreement. Business Associate acknowledges that, in receiving, maintaining, processing, using or disclosing PHI and Patient Identifying Information from Covered Entity, it is fully bound by HIPAA and the Service Agreement or as Required by LawPart 2 Regulations, and will comply with all requirements thereunder.
b. (ii) Business Associate shall have in place appropriate policies and procedures, use appropriate safeguards and comply with the applicable requirements of Subpart C of 45 C.F.R. Part § 164 with respect to electronic E-PHI (ePHI) to prevent Use the use or Disclosure disclosure of PHI and Patient Identifying Information other than as provided for herein. Further, Business Associate shall ensure its policies, procedures and safeguards include the requirements set forth in the Part 2 Regulations at 42 C.F.R. § 2.16.
(iii) Business Associate shall comply with the applicable requirements of Subpart E of 45 C.F.R. § 164. To the extent that Business Associate, in providing the Services, is carrying out one or more of Covered Entity’s obligations under Subpart E of 45 C.F.R. § 164, Business Associate shall comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligations.
(iv) Business Associate shall promptly report to Covered Entity, within ten (10) business days after discovery, any use or disclosure of PHI or Patient Identifying Information not permitted by this Agreement.
c. , as well as any Security Incident. In addition, Business Associate agrees to notify DOM shall promptly and without unreasonable delay and delay, notify Covered Entity following the discovery of a Breach of Unsecured PHI as required by 45 C.F.R. § 164.410, except that Business Associate shall make such reports to Covered Entity no later than seventy-two ten (7210) hours business days after discoverydiscovery of the same unless a law enforcement official determines that such a report would impede a criminal investigation or cause damage to national security, in which case Business Associate will comply with 45 C.F.R. § 164.412. A Breach is deemed discovered as of any Use or Disclosure of PHI not provided for by this Agreement of the first day on which it becomes awareis known to Business Associate or to any person, other than the person committing the Breach, who is an employee, officer or other agent of Business Associate, or, by exercising reasonable diligence, would have been known to Business Associate or such person.
(v) Business Associate shall include in any report required under Section 4(a)(iv) immediately above, to the extent possible, (A) a description of the impermissible use/disclosure, Security Incident or Breach of Unsecured PHI, (B) the identification of each individual whose PHI has been, or is reasonably believed to have been, the subject of the impermissible use/disclosure, Security Incident or Breach of Unsecured PHI, and (C) such other available information, as requested by Covered Entity, which Covered Entity may be required to include in any Security Incident of which it becomes awarerequired notifications to the affected individuals.
d. (vi) Business Associate agrees to shall mitigate, to the extent practicable, any harmful effect that is known to Business Associate of (A) a Use Security Incident, (B) a Breach of Unsecured PHI, and (C) a use or Disclosure disclosure of PHI or Patient Identifying Information by Business Associate or its employees or agents, including any Subcontractors, in Violation violation of the requirements of this Agreement Agreement. Further, Business Associate shall reasonably cooperate and take prompt steps to prevent coordinate with Covered Entity in the recurrence investigation of any Incidentviolation of the requirements of this Agreement, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delayimpermissible use/disclosure, and no later than seventy-two (72) hours after discovery of any actual Security Incident or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10vii) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXXCovered Entity, and in the time and manner designated by XXX, shall provide access to PHI in a Designated Record Set, Set to DOM Covered Entity or, as directed by XXXCovered Entity, to an Individual individual in order to meet the requirements under 45 CFR C.F.R. § 164.524.
m. (viii) Business Associate agrees to shall make any amendment(s) amendments to PHI in a Designated Record Set that DOM Covered Entity directs or agrees to pursuant to 45 CFR C.F.R. § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX164.526.
n. (ix) Business Associate agrees shall make available to document such Disclosures of PHI and Covered Entity information related required to such Disclosures as would be required for DOM to respond to a request by an Individual for provide an accounting of Disclosures disclosures of PHI in accordance with 45 CFR C.F.R. § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting , and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures disclosures under the Part 2 Regulations at 42 C.F.R. § 2.13(d) if applicable.
(x) Business Associate shall make its internal practices, books and records relating to the use and disclosure of PHI in and Patient Identifying Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity and the Secretary for purposes of the Secretary’s determination of Covered Entity’s compliance with HIPAA.
(xi) In accordance with 45 CFR § 164.528the Part 2 Regulations, Business Associate (A) acknowledges that in receiving, storing, processing, or otherwise dealing with any patient records and Patient Identifying Information from Covered Entity, it is fully bound by the Part 2 Regulations; and (B) if necessary, will resist in judicial proceedings any efforts to obtain access to Patient Identifying Information related to substance use disorder diagnosis, treatment, or referral for treatment except as permitted by the Part 2 Regulations.
p. (xii) Business Associate agrees that it shall only use not delegate or disclose the minimum PHI necessary to perform assign any of its functions, activities, or services forunder this Agreement to a Subcontractor, or on behalf of, DOM as specified unless (A) Covered Entity consents to same in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rulewriting, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations (B) such arrangement is permitted under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, booksPart 2 Regulations, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's (C) such arrangement is set forth in a written agreement in compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310applicable provisions of HIPAA and the Part 2 Regulations.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. 2.1 Business Associate agrees to may not Use use or Disclose PHI disclose Protected Health Information other than as permitted or required by this Agreement, the Service Agreement Underlying Agreements or as Required by Law.
b. 2.2 Business Associate shall agrees to use appropriate safeguards, including without limitation, administrative, physical and technical safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) set forth in the Security Rule, to prevent Use use or Disclosure of PHI the Protected Health Information other than as provided for by this AgreementAgreement and to reasonably and appropriately employ the same standards as Required by Law to protect the confidentiality, integrity and availability of any Electronic Protected Health Information (e-PHI) that it may receive, maintain or transmit on behalf of the Covered Entity.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. 2.3 Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure of PHI Protected Health Information by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsAgreement.
e. 2.4 Business Associate agrees to notify DOM without unreasonable delayreport to Covered Entity, within twenty-four (24) hours, any use or Disclosure, or suspected Use or Disclosure, of the Protected Health Information not provided for by this Agreement or any Security Incident resulting in an unauthorized access or acquisition of e-PHI, of which it becomes aware, involving Protected Health Information of the Covered Entity. Business Associate shall report the unauthorized use or disclosure using the process specified in the services agreement executed between Business Associate and Covered Entity. Business Associate hereby reports to Covered Entity that incidents including, but not limited to, ping sweeps or other common network reconnaissance techniques, attempts to log on to a system with an invalid password or username, and no later than seventy-two (72) hours after discovery denial of any actual or suspected Breach of Unsecured PHIservice attacks that do not result in a server being taken off line, all may occur from time to time.
2.5 Business Associate must in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ CFR 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to if applicable, ensure that any subcontractors Subcontractors, agents or affiliates of the Business Associate, that create, receive, maintain, or transmit protected health information PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information. Business Associate must obtain satisfactory assurances in the form of a written agreement or memorandum of understanding directly from Subcontractors stipulating that the Subcontractor agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements terms and conditions of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands must ensure that submission of their Subcontractors’ any agent or Subcontractor to whom the Business Associate Agreement(s) to DOM does provides PHI, not constitute DOM approval of any kind, including export PHI beyond the borders of the use Commonwealth of such Subcontractors or Puerto Rico without express written agreement of the adequacy of such agreementsCovered Entity.
l. 2.6 Business Associate agrees to provide access, at the written request of XXXCovered Entity, and in the time and manner designated by XXXCovered Entity, to PHI Protected Health Information in a Designated Record Set, to DOM or, as directed by XXX, to an Individual Covered Entity in order to meet the requirements under 45 CFR § §164.524.
m. 2.7 Business Associate agrees to make any amendment(s) to PHI Protected Health Information in a Designated Record Set that DOM the Covered Entity directs or agrees to pursuant to 45 CFR § §164.526 at the written request of DOM Covered Entity or an Individual, and in the time and manner designated by XXXCovered Entity.
n. 2.8 Business Associate agrees to make available internal practices, books, and records relating to the use and Disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity, or at the request of the Covered Entity to the Secretary, in a time and manner designated by the Covered Entity or the Secretary, for purposes of the Secretary determining Covered Entity's compliance with the Privacy and Security Rules.
2.9 Business Associate agrees to document such Disclosures of PHI Protected Health Information and information related to such Disclosures as would be required for DOM Covered Entity to respond to a request by an Individual for an accounting of Disclosures of PHI Protected Health Information in accordance with 45 CFR § §164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. 2.10 Business Associate agrees to provide to DOM Covered Entity or an Individual, in a time and manner designated by DOMCovered Entity, information collected in accordance with section Section (III)(h1)(i) of this Agreement, to permit XXX Covered Entity to respond to a request by an Individual for an accounting of Disclosures of PHI Protected Health Information by Business Associate in accordance with 45 CFR § §164.528.
p. 2.11 Business Associate understands and agrees that it shall only will not access or use or disclose the minimum any Protected Health Information of any Individual except for those Individuals whose PHI necessary has been disclosed to perform functions, activitiesBusiness Associate, or services foris created, received, maintained, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued transmitted by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated or to Business Associate on behalf of Covered Entity, and it will further limit access to that Protected Health Information that is necessary to the activities undertaken by DOMBusiness Associate on behalf of Covered Entity and as otherwise permitted by this Agreement.
q. 2.13 Business Associate agrees that will, pursuant to the extent that Business Associate carries out DOM’s obligations under the Privacy RuleHITECH Act and its implementing regulations, Business Associate will comply with the requirements of the Privacy Rule Rule, including those contained in 45 CFR §§ 164.502(e) and 164.504(e)(1)(ii), at such time as the requirements are applicable to Business Associate. To the extent Business Associate is to carry out one or more of Covered Entity’s obligations under Subpart E of 45 C.F.R. Part 164, Business Associate agrees to comply with the requirements of Subpart E that apply to DOM Covered Entity in the performance of such obligationobligations. Business Associate will not directly or indirectly receive remuneration in exchange for any Protected Health Information, subject to the exceptions contained in the HITECH Act, without a valid authorization from the applicable Individual. Business Associate will not use Protected Health Information to engage in any communication which might be deemed to be “Marketing” under the HITECH Act. In addition, Business Associate will, pursuant to the HITECH Act and its implementing regulations, comply with all applicable requirements of the Security Rule, contained in 45 CFR § 164.308, 164.310, 164.312 and 164.316, at such time as the requirements are applicable to Business Associate.
r. 2.14 Business Associate agrees to make internal practices, books, uses of and records, including disclosures and requests for Protected Health Information consistent with HIPAA and any of Covered Entity’s Minimum Necessary policies and procedures, available procedures provided to the Secretary for purposes Business Associate and consistent with Covered Entity’s Notice of determining Business Associate’s and/or DOM's compliance Privacy Practices. Covered Entity asserts that its Minimum Necessary policies and procedures are consistent with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. §164.514(d) and Business Associate agrees to comply with the provisions of that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOMrule.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. 1. Business Associate agrees to not Use use or Disclose disclose PHI other than as permitted or required by the Service Agreement or as Required required by Lawlaw.
b. 2. Business Associate shall use appropriate agrees to employ administrative, physical, and technical safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) meeting required Security Standards for business associates as required by law to prevent Use disclosure or Disclosure use of PHI other than as provided for allow by this Agreement.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. 3. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI held by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsAgreement.
e. 4. Business Associate agrees to report to Covered Entity any use or disclosure of the PHI not provided for by this Agreement of which it becomes aware.
5. If a breach of unsecured PHI occurs at or by Business Associate, the Business Associate must notify DOM Covered Entity following the discovery of the breach without unreasonable delaydelay and, and in all cases, no later than seventy-two thirty (7230) hours after days from the discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410the breach. The notification shall include, to To the extent possible and subsequently as possible, the information becomes available, Business Associate should provide the Covered Entity with the identification of all Individuals whose Unsecured PHI is reasonably believed each individual affected by Business Associate to have been Breached along with the breach as well as any other available information that is required to be included provided by the Covered Entity in the its notification to the Individual, HHS, and/or the media, affected individuals. Business Associate shall comply with all in accordance with the data Breach regulations issued by HHS and applicable state agencies regarding breach notification requirements set forth in 45 C.F.R.§ 164.410to Covered Entity.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information6. Business Associate agrees to ensure that any Subcontractors that createagent, receiveincluding a subcontractor, maintainto whom it provides PHI received from, or transmit electronic PHI (ePHI) created or received by Business Associate on behalf of Covered Entity, agrees to the same restrictions and conditions that apply through this Agreement to Business Associate will agree with respect to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this AgreementPHI.
7. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide accessagrees, at the request of XXXCovered Entity, and in the time and manner designated by XXX, to provide Covered Entity (or a designate of Covered Entity) access to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual Set in prompt commercially reasonable manner in order to meet the requirements under 45 CFR § §164.524.
m. 8. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM the Covered Entity directs or agrees to pursuant to 45 CFR § §164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM Covered Entity or an Individual, in a time prompt and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528commercially reasonable manner.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements9. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and proceduresprocedures and PHI, relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Secretary (including official representatives of the Secretary), in a prompt commercially reasonable manner for purposes of determining Business AssociateCovered Entity’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310Rule.
s. 10. Business Associate shall, upon request with reasonable notice, provide Covered Entity access to its premises for a review and demonstration of its internal practices and procedures for safeguarding PHI.
11. Business Associate agrees that nothing to document such disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an individual for an accounting of disclosures of PHI in this Agreement shall permit accordance with 45 CFR §164.528.
12. Business Associate agrees to accessprovide to Covered Entity or an Individual, storein a prompt commercially reasonable manner, shareinformation collected in accordance with this Agreement, maintain, transmit or use or disclose to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in any form via any medium accordance with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM45 CFR §164.528.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. a) In consideration of the disclosure of PHI by the Disclosing Party, the Receiving Party hereby agrees: (i) to hold the PHI in strict confidence and to take all reasonable precautions to protect such information (including, without limitation, all precautions the Receiving Party employs with respect to its own confidential materials), (ii) not to disclose any such PHI or any information derived therefrom to any third person, (iii) not to make any use whatsoever at any time of such PHI except to evaluate internally its relationship with the Disclosing Party, and (iv) not to copy or reverse engineer any such PHI. The receiving Party shall require that its employees, agents and sub-contractors to whom PHI is disclosed or who have access to PHI sign a nondisclosure or similar agreement in content substantially similar to this Agreement.
b) Business Associate agrees to not Use use or Disclose disclose PHI other than as permitted or required by the Service Agreement or as Required required by Lawlaw.
b. c) Business Associate shall agrees to use appropriate safeguards safeguards, and comply with Subpart C of 45 C.F.R. CFR Part 164 with respect to electronic PHI (ePHI) PHI, to prevent Use use or Disclosure disclosure of PHI protected health information other than as provided for by this the Agreement.
c. d) Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of report to covered entity any Use use or Disclosure of disclosure PHI not provided for by this the Agreement of which it becomes aware, including breaches of unsecured protected health information as required at 45 CFR 164.410, and any Security Incident security incident of which it becomes aware; Business Associate shall report such breach within 3 days of discovery.
d. e) Business Associate agrees to mitigateto, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(iiCFR 164.502(e)(l)(ii) and 164.308(b)(2), Business Associate agrees to if applicable, ensure that any subcontractors that create, receive, maintain, or transmit protected health information PHI on behalf of the Business Associate business associate agree to the same restrictions, conditions, and requirements that apply to Business Associate the business associate with respect to such information. Business Associate .
f) Covered Entity acknowledges and agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty , will not make PHI available (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(sa) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, extent and in the time and manner designated required by XXXSection 164.524 of the Privacy rule, (b) for amendment or incorporate any amendments to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI Protected Health Information in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date requirements of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes Section 164.526 of the Privacy Rule, and any minimum necessary policies and procedures communicated to or (c) for purposes of accounting of disclosures, as required by Section 164.528 of the Privacy Rule. Rather, Covered Entity will be solely responsible for compliance with each of the foregoing.
g) Business Associate by DOMagrees to maintain and make available the PHI required to provide an accounting of disclosures to the Covered Entity as necessary to satisfy covered entity’s obligations under 45 CFR 164.528.
q. h) Business Associate agrees that to the extent that the Business Associate carries is to carry out DOMone or more of Covered Entity’s obligations obligation(s) under the Privacy RuleSubpart E of 45 CFR Part 164, Business Associate will comply with the requirements of the Privacy Rule Subpart E that apply to DOM the covered entity in the performance of such obligationobligation(s).
r. i) Business Associate agrees to make its internal practices, books, and records, including policies and procedures, records available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310HIPAA Rules.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to shall not Use use or Disclose disclose PHI other than as permitted or required by the Service Agreement under this Agreement, or as Required by Law.
b. . • Business Associate shall use appropriate administrative, physical and technical safeguards and comply with the applicable requirements of Subpart C of 45 C.F.R. Part CFR § 164 with respect to electronic E-PHI (ePHI) to prevent Use the use or Disclosure disclosure of PHI other than as provided for by herein. • Business Associate shall comply with the applicable requirements of Subpart E of 45 CFR § 164. To the extent that Business Associate, in providing the Services, is carrying out one or more of Covered Entity’s obligations under Subpart E of 45 CFR § 164, Business Associate shall comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligations. • Business Associate shall ensure that any Subcontractors that create, receive, maintain or transmit PHI on behalf of Business Associate agree to comply with the applicable requirements of Subpart C and Subpart E of 45 CFR § 164, and that each Subcontractor enters into a business associate agreement with Business Associate under which each Subcontractor agrees to the same restrictions and conditions that apply to Business Associate under this Agreement.
c. . • Business Associate agrees shall report to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of Covered Entity any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any successful Security Incident of which it becomes aware.
d. , including any Breach of Unsecured PHI as required by 45 CFR § 164.410. Business Associate agrees shall report to Covered Entity any Breach of Unsecured PHI (other than a successful Security Incident as set forth immediately above) as soon as reasonably practicable after Business Associate’s discovery (as such term is used and defined under HIPAA) but in no event later than such timeframe as required under 45 CFR § 164.410. • Business Associate shall include in any report required under Section 4(a)(v) immediately above, to the extent possible, (A) a description of and details concerning the Security Incident or Breach, including the date of discovery by Business Associate (B) the identification of each individual whose PHI has been, or is reasonably believed to have been, the subject of the Breach, (C) a description of the Business Associate’s investigation into the incident, including mitigating actions taken by Business Associate to mitigate harm to affected individuals and protect against further breach; (D) contact information for the individual within Business Associate’s organization most knowledgeable about the incident and who is responsible for coordinating efforts with Covered Entity with respect to same, and (E) such other available information, as requested by Covered Entity, which Covered Entity may be required to include in any required notifications to the affected individuals. • Business Associate shall mitigate, to the extent practicable, any harmful effect that is known to Business Associate of (A) a Use successful Security Incident, (B) a Breach of Unsecured PHI, and (C) a use or Disclosure disclosure of PHI by Business Associate or its employees or agents, including any Subcontractors, in Violation violation of the requirements of this Agreement Agreement. Further, Business Associate shall reasonably cooperate and take prompt steps to prevent coordinate with Covered Entity in the recurrence investigation of any Incidentviolation of the requirements of this Agreement, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of successful Security Incident or any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and • Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, access to PHI in a Designated Record Set, Set to DOM Covered Entity or, as directed by XXXCovered Entity, to an Individual individual in order to meet the requirements under 45 CFR § 164.524.
m. . • Business Associate agrees to shall make any amendment(s) amendments to PHI in a Designated Record Set that DOM Covered Entity directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. 164.526. • Business Associate agrees shall make available to document such Disclosures of PHI and Covered Entity information related required to such Disclosures as would be required for DOM to respond to a request by an Individual for provide an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528. • Business Associate agrees shall make internal practices, books and records relating to retain such documentation for at least six (6) years after the date use and disclosure of disclosure PHI received from, or provide a full accounting and relevant documentation to DOM at the time of termination.
o. created or received by Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, Covered Entity available to the Secretary for purposes of determining Business AssociateCovered Entity’s and/or DOM's or the Secretary’s determination of the Parties’ compliance with HIPAA. • If the Privacy Rule pursuant scope of Services includes electronic transactions, Business Associate shall satisfy all applicable provisions of the HIPAA standards for electronic transactions and code sets, also known as the Electronic Data Interchange (EDI) Standards, codified at 45 C.F.R. Part 162. Business Associate further agrees to ensure that any Subcontractor that conducts standard transactions, as such term is defined at 45 C.F.R. § 160.310162.103, on its behalf will comply with the EDI standards.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. (a) Business Associate agrees to not Use use or Disclose PHI disclose Protected Health Information other than as permitted or required by the Service Agreement Section 3.0 of this Agreement, or as Required by Law. This Agreement does not authorize Business Associate to use or disclose Protected Health Information in any manner that will violate the Privacy Rule if done by Covered Entity, except as permitted for Business Associate’s proper management or administration as described herein.
b. (b) Business Associate shall agrees to use appropriate administrative, physical and technical safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of PHI the Protected Health Information other than as provided for by this Agreement. Business Associate will implement administrative, physical, and technical safeguards (including written policies and procedures) that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic Protected Health Information that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity as required by the Security Rule.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72c) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI Protected Health Information by Business Associate (or its agents or Subcontractors) in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsAgreement.
e. (d) Business Associate agrees to notify DOM without unreasonable delayreport to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware, and no later than seventy-two (72) hours after discovery of including any actual or suspected Breach of Unsecured PHI, all Protected Health Information as required under 45 CFR 164.410 and any Security Incident of which it becomes aware. The Breach will be treated as being discovered in accordance with 45 C.F.R. § CFR 164.410, and Business Associate will report the Breach to Covered Entity as soon as possible but in no event later than ten (10) calendar days following the discovery of the Breach unless a delay is requested by a law-enforcement official in accordance with 45 CFR 164.412. The notification Business Associate shall includeinclude in its report to the Covered Entity, the following information regarding the Breach, to the extent possible possible:
(i) The identity of each individual whose Unsecured Protected Health Information has been or is reasonably believed to have been breached;
(ii) Identify the nature of the Breach, which includes a brief description of what happened, the date of the Breach, and subsequently the date of the discovery of the Breach;
(iii) A description of the types of Unsecured Protected Health Information involved in the Breach (such as whether full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information involved);
(iv) A description of what the Business Associate is doing to investigate the Breach, mitigate harm to individuals, and to protect against any further Breaches;
(v) Identify what steps, if any, the individuals who were subject to a Breach should take to protect themselves, including any contact procedures the Business Associate will make available for individuals to ask questions or learn additional information; and
(vi) Any additional information, including written reports and risk assessment under 45 CFR 164.402, the Covered Entity may reasonably request in its discretion. Such information shall be provided by Business Associate to Covered Entity within the time specified above, however, if such information is not available at such time, Business Associate shall not delay the initial notification of the Breach to Covered Entity and shall take all reasonable steps necessary to promptly collect and provide such additional information to Covered Entity as the information becomes availableavailable in accordance with 45 CFR 164.410. To the extent that a Breach occurs as a result of the Business Associate's, the identification or one of all Individuals whose Unsecured PHI is reasonably believed by its Subcontractor’s, failure to comply with one or more of its obligations under this Agreement, Covered Entity may, upon providing written notification to Business Associate, require Business Associate to have been Breached along with any other available information that is required provide notification of a Breach applicable to be included all third parties in the satisfaction of Covered Entity’s obligations under 45 CFR §164. Upon receiving notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOMfrom Covered Entity, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, take all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident steps to ensure that any notices sent the third party Breach notifications are provided, to the satisfaction of Covered Entity, in connection a time and manner sufficient to comply with the Incident are, subject to Covered Entity’s obligations under 45 C.F.R. §164.412, sent without unreasonable delayCFR 164, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible pay for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident such Breach and preparation and delivery of notices to affected individuals and government agenciessuch required notifications.
i. With respect to an Incident, deliver to DOM within fifteen (15e) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. CFR §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure enter into a written contract with any agent or Subcontractor that any subcontractors that createcreates, receivereceives, maintainmaintains, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) transmits Protected Health Information and/or Electronic Protected Health Information on behalf of Business Associate will agree Associate, and agrees that such contract shall obligate Business Associate’s agent or Subcontractor, as applicable, to comply abide by the same restrictions and conditions with the applicable requirements respect to use and disclosure of the Security Rule and Privacy Rule by entering into a Protected Health Information as Business Associate Agreement is required to abide by and implement in accordance with this Agreement. In addition, Business Associate shall provide DOM ensure that any such agent or Subcontractor agrees to implement reasonable and appropriate safeguards to protect Covered Entity’s Protected Health Information and/or Electronic Protected Information in accordance with a copy of all such executed agreements between 45 CFR §164.308(b)(2). Furthermore, Business Associate and shall be responsible for any failure of Business Associate’s Subcontractors at least thirty (30) calendar days prior Workforce to disclosing any abide by the same restrictions and conditions with respect to use and disclosure of DOM’s PHI pursuant the Protected Health Information as Business Associate is required to said agreements abide by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of accordance with this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. (f) Business Associate agrees to provide access, at access within 10 days following the request of XXXCovered Entity to the Covered Entity (or, upon direction of Covered Entity, directly to an individual) for inspection and in copying Protected Health Information about the time and manner designated by XXX, to PHI individual in a Designated Record Set, to DOM or, as directed by XXX, to an Individual Set that is in the Business Associate’s custody or control in order for Covered Entity to meet the requirements under 45 CFR § 164.524. Effective as of the date set forth in the Final Rule, if Covered Entity requests an electronic copy of Protected Health Information, Business Associate agrees to provide an electronic copy of the Protected Health Information if such Protected Health Information is maintained electronically in a Designated Record Set in the Business Associate’s custody and control and is readily producible in such format or, if not, in a readable electronic form and format as agreed to by Covered Entity and Business Associate in order for Covered Entity to meet its electronic access obligations under 45 CFR §164.524. Business Associate shall notify Covered Entity in writing within ten (10) calendar days of Business Associate’s receipt of any such request other than from Covered Entity and shall, at Covered Entity’s request, provide Covered Entity with a copy of any Protected Health Information so accessed.
m. (g) Business Associate agrees to make any amendment(sAmendment(s) to PHI Protected Health Information in a Designated Record Set that DOM the Covered Entity or an individual directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM Covered Entity or an Individualindividual, and in a prompt and reasonable manner consistent with the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528HIPAA regulations. Business Associate agrees to retain shall notify Covered Entity in writing within ten (10) calendar days of Business Associate’s receipt of any such documentation for request other than from Covered Entity and shall, at least six (6) years after the date Covered Entity’s request, provide Covered Entity with a copy of disclosure or provide a full accounting and relevant documentation to DOM at the time of terminationany Protected Health Information so amended.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(hh) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make its internal practices, books, and records, including policies and proceduresprocedures and Protected Health Information, relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or at the request of the Covered Entity, to the Secretary in a time and manner designated by the Covered Entity or the Secretary, for purposes of the Secretary determining Business Associate’s and/or DOMCovered Entity's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310Rule. Business Associate shall immediately notify Covered Entity, in writing, upon Business Associate’s receipt of any such request and shall, at Covered Entity’s request, provide Covered Entity with a copy of any such request and any materials so accessed.
s. (i) Business Associate agrees to document disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528. Business Associate shall notify Covered Entity in writing within ten (10) calendar days of Business Associate’s receipt of any such request for an accounting, other than from Covered Entity, and shall at Covered Entity’s request, provide Covered Entity with a copy of the accounting so provided. Business Associate shall maintain documentation of disclosures of Protected Health Information for a period of at least six (6) years following the date of such disclosure.
(j) Business Associate agrees to provide to Covered Entity or an individual an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528, in a prompt and reasonable manner consistent with the HIPAA regulations.
(k) Business Associate agrees to satisfy all applicable provisions of HIPAA standards for the Electronic Transactions Rule and further agrees to ensure that any agent, including a Subcontractor, that conducts standard transactions on its behalf will comply with the Electronic Transactions rule to the extent required by law.
(l) Business Associate agrees to make reasonable efforts to limit any use, disclosure or request of Protected Health Information to the Minimum Necessary to accomplish the intended purpose of the use, disclosure or request in accordance with the Privacy Rule. Business Associate agrees that nothing the Minimum Necessary determination shall be made in accordance with Covered Entity’s Minimum Necessary policies and procedures together with applicable guidance under HITECH and the HIPAA rules.
(m) Business Associate agrees, effective as of the date of this Agreement, to not directly or indirectly receive remuneration in exchange for any Protected Health Information of an individual unless the Covered Entity obtained from the individual, in accordance with 45 CFR 164.508, a valid authorization that includes a specification of whether the Protected Health Information can be further exchanged for remuneration by the entity receiving Protected Health Information of that individual except as set forth under HITECH.
(n) Business Associate agrees to comply, and will require any agent (including Subcontractors) it employs to comply, with the applicable provisions of the Standards for Electronic Transactions Rule, and with the National Provider Identifier requirements (to the extent applicable) and any other rules or requirements established by HHS with respect to such transaction.
(o) Business Associate agrees to report on a monthly basis to Covered Entity any Security Incidents resulting from any attempted or successful (i) unauthorized access, use, disclosure, modification, or destruction of Electronic Protected Health Information, or (ii) interference with Business Associate’s information system, of which Business Associate becomes aware. Notwithstanding the foregoing, if such Security Incident resulted in a use or disclosure not permitted by this Agreement shall permit or a breach of Unsecured Protected Health Information, Business Associate to access, store, share, maintain, transmit or will report such incident as set forth in paragraph (d) above.
(p) Business Associate shall not use or disclose PHI Genetic Information for underwriting purposes in any form via any medium violation of HIPAA.
(q) To the extent Business Associate is responsible for carrying out one or more obligations of Covered Entity under Subpart E of 45 CFR Part 164, Business Associate agrees to comply with any third party, including the requirements of Subpart E that apply to Covered Entity in the performance of such obligation(s).
(r) Business Associate’s Subcontractors, beyond Associate agrees that it is directly subject to the boundaries and jurisdiction requirements of the United States without express written authorization from DOMPrivacy Rule and the Security Rule in accordance with HITECH and the Final Rule, subject to civil and criminal penalties for failure to comply with such requirements.
Appears in 1 contract
Samples: Appointment and Agent Fee Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to will:
a. not Use use or Disclose PHI disclose Protected Health Information that it receives from or on behalf of Athena or that it creates on behalf of Athena (collectively “PHI”) other than as permitted or required by the Service Agreement this Appendix, or as Required required by Law.law;
b. Business Associate shall not use or disclose PHI in a manner that would violate the requirements of the Privacy Rule when done by Athena, except as permitted by Section 3, below;
c. use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of the PHI other than as provided for by this Agreement.
c. Business Associate agrees Appendix and shall, after the compliance date of the HIPAA Final Rule, comply with the Security Rule with respect to notify DOM without unreasonable delay and no later Electronic PHI, to prevent use or disclosure of such information other than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not as provided for by the Agreement and this Agreement of which it becomes awareAppendix;
d. implement administrative, physical, and any Security Incident technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of which it becomes aware.PHI (including electronic PHI);
d. Business Associate agrees to e. mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Appendix;
f. report to Athena as soon as practicable and as required by HIPAA and the HITECH Act, as implemented by the HIPAA Omnibus Final Rule (“HIPAA Final Rule”) and any subsequent amendment thereto, or any subsequent rule or regulation interpreting or modifying HIPAA or the HITECH Act, any use or disclosure of PHI by Business Associate other than as provided for by this Agreement and take prompt steps any Security Incident (as defined in the Security Rule) with respect to prevent the recurrence electronic PHI;
g. upon discovery of any IncidentBreach involving Unsecured PHI, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM Athena of that Breach without unreasonable delay; provided, however, that the parties acknowledge and agree that this Section constitutes notice by Business Associate to Athena of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined below) for which notice to Athena by Business Associate shall be required only upon request. “Unsuccessful Security Incidents” shall include, but not be limited to, pings and other broadcast attacks on Business Associate's firewall, port scans, unsuccessful log-on attempts, denials of service, and any combination of the above, so long as no later than seventy-two such incident results in unauthorized access, use, or disclosure of PHI. Business Associate's notification to Athena shall include (72i) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall includeidentification, to the extent possible and subsequently as the information becomes availablepossible, the identification of all Individuals each individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been Breached along with accessed, used, or disclosed through the Breach; (ii) any other available information known to Business Associate that Athena is required to include in its notice to affected individuals; and (iii) any other information that is required would need to be included in Athena's accounting of disclosures under HIPAA or the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business AssociateHITECH Act, as applicable, demonstrates there is a low probability implemented by the PHI has been compromised HIPAA Final Rule and any subsequent amendment thereto or one of any subsequent rule or regulation interpreting or modifying HIPAA or the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.HITECH Act; 27
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to h. ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incidentagent, including costs associated with mitigation of the Incident and preparation and delivery of notices a subcontractor, to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate whom it provides PHI agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, restrictions and requirements conditions that apply through this Agreement to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.;
l. Business Associate agrees to i. provide access, at the request of XXX, and in the time and manner designated by XXXAthena, to PHI in a Designated Record Set, to DOM Athena or, as directed by XXXAthena, to an Individual in order to meet the requirements under 45 CFR § 164.524.;
m. Business Associate agrees to j. make any amendment(s) each amendment to PHI in a Designated Record Set that DOM Athena directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM Athena or an Individual;
k. make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary, in the a time and manner designated by XXX.the Secretary, for purposes of the Secretary determining Athena's compliance with the Privacy Rule;
n. Business Associate agrees to l. document such Disclosures disclosures of PHI and information related to such Disclosures disclosures as would be required for DOM Athena to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.;
o. Business Associate agrees to m. provide to DOM Athena or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX Athena to respond to a request by an that Individual for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528.;
n. establish and enforce appropriate clearance procedures and supervision to assure that its workforce follows requirements consistent with HIPAA;
o. act immediately and effectively to terminate access to PHI of any of its staff upon such staff member's termination or reassignment;
p. Business Associate agrees provide appropriate training for its staff to assure that it shall only use or disclose its staff complies with its obligations consistent with the minimum PHI necessary requirements of HIPAA; and
q. implement appropriate (i) disposal and reuse procedures with respect to perform functionsdocuments and equipment, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule(ii) authentication and access controls, and any minimum necessary policies and procedures communicated (iii) appropriate encryption to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply protect PHI consistent with the requirements of the Privacy Rule that apply to DOM in the performance of such obligationSecurity Rule.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use use or Disclose PHI disclose Protected Health Information other than as permitted or required by the Service this Agreement or as Required by By Law.
b. , or if such use or disclosure does not otherwise cause a Breach of Unsecured Protected Health Information. Business Associate agrees that 45 CFR §§ 164.308, 164.310, 164.312, and 164.316 shall apply to Business Associate in the same manner that such sections apply to Covered Entity, and that Business Associate shall use appropriate administrative, physical, and technical safeguards and comply in compliance with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) the Security Rule, to prevent Use use or Disclosure disclosure of PHI the Protected Health Information other than as provided for by this Agreement.
c. . Business Associate shall ensure that all Protected Health Information is Secured. The written policies and procedures and documentation required by 45 CFR § 164.316 shall be made available to Covered Entity, upon Covered Entity’s request. Business Associate shall comply with all the obligations required of a Business Associate under the HITECH Act. The additional requirements of the HITECH Act that relate to privacy and security and that are made applicable with respect to covered entities shall also be applicable to Business Associate and shall be and by this reference hereby are incorporated into this Agreement. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to promptly mitigate, to the extent practicableRequired by Law with respect to Business Associate, any harmful effect that is known to Business Associate as a result of a Use use or Disclosure disclosure of PHI Protected Health Information by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence Agreement, or that would otherwise cause a Breach of any Incident, including any action required by applicable federal and state laws and regulations.
e. Unsecured Protected Health Information. Business Associate agrees to notify DOM without unreasonable delayimmediately report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement. Business Associate agrees, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §CFR § 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees ) to ensure that any subcontractors that createagent, receiveincluding Subcontractors, maintainto whom it provides Protected Health Information in any form, including electronic form, created, maintained, transmitted, or transmit protected health information received by Business Associate from or on behalf of the Business Associate agree Covered Entity agrees in writing to the same restrictions, conditions, and requirements that apply through to Business Associate with respect to such information. Moreover, Business Associate agrees to shall ensure that any Subcontractors that createsuch agent or Subcontractor agrees to implement reasonable and appropriate safeguards to protect the Covered Entity’s Protected Health Information. Notwithstanding anything to the contrary in the Primary Agreement or this BAA, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy not use any agent or Subcontractor to perform any service requiring access to Protected Health Information without the express written consent of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any an authorized representative of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this AgreementCovered Entity. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide prompt access, at the request of XXX, and in the time and manner designated by XXX, Covered Entity to PHI Protected Health Information in a Designated Record Set, to DOM Covered Entity, or, as if directed by XXXCovered Entity, to an Individual Individual, in order to meet the requirements under 45 CFR § 164.524.
m. . If an Individual requests directly from Business Associate (i) to inspect or copy his or her Protected Health Information, or (ii) requests its disclosure to a third party, the Business Associate shall promptly notify Covered Entity in writing of such request. Business Associate also agrees to comply with an Individual’s request to restrict the disclosure of his or her personal Protected Health Information in a manner consistent with 45 CFR § 164.522, except where such use, disclosure or request is required or permitted under applicable law. Business Associate further agrees that when requesting, using or disclosing Protected Health Information in accordance with 45 CFR § 502(b)(1) that such request, use or disclosure shall be to the minimum extent necessary, including the use of a “limited data set” as defined in 45 CFR § 164.514(e)(2), to accomplish the intended purpose of such request, use or disclosure, as interpreted under related guidance issued by the Secretary from time to time. Business Associate agrees to promptly make any amendment(s) to PHI Protected Health Information in a Designated Record Set that DOM the Covered Entity directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and Covered Entity in the time and manner designated as mutually agreed by XXX.
n. the parties, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR § 164.526. Business Associate agrees to make its internal practices, books, and records, including its policies and procedures, relating to the use and disclosure of Protected Health Information and Breach of any Unsecured Protected Health Information created, transmitted, or received by Business Associate from or on behalf of Covered Entity, available to Covered Entity or the Secretary, in a time and manner designated by Covered Entity or the Secretary, for purposes of Covered Entity or the Secretary determining compliance with the Privacy Rule. Business Associate agrees to account for and document such Disclosures disclosures of PHI Protected Health Information, Breaches of Unsecured Protected Health Information, and information related to such Disclosures disclosures as would be required for DOM Covered Entity to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI Protected Health Information in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to promptly provide to DOM Covered Entity or an Individual, in a time and manner designated by DOM, Individual information collected in accordance with section (III)(hSection 2(j) of this AgreementBAA, to permit XXX Covered Entity to respond to a request by an Individual or the Secretary for an accounting of disclosures of Protected Health Information and Breaches of Unsecured Protected Health Information. To the extent that Business Associate is to carry out one or more of Covered Entity’s obligation(s) under Subpart E of 45 CFR Part 164, Business Associate agrees to comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such obligation(s). Business Associate hereby represents and warrants that to the extent it is transmitting a financial or administrative transaction described in the Regulations (each a “Transaction”) for Covered Entity, the format and structure of such transmissions shall be in compliance with the Transaction Standards. With respect to any such Transactions, neither party shall: (i) change the definition, data, condition, or use of a data element or segment in a Transaction Standard; (ii) add any data elements or segments to the maximum defined data set; (iii) use any code or data elements that are either marked “not used” in the Transaction Standard’s implementation specification or are not in the Transaction Standard’s implementation specification(s); or (iv) change the meaning or intent of the Transaction Standard’s implementation specification(s). With respect to Electronic Protected Health Information, Business Associate will: Implement, in compliance with the requirements of the Security Rule, administrative, physical, and technical safeguards to reasonably and appropriately protect the confidentiality, integrity, and availability of the Electronic Protected Health Information it creates, transmits, maintains, or receives from or on behalf of Covered Entity; Ensure that any agent, including a Subcontractor, to whom Business Associate provides Electronic Protected Health Information agrees in writing to implement reasonable and appropriate safeguards to protect such information in compliance with the Security Rule; Business Associate acknowledges that, effective on the Effective Date of this BAA, (x) the foregoing safeguards, policies and procedures requirements shall apply to Business Associate in the same manner that such requirements apply to Covered Entity, and (y) Business Associate shall be liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. 1320d-5 and 1320d-6, as amended from time to time, for failure to comply with the safeguards, policies and procedures requirements and any guidance issued by the Secretary from time to time with respect to such requirements; Report to Covered Entity any Security Incident of which Business Associate becomes aware, including any failure of safeguards or unauthorized access to Electronic Protected Health Information. Business Associate agrees to account for and document any disclosure of Protected Health Information used or maintained as Electronic Protected Health Information and Breaches of Unsecured Protected Health Information in electronic form in a manner consistent with 45 CFR § 164.528 as would be required for Covered Entity to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI Protected Health Information. Business Associate agrees to promptly provide to Covered Entity, or an Individual, information collected in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use this paragraph, to permit Covered Entity to respond to a request by an Individual or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service AgreementsSecretary for an accounting of disclosures of Protected Health Information and Breaches of Unsecured Protected Health Information. Business Associate agrees to comply with the “Prohibition on Sale of Electronic Health Records or Protected Health Information,” as provided in section 13405(d) of Subtitle D (Privacy) of the HITECH Act, and the “Conditions on Certain Contacts as Part of Health Care Operations,” as provided in section 13406 of Subtitle D (Privacy) of the HITECH Act and related guidance issued by the Secretary from time to time. Business Associate acknowledges that, effective on the Effective Date of this BAA, it shall be liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. 1320d-5 and 1320d-6, as amended, for failure to comply with any of the use and disclosure requirements of this BAA and any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, from time to time with respect to such use and any minimum necessary policies and procedures communicated to Business Associate by DOMdisclosure requirements.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Professional Information Technology Consulting Services Agreement
Obligations and Activities of Business Associate. a. 2.1 Business Associate acknowledges that it is directly subject to the Security Rule and to certain portions of the Privacy Rule and will maintain the compliance documentation required under the HIPAA Rules and Regulations. For purposes of HIPAA, Business Associate is not an agent of Covered Entity. Business Associate agrees to not Use to:
2.1.1 Not use or Disclose disclose PHI other than as permitted or required by the Service under this Agreement or as Required by Law.
b. Business Associate shall use 2.1.2 Use appropriate safeguards safeguards, and comply with Subpart C of 45 C.F.R. CFR Part 164 with respect to electronic PHI (ePHI) PHI, to prevent Use use or Disclosure disclosure of the PHI other than as provided for by this Agreement.
c. Business Associate agrees 2.1.3 Report in writing to notify DOM Covered Entity without unreasonable delay and in no case later than seventy-two (72) hours 5 business days after discoverydiscovery any acquisition, access, use or disclosure of any Use or Disclosure of the PHI not provided for by this Agreement of which it becomes aware, including breaches of unsecured PHI as required at 45 CFR 164.410. Business Associate shall fully cooperate with Covered Entity in investigating the potential or actual breach, disclosure or inappropriate access and in meeting Covered Entity’s obligations under the HITECH Act and any other state or federal privacy or security breach notification laws, including, without limitation, assisting the Covered Entity with performing a risk assessment as set forth in 45 C.F.R. §164.402(2) and providing any information and documentation related to such risk assessment to the Covered Entity promptly upon request.
2.1.4 Report in writing to Covered Entity without unreasonable delay and in no case later than 5 business days after discovery any Security Incident of which it becomes aware.
d. . Business Associate agrees to shall mitigate, to the extent practicable, any harmful effect that is known to Business Associate of from a Use or Disclosure of PHI by Business Associate in Violation of Security Incident. Notwithstanding the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes availableforegoing, the identification of all Individuals whose Unsecured PHI is reasonably believed Parties acknowledge and agree that this Section constitutes notice by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one Covered Entity of the exceptions ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined herein) for which no additional notice to the definition of Breach appliesCovered Entity shall be required. “Unsuccessful Security Incidents” include, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperatebut are not limited to, coordinate with, pings and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to other broadcast attacks on Business Associate’s conduct firewall, port scans, unsuccessful log-on attempts, denials of service, and any combination of the above, so long as no such incident results in unauthorized access, use, or status as a business associate for DOM, regardless disclosure of whether DOM and/or Business Associate are named as parties to such Actionselectronic PHI.
k. 2.1.5 In accordance with 45 C.F.R. §§ CFR 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to if applicable, ensure that any subcontractors and agents that create, receive, maintain, or transmit protected health information PHI on behalf of the Business Associate on behalf of Covered Entity agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic information and do not store PHI (ePHI) on behalf of Business Associate will agree to comply with beyond the applicable requirements borders of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy United States of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior America. Remote access to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at data stored within the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including borders of the use United States of such Subcontractors or America is allowed as long as appropriate HIPAA technical controls are utilized. These controls must be approved by the UAB Health System Information Services (HSIS) Information Security Team. Printing of PHI beyond the borders of the adequacy United States of such agreementsAmerica is not allowed.
l. Business Associate agrees 2.1.6 Within five (5) business days of a request by Covered Entity or the Secretary, make available PHI in a Designated Record Set to provide accessCovered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.524, at the request of XXX, and in the time and manner designated by XXX, as well as make any amendments to PHI in a Designated Record SetSet (and incorporate any amendments, to DOM or, if required) as directed or agreed to by XXX, to an Individual the Covered Entity in order to meet the requirements under 45 CFR § 164.524164.526.
m. 2.1.7 Within five (5) business days of a request by Covered Entity or the Secretary, make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received or transmitted or maintained by Business Associate agrees on behalf of Covered Entity, to make any amendment(s) to PHI the Secretary, in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Covered Entity or the Secretary, for purposes of the Secretary determining Covered Entity's or Business Associate’s compliance with the HIPAA Rules and Regulations. In the event such a request comes directly from the Secretary, Business Associate agrees to document notify Covered Entity promptly of such Disclosures request.
2.1.8 Document such disclosures of PHI and information related to such Disclosures disclosures as would be required for DOM Covered Entity to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees 2.1.9 Provide to provide to DOM Covered Entity or an Individual, in a time and manner designated by DOMCovered Entity, information collected in accordance with section (III)(h) of this Agreementsection, to permit XXX Covered Entity to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose 2.1.10 Comply with the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations requirements under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligationHIPAA Rules.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Hipaa Business Associate Agreement
Obligations and Activities of Business Associate. To the extent Business Associate receives PHI on behalf of Covered Entity, Business Associate agrees to maintain the privacy and security of such PHI as set out herein and as required by the HIPAA Rules. Further
a. Business Associate agrees not to not Use use or Disclose disclose PHI other than as permitted or required by the Service Agreement or as Required by By Law.
b. Business Associate shall agrees to use appropriate safeguards and comply with Subpart subpart C of 45 C.F.R. Part CFR part 164 with respect to electronic PHI (ePHI) protected health information, to prevent Use use or Disclosure disclosure of the PHI other than as provided for by this Agreement.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement.
d. Business Associate agrees to report to Covered Entity any use or disclosure of the PHI not provided for by this Agreement and take prompt steps to prevent the recurrence of any Incidentwhich it becomes aware, including breaches of unsecured PHI as required at 45 CFR 169.410 and any action required by applicable federal and state laws and regulationssecurity incident of which it becomes aware.
e. Business Associate agrees to notify DOM without unreasonable delayensure that any agent, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall includeincluding a subcontractor, to the extent possible and subsequently as the information becomes availablewhom it provides PHI received from, the identification of all Individuals whose Unsecured PHI is reasonably believed or created or received by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree Covered Entity agrees to the same restrictions, conditions, restrictions and requirements conditions that apply through this Agreement to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. f. Business Associate agrees to make internal practices, books, and records, including policies and procedures, relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of, Covered Entity available to the Secretary Covered Entity, or to the Secretary, in a time and manner (within30 calendar days following written request from Covered Entity) or designated by the Secretary, for purposes of the Secretary determining Business Associate’s and/or DOMCovered Entity's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310HIPAA Rules.
s. g. Business Associate agrees that nothing to document such disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in this Agreement shall permit accordance with 45 CFR 164.528.
h. Business Associate agrees to accessprovide to Covered Entity or an Individual, storewithin 30 calendar days after written request, shareinformation collected in accordance with Section 1. g., maintainof this Agreement, transmit or use or disclose to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR 164.528.
i. Business Associate agrees to provide to Covered Entity, within 30 days of a written request, any form via any medium with any third party, including PHI in a Designated Record Set (if and to the extent one is maintained by Business Associate) as necessary to satisfy Covered Entity’s Subcontractorsobligations under 45 CFR 164.524. If an Individual makes a request for access to PHI directly to Business Associate, beyond the boundaries and jurisdiction Business Associate shall notify Covered Entity of the United States without express request within 5 days of such request and will co-operate with Covered Entity and Covered Entity shall prepare and send the response to the Individual.
j. Within 30 days of a written authorization request from DOMCovered Entity, Business Associate agrees to make any amendments to any PHI in a Designated Record Set (if and to the extent one is maintained by Business Associate) as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526. If an Individual makes a request for an amendment to PHI directly to Business Associate, Business Associate shall notify Covered Entity of the request within 5 business days of such request and will co-operate with Covered Entity and Covered Entity shall prepare and send the response to the Individual.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use use or Disclose PHI disclose Protected Health Information other than as permitted or required by the Service this Agreement or as Required by By Law.
b. Business Associate shall agrees use appropriate safeguards and comply comply, where applicable, with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) Electronic Protected Health Information, to prevent Use use or Disclosure disclosure of PHI the Protected Health Information other than as provided for by this Agreement.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, report to the Covered Entity any use or disclosure of any Use or Disclosure of PHI Protected Health Information not provided for by this Agreement Agreement, including, without limitation, Breaches of which it becomes awareUnsecured Protected Health Information as required at 45 C.F.R. 164.410, and any Security Incident of which it becomes aware.
d. . The parties acknowledge and agree that this Section 2(c) constitutes notice by Business Associate agrees to mitigateCovered Entity of the ongoing existence and occurrence of attempted but unsuccessful Security Incidents for which no additional notice to Covered Entity shall be required. Unsuccessful Security Incidents shall include, but not be limited to, pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as such incidents do not result, to the extent practicable, any harmful effect that is known to Business Associate is aware, in unauthorized access, use or disclosure of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsElectronic Protected Health Information.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. d. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that createif applicable, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) Protected Health Information on behalf of Business Associate will agree in writing to comply with the applicable same restrictions, conditions, and requirements of the Security Rule and Privacy Rule by entering into a that apply to Business Associate under this Agreement and Business Associate shall provide DOM with a copy of all respect to such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreementsProtected Health Information.
l. e. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI make available Protected Health Information in a Designated Record Set, Set to DOM or, Covered Entity as directed by XXX, necessary to an Individual in order to meet the requirements satisfy Covered Entity’s obligations under 45 CFR C.F.R. § 164.524.
m. f. Business Associate agrees to make any amendment(s) to PHI Protected Health Information in a Designated Record Set that DOM directs as directed or agrees agreed to by the Covered Entity pursuant to 45 CFR C.F.R. § 164.526 at the request of DOM 164.526, or an Individual, and in the time and manner designated by XXXtake other measures as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. § 164.526.
n. g. Business Associate agrees to document such Disclosures of PHI maintain and make available the information related required to such Disclosures as would be required for DOM to respond to a request by an Individual for provide an accounting of Disclosures of PHI in accordance with disclosures to Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR C.F.R. § 164.528.
p. h. To the extent that Business Associate agrees that it shall only use is to carry out one or disclose the minimum PHI necessary to perform functionsmore of Covered Entity’s obligations under Subpart E of 45 C.F.R. Part 164, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule Subpart E that apply to DOM Covered Entity in the performance of such obligationobligations.
r. i. Business Associate agrees to make its internal practices, books, and records, including policies and procedures, records available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310HIPAA.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. a) Business Associate agrees to comply with those provisions of the Security Rule that are set forth at 45 C.F.R. §§ 164.308, 164.310, 164.312, and 164.316, as amended from time to time, with respect the security of PHI, in the same manner that such regulations apply to the Provider.
b) Business Associate agrees to comply with the Privacy Rule at 45 C.F.R. § 164.504(e), as amended from time to time, with respect to its use and disclosure of PHI, in the same manner that such regulation applies to Provider. The additional requirements of the HITECH Act that relate to privacy and that are made applicable with respect to covered entities shall also be applicable to Business Associate and shall be and by this reference hereby are incorporated into the Business Associate Agreement.
c) Business Associate agrees to not Use use or Disclose further disclose PHI other than as specifically permitted or required by the Service this Agreement or as Required required by Lawlaw.
b. d) Business Associate shall agrees to use appropriate safeguards and comply comply, where applicable, with Subpart C of 45 C.F.R. CFR Part 164 with respect to electronic PHI (ePHI) Electronic PHI, to prevent Use use or Disclosure disclosure of PHI other than as provided for by this Agreement.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72e) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsAgreement.
e. f) Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery report to Provider if it becomes aware of any actual use or suspected disclosure of PHI not provided for by this Agreement, including any Breach of Unsecured PHIPHI as required by 45 CFR 164.410, all in accordance with 45 C.F.R. § 164.410and any Security Incident of which it becomes aware. The notification shall include, Notwithstanding anything herein to the extent possible and subsequently as the information becomes availablecontrary, the identification of all Individuals whose Unsecured PHI is reasonably believed by parties acknowledge and agree that this Agreement shall constitute notice to Provider that Business Associate may periodically experience broadcast attacks on its firewall, port scans, unsuccessful log-on attempts, denials of service and similar unsuccessful security incidents, and Business Associate need not further report such incidents to have been Breached along with any other available information that is required to be included Provider so long as such incidents do not result in the notification to the Individualunauthorized access, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410use or disclosure of PHI.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10g) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will on behalf of Provider agree to comply with the applicable requirements of the Security Rule same restrictions and Privacy Rule by entering into a conditions that apply to Business Associate Agreement and Business Associate shall provide DOM with a copy respect to such information, including, without limitation, implementation of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior appropriate safeguards to disclosing any protect the security of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreementsElectronic PHI.
l. h) Upon the written request of Provider, Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, access to Provider to PHI that Business Associate maintains in a Designated Record SetSet (if in fact its arrangements with Provider require Business Associate to maintain Designated Record Sets on behalf of Provider), to DOM or, as directed by XXX, to an Individual in order for Provider to meet the Patient access and copying requirements under 45 CFR § 164.524. If Business Associate maintains an electronic health record which contains the PHI, Business Associate shall provide such information produced in accordance with this section 2(h) in electronic format to enable Provider to fulfill its obligations under applicable regulations.
m. i) Upon the written request of Provider, Business Associate agrees to make any amendment(s) to PHI that Business Associate maintains in a Designated Record Set (if in fact its arrangements with Provider require Business Associates to maintain Designated Record Sets on behalf of Provider), that DOM the Provider directs or agrees to pursuant to 45 CFR § 164.526 164.526.
j) Business Associate agrees to make its internal practices, books and records relating to the use and disclosure of PHI available at the request of DOM the Provider to the Secretary, for purposes of determining Provider’s compliance with the Privacy Rule, subject to attorney-client or an Individual, and in the time and manner designated by XXXother applicable legal privileges.
n. k) Business Associate agrees to document such Disclosures disclosures of PHI and information related to such Disclosures disclosures as would be required for DOM Provider to respond to a request by an Individual Patient for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees , as may be amended from time to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of terminationtime.
o. l) Upon written request of Provider, Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, Provider with information collected in accordance with section (III)(h) Section II.i. of this Agreement, Agreement to permit XXX Provider to respond to a request by an Individual Patient for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. m) Business Associate agrees that to the extent that Business Associate carries it is to carry out DOMProvider’s obligations obligation under the Privacy Rule, Business Associate Rule that it will comply with the requirements of the Privacy Rule that apply to DOM Provider in the performance of such obligation.
r. n) Business Associate agrees to make internal practicesnotify Provider without unreasonable delay, books, and records, including policies and procedures, available but in no event more than 60 days after Business Associate becomes aware of an unauthorized use or disclosure by or on behalf of Business Associate which constitutes a Breach of Unsecured PHI unless it receives a request to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule delay such notification from a law enforcement official pursuant to 45 C.F.R. § 160.310CFR 164.412. Such notification shall include a list of impacted Patients, and describe the Breach in such reasonable detail.
s. o) Upon written request of Provider, Business Associate agrees will comply with a Patient request for restriction of certain disclosures to health plans in accordance with 45 CFR 164.522 and the HITECH Act, if the disclosure is to a health care plan for the purposes of carrying out payment or health care operations and the PHI pertains solely to a health care item or service for which Patient has paid for out of pocket in full. Except to the extent that nothing in this Agreement shall permit Provider must agree to a Patient request for restriction under the HITECH Act, Business Associate shall not be required to access, store, share, maintain, transmit or comply with a Patient’s request to restrict the use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction disclosure of the United States without express written authorization from DOMPHI.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to not Use or Disclose PHI other than as permitted or required by the Service Services Agreement, this Agreement or as Required by By Law.
b. Business Associate shall agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent the Use or Disclosure of PHI other than as provided for by this Agreement. Business Associate further agrees to implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of any electronic PHI, as provided for in the Security Rule and as mandated by Section 13401 of the HITECH Act.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement. Business Associate further agrees to report to Covered Entity any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsin a manner as prescribed in this Agreement.
e. d. Business Associate agrees to notify DOM without unreasonable delayreport to Covered Entity any Security Incident, and no later than seventy-two (72) hours after discovery including all data Breaches or compromises, whether internal or external, related to Covered Entity’s PHI, whether the PHI is secured or unsecured, of any actual which Business Associate becomes aware. For purposes of this Security Incident reporting requirement, the term “Security Incident” shall not include inconsequential incidents that occur on a daily basis, such as scans, “pings” or suspected Breach of other unsuccessful attempts to penetrate computer networks or servers containing electronic PHI maintained by Business Associate.
e. If the Breach, as discussed in paragraph 2(d), pertains to Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, then Business Associate agrees to provide a written assessment report any such data Breach to determine whether the incident is reportable Covered Entity within ten (10) working daysbusiness days of discovery of the Breach; all other compromises, or attempted compromises, of PHI must be reported to Covered Entity within twenty (20) business days of discovery. An impermissible Use or Disclosure Business Associate further agrees, consistent with Section 13402 of protected health the HITECH Act, to provide Covered Entity with information is presumed necessary for Covered Entity to meet the requirements of the HITECH Act, and in a manner and format to be specified by Covered Entity.
f. If Business Associate is an Agent of Covered Entity, then Business Associate agrees that any Breach of Unsecured PHI will be reported to Covered Entity immediately after the Business Associate becomes aware of the Breach, and under no circumstances later than one (1) business day after the Breach. Business Associate further agrees that any compromise, or attempted compromise, of PHI, other than a Breach unless of Unsecured PHI as specified in 2(e) of this Agreement, must be reported to Covered Entity within ten (10) business days of discovering the DOM compromise, or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410attempted compromise.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident areSubcontractor, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. whom Business Associate provides PHI, agrees to be solely responsible for all costs substantially the same restrictions and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to conditions that apply through this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate further agrees that restrictions and conditions analogous to those contained in this Agreement will be imposed on the Subcontractors via a written agreement that complies with all the requirements specified in §164.504(e)(2), and that Business Associate may only provide the Subcontractors PHI consistent with Section 13405(b) of the HITECH Act. Further, Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements provide copies of the Security Rule and Privacy Rule by entering into written agreements to Covered Entity within ten (10) business days of a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business AssociateCovered Entity’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a request for the written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. h. Business Associate agrees to provide access, at the request of XXX, Covered Entity and in the time and manner designated by XXXduring normal business hours, to PHI in a Designated Record Set, to DOM or, as directed by XXX, Set to an Individual Individual, in order to meet the Covered Entity’s requirements under 45 CFR § §164.524, provided that Covered Entity delivers to Business Associate a written notice at least three (3) business days in advance of requesting such access. Business Associate further agrees, in the case where Business Associate controls access to PHI in an Electronic Health Record, or controls access to PHI stored electronically in any format, to provide similar access in order for Covered Entity to meet its requirements under the HIPAA Rules and under Section 13405(c) of the HITECH Act. These provisions do not apply if Business Associate and its employees or Subcontractors have no PHI in a Designated Record Set of Covered Entity.
m. i. Business Associate agrees to make any amendment(s) amendments to PHI in a Designated Record Set that DOM Covered Entity directs or agrees to pursuant to 45 CFR § 164.526 §164.526, at the request of DOM Covered Entity or an Individual, . This provision does not apply if Business Associate and in the time and manner designated by XXXits employees or Subcontractors have no PHI from a Designated Record Set of Covered Entity.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request j. Unless otherwise protected or prohibited from discovery or disclosure by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individuallaw, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and proceduresprocedures (collectively “Compliance Information”), relating to the Use or Disclosure of PHI and the protection of PHI, available to the Covered Entity or to the Secretary for purposes of the Secretary determining Covered Entity’s compliance with the HIPAA Rules and the HITECH Act. Business Associate further agrees, at the request of Covered Entity, to provide Covered Entity with demonstrable evidence that its Compliance Information ensures Business Associate’s and/or DOM's compliance with this Agreement over time. Business Associate will have a reasonable time within which to comply with requests for such access or demonstrable evidence, consistent with this Agreement. In no case may access, or demonstrable evidence, be required in less than five (5) business days after Business Associate’s receipt of such request, unless otherwise designated by the Privacy Rule pursuant to 45 C.F.R. § 160.310Secretary.
s. k. Business Associate agrees that nothing to maintain necessary and sufficient documentation of Disclosures of PHI as would be required for Covered Entity to respond to a request by an Individual for an accounting of such Disclosures, in accordance with 45 CFR §164.528.
l. On request of Covered Entity, Business Associate agrees to provide to Covered Entity documentation made in accordance with this Agreement to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. §164.528. Business Associate shall provide the documentation in a time, manner, and format consistent with Florida law and policy applicable to Covered Entity as well as 45 C.F.R. §164.528.
m. Except as provided for in this Agreement shall permit Agreement, in the event Business Associate to receives an access, storeamendment, shareaccounting of disclosure, maintainor other similar request directly from an Individual, transmit Business Associate shall redirect the Individual to the Covered Entity.
n. To the extent that Business Associate carries out one or use more of Covered Entity’s obligations under the HIPAA Rules, the Business Associate must comply with all requirements of the HIPAA Rules that would be applicable to the Covered Entity. Business Associate must honor all restrictions required by 45 C.F.R. §164.522 that the Covered Entity or disclose PHI in any form via any medium with any third partythe Individual makes the Business Associate aware of, including Business Associatethe Individual’s Subcontractorsright to restrict certain disclosures of PHI to a health plan where the individual pays out of pocket in full for the healthcare item or service, beyond the boundaries and jurisdiction in accordance with Section 13405(a) of the United States without express written authorization from DOMHITECH Act.
Appears in 1 contract
Samples: Hipaa Business Associate Agreement
Obligations and Activities of Business Associate. a. Business Associate agrees to will: a. not Use use or Disclose PHI disclose Protected Health Information that it receives from or on behalf of Athena or that it creates on behalf of Athena (collectively “PHI”) other than as permitted or required by the Service Agreement this Appendix, or as Required required by Law.
law; b. Business Associate shall not use or disclose PHI in a manner that would violate the requirements of the Privacy Rule when done by Athena, except as permitted by Section 3, below; c. use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of the PHI other than as provided for by this Agreement.
c. Business Associate agrees Appendix and shall, after the compliance date of the HIPAA Final Rule, comply with the Security Rule with respect to notify DOM without unreasonable delay and no later Electronic PHI, to prevent use or disclosure of such information other than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not as provided for by the Agreement and this Agreement of which it becomes awareAppendix; d. implement administrative, physical, and any Security Incident technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of which it becomes aware.
d. Business Associate agrees to PHI (including electronic PHI); e. mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Appendix; f. report to Athena as soon as practicable and as required by HIPAA and the HITECH Act, as implemented by the HIPAA Omnibus Final Rule (“HIPAA Final Rule”) and any subsequent amendment thereto, or any subsequent rule or regulation interpreting or modifying HIPAA or the HITECH Act, any use or disclosure of PHI by Business Associate other than as provided for by this Agreement and take prompt steps any Security Incident (as defined in the Security Rule) with respect to prevent the recurrence electronic PHI; g. upon discovery of any IncidentBreach involving Unsecured PHI, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM Athena of that Breach without unreasonable delay; provided, however, that the Parties acknowledge and agree that this Section constitutes notice by Business Associate to Athena of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined below) for which notice to Athena by Business Associate shall be required only upon request. “Unsuccessful Security Incidents” shall include, but not be limited to, pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service, and any combination of the above, so long as no later than seventy-two such incident results in unauthorized access, use, or disclosure of PHI. Business Associate’s notification to Athena shall include (72i) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall includeidentification, to the extent possible and subsequently as the information becomes availablepossible, the identification of all Individuals each individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been Breached along with accessed, used, or disclosed through the Breach; (ii) any other available information known to Business Associate that Athena is required to include in its notice to affected individuals; and (iii) any other information that is required would need to be included in Athena’s accounting of disclosures under HIPAA or the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business AssociateHITECH Act, as applicable, demonstrates there is a low probability implemented by the PHI has been compromised HIPAA Final Rule and any subsequent amendment thereto or one of any subsequent rule or regulation interpreting or modifying HIPAA or the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to HITECH Act; h. ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incidentagent, including costs associated with mitigation of the Incident and preparation and delivery of notices a subcontractor, to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate whom it provides PHI agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, restrictions and requirements conditions that apply through this Agreement to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to ; i. provide access, at the request of XXX, and in the time and manner designated by XXXAthena, to PHI in a Designated Record Set, to DOM Athena or, as directed by XXXAthena, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. Business Associate agrees to ; j. make any amendment(s) each amendment to PHI in a Designated Record Set that DOM Athena directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM Athena or an Individual; 29 k. make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary, in the a time and manner designated by XXX.
n. Business Associate agrees to the Secretary, for purposes of the Secretary determining Athena’s compliance with the Privacy Rule; l. document such Disclosures disclosures of PHI and information related to such Disclosures disclosures as would be required for DOM Athena to respond to a request by an Individual for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to ; m. provide to DOM Athena or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX Athena to respond to a request by an that Individual for an accounting of Disclosures disclosures of PHI in accordance with 45 CFR § 164.528.
; n. establish and enforce appropriate clearance procedures and supervision to assure that its workforce follows requirements consistent with HIPAA; o. act immediately and effectively to terminate access to PHI of any of its staff upon such staff member’s termination or reassignment; p. Business Associate agrees provide appropriate training for its staff to assure that it shall only use or disclose its staff complies with its obligations consistent with the minimum PHI necessary requirements of HIPAA; and q. implement appropriate (i) disposal and reuse procedures with respect to perform functionsdocuments and equipment, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule(ii) authentication and access controls, and any minimum necessary policies and procedures communicated (iii) appropriate encryption to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply protect PHI consistent with the requirements of the Privacy Rule that apply to DOM in the performance of such obligationSecurity Rule.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Services Agreement
Obligations and Activities of Business Associate. a. Business Associate acknowledges that it shall provide products and services consistent with the Agreement.
b. Business Associate agrees to not Use use or Disclose further disclose PHI other than as permitted or required by the Service Agreement Agreement, BAA, or as Required by Law.
b. c. Business Associate shall agrees to use appropriate safeguards to prevent the unauthorized use or disclosure of PHI consistent with the HIPAA Security Rule (45 C.F.R. Part 160 and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use or Disclosure of PHI other than as provided for by this Agreement.
c. 164), including appropriate administrative, physical, and technical safeguards. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes awarewill follow generally accepted system security principles.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation of the requirements violation of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsBAA or HIPAA.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery report to Customer any use or disclosure of any actual or suspected Breach PHI not provided for by this BAA of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by which Business Associate becomes aware, including breaches of unsecured PHI and Security Incidents ("Notifying Event"). Such report must be provided to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable Customer within ten (10) working daysbusiness days of Business Associate's discovery of such Notifying Event. An impermissible Use The parties agree to cooperate in good faith to determine whether any Notifying Event constitutes a “Breach” as defined under HIPAA. Business Associate shall cooperate and coordinate with Customer to determine additional actions that may be required of Business Associate for mitigation of a Notifying Event. Business Associate otherwise agrees to comply with all applicable requirements concerning breach notification to Customer as required by HIPAA.
f. Notwithstanding the foregoing, the Parties agree to the following reporting procedure for Security Incidents that do not result in unauthorized access, use, disclosure, modification, destruction of ePHI, or Disclosure interference with system operations ("Unsuccessful Security Incidents"). For Unsuccessful Security Incidents, the Parties agree that this paragraph constitutes notice of protected health information is presumed such Unsuccessful Security Incidents. By way of example, the Parties consider the following to be illustrative of Unsuccessful Security Incidents when they do not result in actual unauthorized access, use, disclosure, modification, destruction of ePHI, or interference with system operations: (i) pings on firewall; (ii) port scans; (iii) attempts to log on to a Breach unless the DOM system or Business Associateenter a database with an invalid password or username; (iv) denial-of-service attacks that do not result in a server being taken off-line; and (v) malware (worms, as applicableviruses, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410etc.).
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident areSubcontractor to whom it provides PHI received from, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required or created or received by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree Customer, agrees to the same restrictions, conditions, restrictions and requirements conditions that apply through this BAA to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. h. Business Associate agrees to provide access, at the request of XXXCustomer, and in the a reasonable time and manner designated by XXXmanner, to PHI in a Designated Record Set, to DOM Customer or, as directed by XXXCustomer, to an Individual in order to meet the requirements under 45 CFR C.F.R. § 164.524. To the extent that such PHI is maintained in an Electronic Health Record, Business Associate agrees to produce a copy of such PHI in electronic format upon Customer's or a patient's request in accordance with HIPAA.
m. i. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM Customer directs or agrees to pursuant to 45 CFR C.F.R. § 164.526 at the request of DOM Customer or an Individual, and in the a reasonable time and manner designated by XXXmanner.
n. x. Xxxxxxxx Associate agrees to make internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of, Customer available to the Secretary for purposes of the Secretary determining Customer's compliance with HIPAA.
k. Business Associate agrees to document such Disclosures disclosures of PHI and information related to such Disclosures disclosures as would be required for DOM Customer to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting disclosures and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM Customer or an Individual, in a reasonable time and manner designated by DOMmanner, information collected in accordance with section (III)(h) of this AgreementBAA, to permit XXX Customer to respond to a request by an Individual for an accounting of Disclosures and disclosures of PHI in accordance with 45 CFR C.F.R. § 164.528.
p. l. Business Associate agrees that it shall only to use or disclose the minimum necessary PHI necessary pursuant to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. HIPAA.
m. Business Associate agrees to comply with any guidance issued by the Secretary prohibition on what constitutes “minimum necessary” for purposes the sale of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOMPHI without an Individual's authorization in accordance with HIPAA.
q. n. Business Associate agrees that to comply with the restrictions on marketing set forth in HIPAA.
o. To the extent that Business Associate carries is to carry out DOM’s obligations Customer's obligation under the Privacy RuleSubpart E of 45 C.F.R. Part 164, Business Associate will agrees to comply with the requirements of the Privacy Rule Subpart E that apply to DOM Customer in the performance of such obligation.
r. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. (a) Business Associate agrees to not Use use or Disclose further disclose PHI other than as required by law, the Agreement, or as permitted or required by the Service Agreement or as Required by Lawthis BAA.
b. (b) Business Associate shall agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) PHI, to prevent Use use or Disclosure disclosure of the PHI other than as provided for by this AgreementBAA.
c. (c) Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of report to Covered Entity any Use use or Disclosure disclosure of PHI not provided for by this Agreement BAA of which it becomes aware, including Breaches of Unsecured PHI as required at 45 C.F.R § 164.410, and any Security Incident of which it becomes aware. The Parties agree this section constitutes notice by Business Associate to Covered Entity of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined below) for which no additional notice to Covered Entity shall be required. “Unsuccessful Security Incidents” shall include, but not be limited to, pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as no such incident results in unauthorized access, use or disclosure of PHI.
d. (d) In the event of a Breach of any Unsecured PHI that Business Associate agrees accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds or uses on behalf of Covered Entity, Business Associate shall provide notice of such Breach to Covered Entity immediately, but in any event not more than 7 business days after discovering the Breach or, by exercising reasonable diligence would have discovered the Breach. Notice of a Breach shall include, to the extent known to Business Associate: (i) the identification of each individual whose PHI has been, or is reasonably believed to have been, accessed, acquired, or disclosed during the Breach, (ii) the date of the Breach, if known, (iii) a description of the types of unsecured PHI that were involved in the Breach, (iv) the scope of the Breach, (v) a description of the Business Associate’s response to the Breach, and (vi) and steps Business Associate is taking to protect against any further breaches. In the event of a Breach, Business Associate shall, in consultation with Covered Entity, mitigate, to the extent practicable, any harmful effect of such Breach that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsAssociate.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72e) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any agents and subcontractors that create, receive, maintain, or transmit protected health information PHI on behalf of the Business Associate agree to the same substantially similar restrictions, conditions, and requirements that apply to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. (f) Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. Business Associate agrees to make its internal practices, books, and records, including policies and procedures, records available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant HIPAA Regulations.
(g) Business Associate agrees to maintain and make available to Covered Entity, within ten (10) business days following a written request, information necessary to permit Covered Entity to respond to a request by an individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 160.310164.528.
s. (h) If Business Associate maintains information in a Designated Record Set, it agrees that nothing to make available to Covered Entity, within ten (10) business days following a written request, PHI in this Agreement shall permit such Designated Record Set, in order for Covered Entity to respond to individuals’ requests for access to information about them in accordance with 45 C.F.R § 164.524. If Business Associate maintains, on behalf of Covered Entity, information in an electronic Designated Record Set, Business Associate shall provide such information in the electronic format to accessCovered Entity upon request, storeor, shareif directed by the Covered Entity, maintaindirectly to a requesting individual.
(i) If Business Associate maintains information in a Designated Record Set, transmit it agrees to make any amendments or use or disclose corrections to PHI in any form via any medium such Designated Record Set within ten (10) business days following a written request by the Covered Entity in accordance with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM45 C.F.R. § 164.526.
Appears in 1 contract
Samples: Business Associate Addendum
Obligations and Activities of Business Associate. a. In order that Covered Entity and Business Associate may achieve and maintain compliance with the requirements of HIPAA, Business Associate agrees to not Use or Disclose to:
A. Not use and disclose PHI other than as permitted or required by the Service this Agreement or as Required required by Lawlaw. Business Associate agrees to review and understand the HIPAA Rules as it applies to Business Associate, and to comply with the applicable requirements of the HIPAA Rules, as well as any applicable amendments.
b. Business Associate shall use B. Use appropriate safeguards administrative, physical and technical safeguards, and comply with Subpart C of 45 C.F.R. Part CFR §164 with respect to electronic PHI (ePHI) to prevent Use or Disclosure protect the confidentiality, integrity and availability of the PHI other than as provided for by this Agreementin compliance with the Regulations.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. C. In accordance with 45 C.F.R. CFR §§ 164.502(e)(1)(ii164.502 (e) (1) (ii) and 164.308(b)(2164.308 (b) (2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, maintain or transmit protected health information PHI on behalf of the Business Associate agree to the same restrictions, conditions, conditions and requirements that apply to the Business Associate with respect to such information.
D. Notify the designated Privacy Official of the Covered Entity of any use or disclosure of PHI by Business Associate not permitted by this Agreement, any Security Incident involving electronic PHI, and any Breach of Unsecured or Secured PHI as required at 45 CFR§ 164.410 within 12 hours.
1. Business Associate shall provide the following information to Covered Entity within 10 business days of discovery of a breach except when despite all reasonable efforts by Business Associate to obtain the information required, the parties agree that circumstances beyond the control of the Business Associate necessitate additional time. Under such circumstances Business Associate shall provide to Covered Entity the following information as soon as possible and without unreasonable delay, but in no event later than 20 calendar days from the date of discovery of a breach:
a. The date of the breach;
b. The date of the discovery of the breach;
c. A description of the types of unsecured PHI that were involved;
d. Identification of each individual whose unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, or disclosed; and
e. Any other details necessary to complete a risk assessment under the presumption of breach standard.
2. Covered Entity will be responsible to provide notification to individuals whose unsecured PHI has been disclosed, as well as the Secretary and the media, as required by Sec. 13402 of the XXXXXX Xxx, 00 X.X.X.X. § 00000.
3. Business Associate shall be liable for costs of any associated mitigation if caused by the Business Associate’s acts or omissions, or the acts or omissions of Business Associate’s agents, officers, employees or subcontractors if Covered Entity determines that the breach is significant enough to warrant such measures.
4. Business Associate agrees to ensure that establish procedures to investigate the breach, mitigate losses, and protect against any Subcontractors that createfuture breaches, receive, maintain, or transmit electronic PHI (ePHI) on behalf and to provide a description of Business Associate will agree to comply with these procedures and the applicable requirements specific findings of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior investigation to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and Covered Entity in the time and manner designated reasonably requested by XXXCovered Entity and actions taken or that will be taken to mitigate the losses.
E. Limit its uses and disclosures of, and Individual requests for, PHI (a) when practical, to PHI the information making up a Limited Data Set; and (b) in a Designated Record Setall other cases subject to the requirements of 45 CFR §164.502 (c), to DOM orthe minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure or Individual request as directed by XXX, necessary to an Individual in order to meet the requirements satisfy Covered Entity’s obligations under 45 CFR § §164.524.
m. Business Associate agrees F. Upon reasonable notice and prior written request, to make any amendment(s) available during normal business hours at Business Associate’s offices all records, books, agreements, internal practices, policies and procedures relating to PHI in a Designated Record Set that DOM directs the use or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures disclosure of PHI to Covered Entity and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an IndividualSecretary, in a time and manner designated by DOMthe Secretary, for purposes of determining the Covered Entity’s compliance with the laws and Regulations, subject to the U.S. Department of Health and Human Services attorney-client and other applicable legal privileges. Business Associate will give to Covered Entity a copy of the documents given to the Secretary.
G. Maintain and make available the information collected in accordance with section (III)(h) of this Agreement, required to permit XXX to respond to a request by an Individual for provide an accounting of Disclosures disclosures to an Individual under 45 CFR §164.528 (including without limitation a disclosure permitted under 45 CFR §164.512) and the HITECH Act, within 20 business days of receipt of a request from Covered Entity.
H. Make any amendment(s) to PHI in a designated record set as directed or agreed to by the Covered Entity. Within five business days following the Business Associate’s amendment of PHI as directed by the Covered Entity, the Business Associate shall provide written notice to the Covered Entity confirming that the Business Associate has made to amendments to PHI as directed by the Covered Entity and containing any other information as may be necessary for the Covered Entity to provide adequate notice to the Individual in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use 164.526 or disclose the minimum PHI take other measures as necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in satisfy the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOMCovered Entity’s obligations under 45 CFR § 164.526.
I. To the Privacy Rule, extent the Business Associate will is to carry out one or more of Covered Entity’s obligations under Subpart E of 45 CFR§ 164, comply with the requirements of the Privacy Rule Subpart E that apply to DOM the Covered Entity in the performance of such obligationobligations.
r. Business Associate agrees J. Subject to make Section VI.C.1.-6. of this Agreement, return to the Covered Entity or destroy, within 30 days of the termination of this Agreement, any and all PHI in its possession and retain no copies (which for purposes of this Agreement shall include without limitation destroying all backup tapes and permanently deleting all electronic PHI).
K. Make its internal practices, books, and records, including policies and procedures, records available to the Secretary for purposes of determining compliance with the HIPAA Rules.
L. Warrants they have taken specific measures with respect to electronic data security measures. Agrees, if requested by Covered Entity, to allow Covered Entity to inspect and audit Business Associate’s and/or DOM's compliance with business to verify what electronic data security measures the Privacy Rule pursuant to 45 C.F.R. § 160.310.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOMhas taken.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. (a) Business Associate agrees to not Use or Disclose PHI Protected Health Information other than as permitted or required by this BA Agreement, as Required By Law, or as contemplated by the Service Agreement or as Required by LawAgreement.
b. (b) Business Associate shall agrees to use appropriate safeguards and comply safeguards, including compliance with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) Protected Health Information, to 46076832.1 prevent Use or Disclosure of PHI the electronic Protected Health Information other than as provided for permitted by this BA Agreement.
c. (c) Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of report to Covered Entity's Privacy Official any Use or Disclosure of PHI Protected Health Information not provided for by this BA Agreement of which it becomes aware, including Breaches of Unsecured Protected Health Information as required by 45 C.F.R. §164.410, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate. For reports of incidents constituting a Breach, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.
e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification report shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals each individual whose Unsecured PHI Protected Health Information has been, or is reasonably believed by Business Associate to have been Breached along been, accessed, acquired, or Disclosed during such Breach. Security Incidents that do not result in any unauthorized access, use, disclosure, modification, destruction of information or interference with any other available information that is required to system operations will be included reported in the notification aggregate upon written request of Covered Entity in a manner and frequency mutually acceptable to the Individualparties. Business Associate hereby reports to Covered Entity that incidents including, HHSbut not limited to, and/or ping sweeps or other common network reconnaissance techniques, attempts to log on to a system with an invalid password or username, and denial of service attacks that do not result in a server being taken off line, may occur from time to time will only be reported in the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410aggregate.
f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10d) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ §164.502(e)(1)(ii) and 164.308(b)(2), if applicable, Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information Protected Health Information on behalf of the Business Associate agree to the same restrictions, conditions, conditions and requirements that apply through this BA Agreement to Business Associate with respect to such information. .
(e) To the extent Business Associate has Protected Health Information in an existing Designated Record Set, and only to the extent required by HIPAA, Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI (ePHI) on behalf of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting a written or an electronic copy to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI make available Protected Health Information in a Designated Record Set, to DOM orCovered Entity as necessary to satisfy Covered Entity's obligations under 45 C.F.R. §164.524. The Parties agree and acknowledge that, as directed by XXXwhile both entities may have to respond to a request pursuant to 45 C.F.R. §164.524(d)(3), it is Covered Entity's responsibility to respond initially to all such requests and, pursuant to this Agreement, to notify Business Associate if Covered Entity has told an Individual in order individual to meet the requirements under 45 CFR § 164.524contact Business Associate directly.
m. (f) Business Associate agrees to make Protected Health Information available for purposes of any amendment(s) to PHI Protected Health Information in its possession contained in a Designated Record Set that DOM directs or agrees as agreed to by Covered Entity pursuant to 45 CFR § C.F.R. §164.526 at the request or take other measures as necessary to satisfy Covered Entity's obligations under 45 C.F.R. §164.526. The Parties agree and acknowledge that it is Covered Entity's responsibility to respond to all such requests and to notify Business Associate of DOM any amendment or an Individual, and in the time and manner designated by XXXrefusal to amend.
n. (g) Business Associate agrees to document such Disclosures maintain and make available the information required to provide an accounting of PHI disclosures to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 C.F.R. §164.528(b), subject to the exceptions in 45 C.F.R. §164.528(a). The Parties agree and information related to such Disclosures as would be required for DOM acknowledge that it is Covered Entity's responsibility to respond to a request by an Individual all such requests. As disclosures must be made for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least the period six (6) years after prior to the date request or such shorter period if requested by an individual, the Parties agree that the responsibility of disclosure Business Associate to provide this information shall not extend beyond termination of this or provide a full accounting and relevant documentation to DOM at the time of terminationsubsequent BA Agreement.
o. (h) To the extent Business Associate agrees is to provide to DOM carry out one or an Individualmore of Covered Entity's obligations under Subpart E of 45 C.F.R. Part 164 of the HIPAA Rules, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule Subpart E that apply to DOM Covered Entity in the performance of such obligationobligation(s).
r. (i) Business Associate agrees to make Protected Health Information of Covered Entity’s patients available whenever such patients participate in a third party program requiring access to patient data.
(j) Business Associate agrees to make its internal practices, books, and records, including policies records related to Business Associate's use and procedures, disclosure of Protected Health Information received from Covered Entity available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310HIPAA Rules.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: Business Associate Agreement
Obligations and Activities of Business Associate. a. (A) Business Associate acknowledges and agrees that all PHI that is created or received by Covered Entity and used by or disclosed to Business Associate or created or received by Business Associate on Covered Entity’s behalf shall be subject to this BAA.
(B) Business Associate agrees to not Use use or Disclose disclose PHI other than as permitted or required by the Service Agreement this BAA or as Required by Law.
b. (C) Business Associate shall agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use use or Disclosure disclosure of PHI other than as provided for by this AgreementBAA.
c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72D) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.
d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use use or Disclosure disclosure of PHI by Business Associate in Violation violation of the requirements of this Agreement and take prompt steps to prevent BAA, the recurrence of any Incident, including any action required by applicable federal and state laws and regulationsPrivacy Rule or the Security Rule.
e. (E) Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after Covered Entity promptly following discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall Any notice pursuant to this Section 2(E) will include, to the extent possible and subsequently as the information becomes availablepossible, the identification of all Individuals each Individual whose Unsecured PHI has been, or is reasonably believed by Business Associate Associate, to have been Breached along with any accessed, acquired or disclosed during such Breach. Business Associate will also provide Covered Entity other available information that Covered Entity is required to be included include in the its notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.
f. Once an actual or suspected Breach is reported to DOM, (F) Business Associate agrees to provide a written assessment report to determine whether the incident is reportable within ten Covered Entity any use or disclosure of PHI not provided for by this BAA or any Security Incident of which it becomes aware. Exhibit B of C360 T&C (1020211012US-CA) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.12
g. Business Associate agrees to fully cooperate, coordinate with, and assist XXX in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.
h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.
i. With respect to an Incident, deliver to DOM within fifteen (15G) business days after discovery of an Incident a written corrective action plan (“CAP”) describing, at a minimum, the measures Business Associate has taken and intends to take to halt or contain the Incident and mitigate the effects of the Incident, and, if the CAP is approved by XXX, promptly and fully implement any remaining requirements of the CAP.
j. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.
k. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that createagent, receiveincluding a subcontractor, maintainto whom it provides PHI received from, or transmit protected health information created or received by Business Associate for, or on behalf of the Business Associate agree of, Covered Entity agrees in writing to the same restrictions, conditions, substantially similar restrictions and requirements conditions that apply through this BAA to Business Associate with respect to such information. Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit electronic PHI .
(ePHIH) on behalf Within fifteen (15) days of Business Associate will agree to comply with the applicable requirements of the Security Rule and Privacy Rule by entering into a Business Associate Agreement and Business Associate shall provide DOM with a copy of all such executed agreements between Business Associate and Business Associate’s Subcontractors at least thirty (30) calendar days prior to disclosing any of DOM’s PHI pursuant to said agreements by submitting receiving a written or an electronic copy request from Covered Entity, provide to DOM’s Privacy Officer at the address included in Section VII(f) of this Agreement. Business Associate understands that submission of their Subcontractors’ Business Associate Agreement(s) Covered Entity such information as is requested by Covered Entity to DOM does not constitute DOM approval of any kind, including of the use of such Subcontractors or of the adequacy of such agreements.
l. Business Associate agrees to provide access, at the request of XXX, and in the time and manner designated by XXX, to PHI in a Designated Record Set, to DOM or, as directed by XXX, to an Individual in order to meet the requirements under 45 CFR § 164.524.
m. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that DOM directs or agrees to pursuant to 45 CFR § 164.526 at the request of DOM or an Individual, and in the time and manner designated by XXX.
n. Business Associate agrees to document such Disclosures of PHI and information related to such Disclosures as would be required for DOM permit Covered Entity to respond to a request by an Individual to inspect and obtain a copy of PHI about the Individual that is maintained in a Designated Record Set, for as long as the PHI is maintained in the Designated Record Set, in accordance with 45 C.F.R. § 164.524; to amend PHI or a record about the Individual in a Designated Record Set, for as long as PHI is maintained in the Designated Record Set, in accordance with 45 C.F.R. § 164.526; and for an accounting of Disclosures the disclosures of the Individual’s PHI in accordance with 45 CFR § 164.528. Business Associate agrees to retain such documentation for at least six (6) years after the date of disclosure or provide a full accounting and relevant documentation to DOM at the time of termination.
o. Business Associate agrees to provide to DOM or an Individual, in a time and manner designated by DOM, information collected in accordance with section (III)(h) of this Agreement, to permit XXX to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR C.F.R. § 164.528.
p. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in the Service Agreements. Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.
q. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.
r. (I) Business Associate agrees to make internal practices, books, and records, including policies and proceduresprocedures and PHI, relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of, Covered Entity, available to the Secretary Secretary, in a time and manner designated by the Secretary, for purposes of the Secretary determining Business AssociateCovered Entity’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310Rule.
s. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.
Appears in 1 contract
Samples: C360 Agreement
