OBLIGATIONS AND ACTIVITIES OF CONTRACTOR AS BUSINESS ASSOCIATE 1. CONTRACTOR agrees not to use or further disclose PHI COUNTY discloses to CONTRACTOR other than as permitted or required by this Business Associate Contract or as required by law.
2. XXXXXXXXXX agrees to use appropriate safeguards, as provided for in this Business Associate Contract and the Agreement, to prevent use or disclosure of PHI COUNTY discloses to CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY other than as provided for by this Business Associate Contract.
3. XXXXXXXXXX agrees to comply with the HIPAA Security Rule at Subpart C of 45 CFR Part 164 with respect to electronic PHI COUNTY discloses to CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY.
4. CONTRACTOR agrees to mitigate, to the extent practicable, any harmful effect that is known to CONTRACTOR of a Use or Disclosure of PHI by CONTRACTOR in violation of the requirements of this Business Associate Contract.
5. XXXXXXXXXX agrees to report to COUNTY immediately any Use or Disclosure of PHI not provided for by this Business Associate Contract of which CONTRACTOR becomes aware. CONTRACTOR must report Breaches of Unsecured PHI in accordance with Paragraph E below and as required by 45 CFR § 164.410.
6. CONTRACTOR agrees to ensure that any Subcontractors that create, receive, maintain, or transmit PHI on behalf of CONTRACTOR agree to the same restrictions and conditions that apply through this Business Associate Contract to CONTRACTOR with respect to such information.
7. CONTRACTOR agrees to provide access, within fifteen (15) calendar days of receipt of a written request by COUNTY, to PHI in a Designated Record Set, to COUNTY or, as directed by COUNTY, to an Individual in order to meet the requirements under 45 CFR § 164.524. If CONTRACTOR maintains an Electronic Health Record with PHI, and an individual requests a copy of such information in an electronic format, CONTRACTOR shall provide such information in an electronic format.
8. CONTRACTOR agrees to make any amendment(s) to PHI in a Designated Record Set that COUNTY directs or agrees to pursuant to 45 CFR § 164.526 at the request of COUNTY or an Individual, within thirty (30) calendar days of receipt of said request by COUNTY. XXXXXXXXXX agrees to notify COUNTY in writing no later than ten (10) calendar days after said amendment is completed.
9. CONTRACTOR agrees to make internal practices, books, and records, including policies and procedures, relating to the use and disclosure of PHI received from, or created or received by CONTRACTOR on behalf of, COUNTY available to COUNTY and the Secretary in a time and manner as determined by COUNTY or as designated by the Secretary for purposes of the Secretary determining COUNTY’S compliance with the HIPAA Privacy Rule.
10. CONTRACTOR agrees to document any Disclosures of PHI COUNTY discloses to CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY, and to make information related to such Disclosures available as would be required for COUNTY to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
11. CONTRACTOR agrees to provide COUNTY or an Individual, as directed by COUNTY, in a time and manner to be determined by COUNTY, that information collected in accordance with the Agreement, in order to permit COUNTY to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
12. XXXXXXXXXX agrees that to the extent CONTRACTOR carries out COUNTY’s obligation under the HIPAA Privacy and/or Security rules CONTRACTOR will comply with the requirements of 45 CFR Part 164 that apply to COUNTY in the performance of such obligation.
13. If CONTRACTOR receives Social Security data from COUNTY provided to COUNTY by a state agency, upon request by COUNTY, CONTRACTOR shall provide COUNTY with a list of all employees, subcontractors and agents who have access to the Social Security data, including employees, agents, subcontractors and agents of its subcontractors.
14. CONTRACTOR will notify COUNTY if CONTRACTOR is named as a defendant in a criminal proceeding for a violation of HIPAA. COUNTY may terminate the Agreement, if CONTRACTOR is found guilty of a criminal violation in connection with HIPAA. COUNTY may terminate the Agreement, if a finding or stipulation that CONTRACTOR has violated any standard or requirement of the privacy or security provisions of HIPAA, or other security or privacy laws are made in any administrative or civil proceeding in which CONTRACTOR is a party or has been joined. COUNTY will consider the nature and seriousness of the violation in deciding whether or not to terminate the Agreement.
Approved Services; Additional Services Registry Operator shall be entitled to provide the Registry Services described in clauses (a) and (b) of the first paragraph of Section 2.1 in the Specification 6 attached hereto (“Specification 6”) and such other Registry Services set forth on Exhibit A (collectively, the “Approved Services”). If Registry Operator desires to provide any Registry Service that is not an Approved Service or is a material modification to an Approved Service (each, an “Additional Service”), Registry Operator shall submit a request for approval of such Additional Service pursuant to the Registry Services Evaluation Policy at xxxx://xxx.xxxxx.xxx/en/registries/rsep/rsep.html, as such policy may be amended from time to time in accordance with the bylaws of ICANN (as amended from time to time, the “ICANN Bylaws”) applicable to Consensus Policies (the “RSEP”). Registry Operator may offer Additional Services only with the written approval of ICANN, and, upon any such approval, such Additional Services shall be deemed Registry Services under this Agreement. In its reasonable discretion, ICANN may require an amendment to this Agreement reflecting the provision of any Additional Service which is approved pursuant to the RSEP, which amendment shall be in a form reasonably acceptable to the parties.
Information Services Traffic 5.1 For purposes of this Section 5, Voice Information Services and Voice Information Services Traffic refer to switched voice traffic, delivered to information service providers who offer recorded voice announcement information or open vocal discussion programs to the general public. Voice Information Services Traffic does not include any form of Internet Traffic. Voice Information Services Traffic also does not include 555 traffic or similar traffic with AIN service interfaces, which traffic shall be subject to separate arrangements between the Parties. Voice Information services Traffic is not subject to Reciprocal Compensation charges under Section 7 of the Interconnection Attachment.
5.2 If a D&E Customer is served by resold Verizon Telecommunications Service or a Verizon Local Switching UNE, subject to any call blocking feature used by D&E, to the extent reasonably feasible, Verizon will route Voice Information Services Traffic originating from such Service or UNE to the Voice Information Service platform. For such Voice Information Services Traffic, unless D&E has entered into an arrangement with Verizon to xxxx and collect Voice Information Services provider charges from D&E’s Customers, D&E shall pay to Verizon without discount the Voice Information Services provider charges. D&E shall pay Verizon such charges in full regardless of whether or not it collects such charges from its own Customers.
5.3 D&E shall have the option to route Voice Information Services Traffic that originates on its own network to the appropriate Voice Information Services platform(s) connected to Verizon’s network. In the event D&E exercises such option, D&E will establish, at its own expense, a dedicated trunk group to the Verizon Voice Information Service serving switch. This trunk group will be utilized to allow D&E to route Voice Information Services Traffic originated on its network to Verizon. For such Voice Information Services Traffic, unless D&E has entered into an arrangement with Verizon to xxxx and collect Voice Information Services provider charges from D&E’s Customers, D&E shall pay to Verizon without discount the Voice Information Services provider charges.
5.4 D&E shall pay Verizon such charges in full regardless of whether or not it collects charges for such calls from its own Customers.
5.5 For variable rated Voice Information Services Traffic (e.g., NXX 550, 540, 976, 970, 940, as applicable) from D&E Customers served by resold Verizon Telecommunications Services or a Verizon Local Switching Network Element, D&E shall either (a) pay to Verizon without discount the Voice Information Services provider charges, or (b) enter into an arrangement with Verizon to xxxx and collect Voice Information Services provider charges from D&E’s Customers.
5.6 Either Party may request the other Party provide the requesting Party with non discriminatory access to the other party’s information services platform, where such platform exists. If either Party makes such a request, the Parties shall enter into a mutually acceptable written agreement for such access.
5.7 In the event D&E exercises such option, D&E will establish, at its own expense, a dedicated trunk group to the Verizon Information Service serving switch. This trunk group will be utilized to allow D&E to route information services traffic originated on its network to Verizon.
DEPENDENT PERSONAL SERVICES 1. Subject to the provisions of Articles 16, 18 and 19, salaries, wages and other similar remuneration derived by a resident of a Contracting State in respect of an employment shall be taxable only in that State unless the employment is exercised in the other Contracting State. If the employment is so exercised, such remuneration as is derived therefrom may be taxed in that other State.
2. Notwithstanding the provisions of paragraph 1, remuneration derived by a resident of a Contracting State in respect of an employment exercised in the other Contracting State shall be taxable only in the first-mentioned State if:
a) the recipient is present in the other State for a period or periods not exceeding in the aggregate 183 days in any twelve-month period commencing or ending in the tax year concerned, and
b) the remuneration is paid by, or on behalf of, an employer who is not a resident of the other State, and
c) the remuneration is not borne by a permanent establishment or a fixed base which the employer has in the other State.
3. Notwithstanding the preceding provisions of this Article, remuneration derived in respect of an employment exercised aboard a ship or aircraft operated in international traffic by a resident of a Contracting State, may be taxed in that State.
Services to Other Clients; Certain Affiliated Activities (a) The relationship between the Asset Manager and the Series is as described in this Agreement and nothing in this Agreement, none of the services to be provided pursuant to this Agreement, nor any other matter, shall oblige the Asset Manager to accept responsibilities that are more extensive than those set forth in this Agreement.
(b) The Asset Manager’s services to the Series are not exclusive. The Asset Manager may engage in other activities on behalf of itself, any other Managing Party and other clients (which, for the avoidance of doubt, may include other series of the Company). The Series acknowledges and agrees that the Asset Manager may, without prior notice to the Series, give advice to such other clients. The Asset Manager shall not be liable to account to the Series for any profits, commission or remuneration made or received in respect of transactions effected pursuant to the Asset Manager’s advice to another client and nor will the Asset Manager’s fees be abated as a result.
Obligations and Activities of Business Associate Business Associate agrees to:
a. Not use or disclose Protected Health Information other than as permitted or required by this BAA, the Agreement, or as required by law;
b. Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic Protected Health Information, to prevent Use or Disclosure of Protected Health Information other than as provided for by this BAA;
c. Report to Covered Entity any Use or Disclosure of Protected Health Information not provided for by this BAA of which it becomes aware, including breaches of Unsecured Protected Health Information as required at 45 CFR 164.410, and any Security Incident of which it becomes aware;
d. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any Subcontractors that create, receive, maintain, or transmit Protected Health Information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information;
e. Make available Protected Health Information in a Designated Record Set to Covered Entity or to an individual whose Protected Health Information is maintained by Business Associate, or the individual’s designee, and document and retain the documentation required by 45 CFR 164.530(j), as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.524;
f. Make any amendment(s) to Protected Health Information in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526;
g. Maintain and make available the information required to provide an accounting of Disclosures to the Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.528;
h. To the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such obligation(s); and
i. Make its internal practices, books, and records available to the Secretary for purposes of determining Business Associate’s or Covered Entity’s compliance with HIPAA and HIPAA Regulations.
Additional Products and Services Subject to the allocation of funds, the CPO may add similar equipment, supplies, services, or locations, within the scope of this Agreement, to the list of equipment, supplies, services, or locations to be performed or provided by giving written notification to Contractor. For purposes of this Section, the “Effective Date” means the date specified in the notification from the CPO. As of the Effective Date, each item added is subject to this Agreement, as if it had originally been a part, but the charge for each item starts to accrue only on the Effective Date. In the event the additional equipment, supplies, services, or locations are not identical to the items(s) already under this Agreement, the charges therefor will then be Contractor’s normal and customary charges or rates for the equipment, supplies, services, or locations classified in the Fees and Costs (Exhibit “F”).
Products and Services General Information
SERVICES AND EQUIPMENT Section 21.01. Landlord shall, at its cost and expense:
(a) Provide operatorless passenger elevator service Mondays through Fridays from 8:00 A.M. to 6:00 P.M., holidays excepted. A passenger elevator will be available at all other times. A freight elevator shall be available Mondays through Fridays, holidays excepted, only from 8:00 to 6:00 P.M. The freight elevator shall be available on a "first come, first served" basis during the said days and hours and on a reservation "first come, first served" basis other than on said days and hours at Landlord's customary charges therefor.
(b) Maintain and repair the Building standard heating, ventilating and air conditioning system servicing the Demised Premises (the "HVAC System") installed by Landlord, except for those repairs which are the obligation of Tenant pursuant to Article 6 of this Lease. The HVAC System will be operated by Landlord as and when required by law, or for the comfortable occupancy of the Demised Premises (as determined by Landlord) throughout the year on Mondays through Fridays, holidays excepted, from 8:00 A.M. to 6:00 P.M.; provided that Tenant shall draw and close the draperies or blinds for the windows of the Demised Premises whenever the HVAC system is in operation and the position of the sun so requires and shall, at all times, cooperate fully with Landlord and abide by all of the Rules and Regulations which Landlord may prescribe for the proper functioning of the HVAC System. Landlord agrees to operate the HVAC System servicing the Demised Premises in accordance with their design criteria unless energy and/or water conservation programs, guidelines or laws and/or requirements of public authorities, shall provide for any reduction in operations below said design criteria in which case such equipment shall be operated so as to provide reduced service in accordance therewith. Tenant expressly acknowledges that some or all windows are or may be hermetically sealed and will not open and Landlord makes no representation as to the habitability of the Demised Premises at any time the HVAC System is not in operation. Tenant hereby expressly waives any claims against Landlord arising out of the cessation of operation of the HVAC System, or the suitability of the Demised Premises when the same is not in operation, whether due to normal scheduling or the reasons set forth in Section 21.03. Said system is designed to be capable of manufacturing, within tolerances normal in first-class office buildings, inside space conditions averaging 78 degrees Fahrenheit dry bulb and 50% relative humidity when outside conditions are 95 degrees Fahrenheit dry bulb and 75 degrees Fahrenheit wet bulb, and a temperature of not lower than an average of 68 degrees Fahrenheit when outside temperature is 50 degrees Fahrenheit or lower. Landlord will not be responsible for the failure of the HVAC System if such failure results from the occupancy of the Demised Premises by more than an average of one (1) person for each one hundred (100) square feet in any separate room or area, and upon a combined lighting and standard electrical load not to exceed three (3) xxxxx per usable square foot (excluding the Building HVAC), or if Tenant shall install and operate machines, incandescent lighting and appliances the total connected electrical load in excess of the Building's electrical specifications, as determined by Landlord's consulting engineers. If Tenant shall occupy the Demised Premises at an occupancy rate of greater than that for which the HVAC System was designed, or if the total connected electrical load is in excess of the Building's electrical specifications, as determined by Landlord's consulting engineers, or if Tenant's partitions shall be arranged in such a way as to interfere with the normal operation of the HVAC System, Landlord may elect to make changes to the HVAC System or the ducts through which it operates required by reason thereof, and the cost thereof shall be reimbursed by Tenant to Landlord, as additional rent, within twenty (20) days after presentation of a xxxx therefor. Landlord, throughout the term, shall have free access to all mechanical installations of Landlord, including but not limited to air-cooling, fan, ventilating and machine rooms and electrical closets, and Tenant shall not construct partitions or other obstructions that may interfere with Landlord's free access thereto, or interfere with the moving of Landlord's equipment to and from the enclosures containing said installations. Neither Tenant nor any person or entity within Tenant's control shall at any time enter the said enclosures or tamper with, adjust, touch or otherwise in any manner affect said mechanical installations, except as set forth herein with respect to the thermostatic controls within the Demised Premises.
(c) Provide Building standard cleaning services in Tenant's office space and public portions of the Building, except no services shall be performed Saturdays, Sundays and holidays, in accordance with Schedule "D" annexed hereto and made part hereof. If, however, any additional cleaning of the Demised Premises is to be done by Tenant, it shall be done at Tenant's sole expense, in a manner reasonably satisfactory to Landlord and no one other than persons approved by Landlord shall be permitted to enter the Demised Premises or the Building for such purpose. Tenant, at its own cost, may utilize its own employees or outside contractors to perform additional cleaning services in the Demised Premises, provided such employees or outside contractors do not cause any labor disruption or dispute or violate Landlord's union contracts affecting the Building. However, such use of outside contractors shall be subject to the right of Landlord to match the costs chargeable by such outside contractors, in which event Landlord shall perform such services at such cost, to be paid by Tenant within twenty (20) days after being billed therefor. Tenant shall pay to Landlord the cost of removal of any of Tenant's refuse and rubbish from the Demised Premises and the Building (i) to the extent that the same, in any one day, exceeds the average daily amount of refuse and rubbish usually attendant upon the use of such Demised Premises as offices, as described and included in Landlord's cleaning contract for the Building or recommended by Landlord's cleaning contractor, and (ii) related to or deriving from the preparation or consumption of food or drink, excluding food or drink for normal business use. Bills for the same shall be rendered by Landlord to Tenant at such time as Landlord may elect and shall be due and payable as additional rent within twenty (20) days after the time rendered. Tenant, at Tenant's expense, shall cause the Demised Premises to be exterminated from time to time to the satisfaction of Landlord and additionally shall cause all portions of the Demised Premises used for the storage, preparation, service or consumption of food or beverages to be cleaned daily in a manner reasonably satisfactory to Landlord, and to be treated against infestation by vermin, rodents or roaches, whenever there is evidence of any infestation. Tenant shall not permit any person to enter the Demised Premises or the Building for the purpose of providing such extermination services, unless such persons have been approved by Landlord. If so requested by Landlord, Tenant shall store any refuse generated by the consumption of food or beverages on the Demised Premises in a cold box or similar facility.
(d) Furnish hot and cold water for lavatory and drinking purposes. If Tenant requires, uses or consumes water for any other purposes, Landlord may install a meter or meters or other means to measure Tenant's water consumption, and Tenant shall reimburse Landlord for the cost of the meter or meters and the installation thereof, and shall pay for the maintenance of said meter equipment and/or pay Landlord's cost of other means of measuring such water consumption by Tenant. Tenant shall pay to Landlord on demand the cost of all water consumed as measured by said meter or meters or as otherwise measured, including sewer rents.
(e) If Tenant shall require and request any of the foregoing services at times other than above provided, and if such request is made at least twenty-four (24) hours prior to the time when such additional services are required, Landlord will provide them and Tenant shall pay to Landlord promptly thereafter the charges therefor at the then Building standard rate charged to other tenants in the Building.
Section 21.02. Holidays shall be deemed to mean all federal holidays, state holidays and Building Service Employees Union Contract holidays.
Section 21.03. Landlord reserves the right to interrupt, curtail or suspend the services required to be furnished by Landlord under this Lease when necessary by reason of accident, emergency, mechanical breakdown or when required by any law, order or regulation of any Federal, State, County or Municipal authority, or for any other cause beyond the control of Landlord. Landlord shall use due diligence to complete all required repairs or other necessary work as quickly as possible so that Tenant's inconvenience resulting therefrom may be for as short a period of time as circumstances will reasonably permit. Except as otherwise provided in this Lease, Tenant shall not be entitled to nor shall Tenant make claim for any diminution or abatement of minimum rent or additional rent or other compensation, nor shall this Lease or any of the obligations of Tenant be affected or reduced by reason of such interruption, curtailment, suspension, work or inconvenience.
Section 21.04. Tenant shall reimburse Landlord promptly for the actual out-of-pocket cost to Landlord of removal from the Demised Premises and the Building of any refuse and rubbish of Tenant not covered by the Cleaning Specifications (Schedule D) and Tenant shall pay all bills therefor when rendered.
Section 21.05. If Tenant shall request Landlord to furnish any services in addition to those hereinabove provided or perform any work not required under this Lease, and Landlord agrees to furnish and/or perform the same, Tenant shall pay to Landlord promptly thereafter the charges therefor, which charges are deemed to be additional rent and payable as such.
Section 21.06. Landlord shall provide security in the Building lobby and Tenant shall have access to the Demised Premises twenty-four (24) hours per day, seven (7) days per week, subject to emergencies, police power and Article 34.
Section 21.07. Landlord represents that the Building facility equipment is Y2K ready and the Building shall be operated and maintained as a first-class building similar to other first-class buildings in the vicinity of the Building.
Obligations and Activities of Business Associates (1) Business Associate agrees not to use or disclose PHI other than as permitted or required by this Section of the Contract or as Required by Law.
(2) Business Associate agrees to use and maintain appropriate safeguards and comply with applicable HIPAA Standards with respect to all PHI and to prevent use or disclosure of PHI other than as provided for in this Section of the Contract and in accordance with HIPAA Standards.
(3) Business Associate agrees to use administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic Protected Health Information that it creates, receives, maintains, or transmits on behalf of the Covered Entity.
(4) Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to the Business Associate of a use or disclosure of PHI by Business Associate in violation of this Section of the Contract.
(5) Business Associate agrees to report to Covered Entity any use or disclosure of PHI not provided for by this Section of the Contract or any Security Incident of which it becomes aware.
(6) Business Associate agrees, in accordance with 45 C.F.R. 502(e)(1)(ii) and 164.308(d)(2), if applicable, to ensure that any subcontractors that create, receive, maintain or transmit PHI on behalf of the Business Associate, agree to the same restrictions, conditions, and requirements that apply to the business associate with respect to such information.
(7) Business Associate agrees to provide access (including inspection, obtaining a copy or both), at the request of the Covered Entity, and in the time and manner designated by the Covered Entity, to PHI in a Designated Record Set, to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 C.F.R. § 164.524. Business Associate shall not charge any fees greater than the lesser of the amount charged by the Covered Entity to an Individual for such records; the amount permitted by state law; or the Business Associate’s actual cost of postage, labor and supplies for complying with the request.
(8) Business Associate agrees to make any amendments to PHI in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 C.F.R. § 164.526 at the request of the Covered Entity, and in the time and manner designated by the Covered Entity.
(9) Business Associate agrees to make internal practices, books, and records, including policies and procedures and PHI, relating to the use and disclosure of PHI received from, or created, maintained, transmitted or received by, Business Associate on behalf of Covered Entity, available to Covered Entity or to the Secretary in a time and manner agreed to by the parties or designated by the Secretary, for purposes of the Secretary investigating or determining Covered Entity’s compliance with the HIPAA Standards.
(10) Business Associate agrees to document such disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528 and section 13405 of the HITECH Act (42 U.S.C. § 17935) and any regulations promulgated thereunder.
(11) Business Associate agrees to provide to Covered Entity, in a time and manner designated by the Covered Entity, information collected in accordance with subsection (g)(10) of this Section of the Contract, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528 and section 13405 of the HITECH Act (42 U.S.C. § 17935) and any regulations promulgated thereunder. Business Associate agrees at the Covered Entity’s direction to provide an accounting of disclosures of PHI directly to an individual in accordance with 45 C.F.R. § 164.528 and section 13405 of the HITECH Act (42 U.S.C. § 17935) and any regulations promulgated thereunder.
(12) Business Associate agrees to comply with any State or federal law that is more stringent than the Privacy Rule.
(13) Business Associate agrees to comply with the requirements of the HITECH Act relating to privacy and security that are applicable to the Covered Entity and with the requirements of 45 C.F.R. §§ 164.504(e), 164.308, 164.310, 164.312, and 164.316.
(14) In the event that an Individual requests that the Business Associate
(A) restrict disclosures of PHI;
(B) provide an accounting of disclosures of the Individual’s PHI;
(C) provide a copy of the Individual’s PHI in an Electronic Health Record; or
(D) amend PHI in the Individual’s Designated Record Set the Business Associate agrees to notify the Covered Entity, in writing, within five Days of the request.
(15) Business Associate agrees that it shall not, and shall ensure that its subcontractors do not, directly or indirectly, receive any remuneration in exchange for PHI of an Individual without
(A) the written approval of the Covered Entity, unless receipt of remuneration in exchange for PHI is expressly authorized by this Contract and
(B) the valid authorization of the Individual, except for the purposes provided under section 13405(d)(2) of the HITECH Act, (42 U.S.C. § 17935(d)(2)) and in any accompanying regulations.
(16) Obligations in the Event of a Breach.
(A) The Business Associate agrees that, following the discovery by the Business Associate or by a subcontractor of the Business Associate of any use or disclosure not provided for by this section of the Contract, any breach of Unsecured protected health information, or any Security Incident, it shall notify the Covered Entity of such Breach in accordance with Subpart D of Part 164 of Title 45 of the Code of Federal Regulations and this Section of the Contract.
(B) Such notification shall be provided by the Business Associate to the Covered Entity without unreasonable delay, and in no case later than 30 days after the Breach is discovered by the Business Associate, or a subcontractor of the Business Associate, except as otherwise instructed in writing by a law enforcement official pursuant to 45 C.F.R. 164.412. A Breach is considered discovered as of the first day on which it is, or reasonably should have been, known to the Business Associate or its subcontractor. The notification shall include the identification and last known address, phone number and email address of each Individual (or the next of kin of the individual if the Individual is deceased) whose Unsecured protected health information has been, or is reasonably believed by the Business Associate to have been, accessed, acquired, or disclosed during such Breach.
(C) The Business Associate agrees to include in the notification to the Covered Entity at least the following information:
1. A description of what happened, including the date of the Breach; the date of the discovery of the Breach; the unauthorized person, if known, who used the PHI or to whom it was disclosed; and whether the PHI was actually acquired or viewed.
2. A description of the types of Unsecured protected health information that were involved in the Breach (such as full name, Social Security number, date of birth, home address, account number, or disability code).
3. The steps the Business Associate recommends that Individual(s) take to protect themselves from potential harm resulting from the Breach.
4. A detailed description of what the Business Associate is doing or has done to investigate the Breach, to mitigate losses, and to protect against any further Breaches.
5. Whether a law enforcement official has advised the Business Associate, either verbally or in writing, that he or she has determined that notification or notice to Individuals or the posting required under 45 C.F.R.
