Protection of Phi by Business Associate. Business Associate shall: Not use or disclose PHI other than as permitted or required by this Agreement, any underlying agreement between the parties, or as Required By Law. Make reasonable efforts to limit requests for and the use and disclosure of PHI to a Limited Data Set (as defined in 45 C.F.R. § 164.514(e)(2)) or to the Minimum Necessary PHI (as defined in 45 C.F.R. § 164.514(d)) to accomplish the intended purpose of such use, disclosure or request. Use appropriate, commercially reasonable safeguards to prevent the use or disclosure of PHI other than those uses or disclosures provided for by this Agreement and comply with the Security Rule with respect to ePHI. Develop and implement administrative, physical and technical safeguards, at its expense, as may be required from time to time to maintain compliance with HIPAA and HITECH and to reasonably and appropriately protect the confidentiality, integrity and availability of ePHI that it creates, receives, maintains or transmits on behalf of Covered Entity and to prevent non-permitted or violating Uses or Disclosures of ePHI. Mitigate, to the extent practicable, any harmful effect of an unauthorized use or disclosure of PHI by Business Associate, or a subcontractor, vendor, or agent of Business Associate, in violation of the requirements of this Agreement. Report without unreasonable delay and in no event later than three (3) business days, to the designated privacy officer of Covered Entity any Security Incident Business Associate Discovers. Notify the designated privacy officer of Covered Entity after Business Associate’s Discovery of a Breach without unreasonable delay, and in no event later than three (3) business days after Business Associate, or any of its employees or agents, Discovered the Breach. Such notification shall include, to the extent possible, the identification of each Individual whose PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired, used, or disclosed during the Breach and any other information available to Business Associate about the Breach which is required to be included in the notification of the Breach provided to the Individual in accordance with 45 C.F.R. §164.404(c). Business Associate will notify Covered Entity prior to any communication with Individuals affected by any Breach. If Business Associate (or one of its subcontractors, vendors or agents) is responsible for a Breach, Covered Entity may, at its option, require Business...
Protection of Phi by Business Associate. With regard to its use and/or disclosure of PHI, Business Associate shall: (1) Not use or further disclose PHI other than as permitted or required by this Agreement or as required by law. Notwithstanding anything contained in this Agreement or any other agreement or understanding between Customer and Business Associate to the contrary, Business Associate shall not further disclose PHI to any third party for purposes other than "treatment," "payment" or "health care operations," as those terms are used and defined within the Privacy Rule, without the prior, written consent of Customer. To the extent Customer’s written consent is given to make such disclosures, Business Associate shall: (a) Maintain records of each such disclosure containing, at a minimum, the following information: (i) the date of the disclosure; (ii) the name of the entity or person who received the PHI and, if known, the address of such entity or person; (iii) a brief description of the PHI disclosed; and (iv) a brief statement of the purpose of the disclosure; and (b) Provide, upon request, to Customer or to the individual to whom the PHI relates an accounting of all such disclosures in accordance with 45 C.F.R. § 164.528 and Section 13405(c) of the HITECH Act. Business Associate shall notify Customer promptly, and in any event, within ten (10) days of a receipt of any request for an accounting of disclosures by an Individual. In the event Business Associate discloses PHI to any third party for purposes other than "treatment", "payment" or "health care operations," as those terms are used and defined within the Privacy Rule, Business Associate shall provide prompt notice of the date and purpose of such disclosure as well as the name and address of the recipient, which notice shall be sent to Customer at address provided in Service Agreement; (2) Use appropriate, commercially reasonable safeguards to prevent use or disclosure of PHI other than as provided for by this Agreement; (3) Report to the Customer any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, including without limitation, any disclosure of PHI to any unauthorized subcontractor, within ten (10) days of its discovery; (4) report any Breach of Unsecured Protected Health Information of which Business Associate becomes aware in writing to Customer without unreasonable delay, and in no event more than ten (10) days following discovery of the Breach, with such report to include such information...
Protection of Phi by Business Associate. Business Associate shall:
A. Not use or disclose PHI other than as permitted or required by this Agreement, any underlying agreement between the parties, or as Required By Law.
B. Make reasonable efforts to limit requests for and the use and disclosure of PHI to a Limited Data Set (as defined in 45 C.F.R. § 164.514(e)(2)) or to the Minimum Necessary PHI (as defined in 45 C.F.R. § 164.514(d)) to accomplish the intended purpose of such use, disclosure or request.
C. Use appropriate, commercially reasonable safeguards to prevent the use or disclosure of PHI other than those uses or disclosures provided for by this Agreement and comply with the Security Rule with respect to ePHI.
D. Develop and implement administrative, physical and technical safeguards, at its expense, as may be required from time to time to maintain compliance with HIPAA and HITECH and to reasonably and appropriately protect the confidentiality, integrity and availability of ePHI that it creates, receives, maintains or transmits on behalf of Covered Entity and to prevent non-permitted or violating Uses or Disclosures of ePHI.
Protection of Phi by Business Associate. Business Associate shall:
A. Not use or disclose PHI other than as permitted or required by this Agreement, any underlying agreement between the parties, or as Required By Law.
B. Make reasonable efforts to limit requests for and the use and disclosure of PHI to a Limited Data Set (as defined in 45 C.F.R. § 164.514(e)(2)) or to the Minimum Necessary PHI to accomplish the intended purpose of such use, disclosure or request.
C. Use appropriate, commercially reasonable safeguards to prevent the use or disclosure of PHI other than those uses or disclosures provided for by this Agreement and comply with the Security Rule with respect to ePHI.
D. Develop and implement administrative, physical and technical safeguards, at its expense, as may be required from time to time to maintain compliance with HIPAA and HITECH and to reasonably and appropriately protect the confidentiality, integrity and availability of ePHI that it creates, receives, maintains or transmits on behalf of Covered Entity and to prevent non-permitted or violating Uses or Disclosures of ePHI.
Protection of Phi by Business Associate
