Privacy Obligations and Activities of BA. BA shall ensure compliance with the HIPAA Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. Part 160 and Part 164 (the “Privacy Rule”). Without limiting the generality of the foregoing, XX agrees that it will, in accordance with HIPAA, comply with the following: BA agrees to not use or disclose personal health information PHI other than as permitted or required by this Attachment, the Contract or as Required By Law. XX agrees to use appropriate safeguards to prevent use or disclosure of PHI other than as provided for by this Attachment and the Contract. BA shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of EPHI that it creates, receives, maintains or transmits on behalf of the Covered Entity. XX agrees to mitigate, to the extent practicable, any harmful effect that is known to BA of a use or disclosure of PHI by BA in violation of the requirements of this Attachment, the Contract and HIPAA. XX agrees to report to Covered Entity any use or disclosure of PHI not provided for by this Attachment and the Contract of which it becomes aware, within twenty (20) business days. BA shall promptly report to Covered Entity any “security incident” of which it becomes aware; as such term is defined in the HIPAA Security Rule. Florida Healthy Kids Corporation October 1, 2008 /s/ RR FHKC /s/ HS INSURER At the request of Covered Entity, BA shall identify: the date of the security incident, the scope of the security incident, the BA’s response to the security incident and the identification of the party responsible for causing the security incident, if known. XX agrees to ensure that any agent, including a subcontractor, to whom it provides PHI and/or EPHI received from, or created or received by BA on behalf of Covered Entity, agrees to the same restrictions and conditions that apply through this Attachment and the Contract to BA with respect to such information. BA agrees to provide access, at the written request of Covered Entity, within ten (10) business days of the written request (five (5) additional business days are permitted if written request provided by the U.S. Postal Service (“USPS”)), to PHI in a Designated Record Set (“DRS”), to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR §164.524. In the event any Individual requests access to PHI directly from BA, BA ...
