Responsibilities of the Business Associate. Regarding the use or disclosure of PHI and PII, the Business Associate agrees to:
1. Only use or disclose the PHI and PII as allowed under this Addendum or otherwise by applicable law.
2. Only use or disclosure PHI and PII in a manner that would not violate the HIPAA Privacy and Security Rules, or FIPA, if done so by a Covered Entity.
3. Establish and implement appropriate procedures, physical, and technical safeguards to prevent improper access, uses, transmissions, or disclosures of PHI and PII for mitigating, to the greatest extents possible under the circumstances, any deleterious effects from any improper access, use, or disclosure of PHI and PII that the Business Associate reports to the County. Safeguards shall include, but are not limited to: (a) the implementation and use of electronic security measures to safeguard electronic data; (b) requiring employees to agree to access, use, or disclose PHI and PII only as permitted or required by this Addendum; and (c) taking related disciplinary action for inappropriate access, use or disclosure as necessary.
4. Ensure that the Business Associate’s subcontractors or agents to whom the Business Associate provides PHI or PII, created received, maintained, or transmitted on behalf County agree to the same restrictions and conditions that apply to the Business Associate with respect to PHI and PII, and ensure that its subcontractors or agents agree to establish and implement reasonable and appropriate safeguards to protect the confidentiality, integrity, and availability of all PHI and PII that it creates receives, maintains, or transmits on behalf of the County.
5. Make the Business Associate’s records, books, accounts, agreements, policies, and procedures available to the Secretary of HHS for determining the County’s compliance with the HIPAA Privacy and Security Rules, and also, with the State of Florida’s Department of Legal Affairs to determine the County’s compliance with FIPA.
6. Limit use by, or disclosure to, its subcontractors, agents, and other third parties, to the minimum PHI and PII necessary to perform or fulfill a specific function required or permitted hereunder.
7. Provide information to the County to permit the County to respond to a request by an individual for an accounting of disclosures within five (5) days of receiving a written request from the County, if the Business Associate maintains a Designated Records Set on behalf of the County.
8. At the request of, and in the time and manner ...
Responsibilities of the Business Associate. With regard to its use and/or disclosure of PHI, the Business Associate hereby agrees to do the following:
a. Not use or disclose PHI other than as permitted or required by the Agreement or as Required by Law;
Responsibilities of the Business Associate. With regard to its use and/or disclosure of PHI, the Business Associate hereby agrees to do the following:
a. Not use or disclose PHI other than as permitted or required by the Agreement or as Required by Law;
b. Use and maintain appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to Electronic PHI, including, without limitation, implementing administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of Electronic PHI to prevent use or disclosure of PHI other than as provided for by the Agreement. Such safeguards must meet the requirements set forth in 45 CFR §§ 164.308, 164.310, 164.312 and 164.316 and be undertaken in a manner consistent with any guidance issued by the Secretary commencing on the effective date of such guidance. The Business Associate shall document and keep these safeguards current as proscribed by the Security Rule. Upon request by Covered Entity, Business Associate will provide evidence of all such safeguards utilized by Business Associate to safeguard Electronic PHI;
c. Report to Covered Entity the following occurrences relating to PHI (“PHI Incident”), including those PHI Incidents by the Business Associate’s employees, representatives, agents or subcontractors: (i) any access, acquisition, use or disclosure of PHI not provided for by this Agreement, (ii) any breach of unsecured PHI (actual or suspected), and (iii) any security incident of which it becomes aware. Business Associate shall notify Covered Entity by telephone call within twenty-four (24) hours from which Business Associate knows, discovers or by exercising reasonable diligence would have known of or discovered the PHI Incident. Within forty-eight (48) hours of verbal notice, the Business Associate shall provide a full written report of the PHI Incident to the Covered Entity, including, without limitation, (i) the names and contact information of each Individual whose PHI has been or is reasonably believed by the Business Associate to have been accessed, acquired, used or disclosed during the PHI Incident, (ii) a brief description of what happened, including the date of the PHI Incident and the date of discovery of the PHI Incident, if known, (iii) a description of the types of unsecured PHI involved in the PHI Incident, (iv) any steps Individuals should take to protect themselves from potential harm resulting from the PHI Incident, (v) a brief description of wha...
Responsibilities of the Business Associate. With regard to the uses or disclosures of PHI per- mitted by this Agreement, Business Associate hereby agrees to the following: PROTECTION OF PHI
Responsibilities of the Business Associate. With regard to its use and/or disclosure of PHI, the Business Associate hereby agrees to do the following:
a. use and/or disclose the PHI only as permitted or required by this Agreement or as otherwise required by law.
b. report to the designated Privacy Officer and/or Security Officer of the Covered Entity, in writing, any use and/or disclosure of the PHI that is not permitted or required by this Agreement of which Business Associate becomes aware within 7 business days of the Business Associate’s discovery of such unauthorized use and/or disclosure. To the extent possible, the Business Associate should provide the Covered Entity with the identification of each individual affected by the breach as well as any information required to be provided by the Covered Entity in its notification of affected individuals. Business Associates shall comply with all regulations issued by HHS and applicable state agencies regarding breach notification to Covered Entities. Business Associates agree to document such disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R §. 164.528.
c. establish procedures for a mutually satisfactory resolution, regarding any deleterious effects form any improper use and/or disclosure of PHI that the Business Associate reports to the Covered Entity.
d. use commercially reasonable efforts to maintain the security of the PHI and to prevent unauthorized use and/or disclosure of such PHI.
e. require all of its subcontractors and agents that receive or use, or have access to, PHI under this Agreement to agree, in writing, to adhere to the same restrictions and conditions on the use and/or disclosure of PHI that apply to the Business Associate pursuant to section 2 of this Agreement.
f. make available all internal practices, records, books agreements, policies, procedures and PHI relating to the use and/or disclosure of PHI received from, or created or received by Business Associate, on behalf of covered Entity, available to Covered Entity or to the Secretary of HHS in a prompt and commercially reasonable manner for purposes of determining (i) the Business Associate’s compliance with the terms of this Agreement and (ii) compliance by the Business Associate and the Covered Entity with all applicable statutory provisions and regulations of and under HIPAA and the HITECH Act, subject to attorney...
Responsibilities of the Business Associate. With regard to its use and/or disclosure of PHI, the Business Associate hereby agrees to do the following:
a. Not use or disclose PHI other than as permitted or required by the Underlying Arrangement or as required by law, subject to Section 3(c) below.
b. Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to secure and protect electronic PHI to prevent use or disclosure of PHI other than as provided for by the Agreement, and to protect the integrity and availability of PHI.
c. Report, in writing, to the UCMC privacy officer within five (5) business days any use or disclosure of PHI not provided for by the Agreement of which it becomes aware, including breaches of unsecured PHI, and any security incident of which it becomes aware, and cooperate with UCMC in any mitigation or breach reporting efforts. The notice will provide as much information as Business Associate has gathered as of that time. A subsequent notice, which Business Associate will provide no later than thirty (30) days after the first discovery of the use or disclosure, will include the identification of each individual whose PHI has been or is reasonably believed by Business Associate to have been affected by or during such use or disclosure. Business Associate will make no public disclosure of such use or disclosure without the approval of UCMC.
d. In accordance with 45 CFR §§ 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, to ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information.
e. Ensure that any agent or subcontractor to whom the Business Associate provides PHI, as well as Business Associate, not export PHI beyond the borders of the United States of America.
f. Within five (5) business days request of UCMC, make available PHI in a designated record set, if a pp lica ble , to UCMC, as necessary to satisfy UCMC’s obligations under 45 CFR § 164.524.
g. Within five (5) business days, make any amendment(s) to PHI, if applicable, in a designated record set as directed or agreed to by UCMC pursuant to 45 CFR § 164.526, or take other measures as necessary to satisfy UCMC’s obligations under 45 CFR § 164.526.
h. As applicable, maintain and make available the information required to provide an accounting of disclosures as necessary to satisfy UCMC’s o...
Responsibilities of the Business Associate a. The Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Business Associate Agreement.
b. The Business Associate represents and warrants that to the extent that the Business Associate is provided with any Health Information, the Business Associate will:
1) not use or further disclose the information other than as specifically set forth in this Business Associate Agreement;
2) not use or further disclose the Health Information in a manner that would violate the requirements of any state or federal law including the provisions of the HIPAA Regulations;
3) use appropriate safeguards to prevent use or disclosure of the Health Information other than as provided for in this Business Associate Agreement;
4) report to GCCMHA any use or disclosure of the Health Information not provided for by this Agreement of which BA may become aware;
5) ensure that any agents, including subcontractors, to whom BA provides Health Information received from GCCMHA or Affiliated Entities agrees to the same restrictions and conditions that apply to Business Associate with respect to such Health Information;
6) make the Health Information available in accordance with the HIPAA Regulations;
7) make available Health Information for amendment and incorporate any amendments to Health Information in accordance with the HIPAA Regulations;
8) make its internal practices, books and records relating to the use and disclosure of Health Information received from GCCMHA available to the Secretary of the Center for Medicaid Services (CMS) for purposes of determining GCCMHA compliance with the HIPAA Regulations;
9) return all Health Information received from GCCMHA which Business Associate maintains in any form at the termination of this Agreement;
10) provide an accounting of disclosures to the individual upon request;
11) provide an accounting of disclosures to the GCCMHA upon request.
c. Business Associate agrees to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the protected health information that it creates, receives, maintains, or transmits on behalf of the covered entity as required by the Privacy Rule, Security Rule, and HITECH Act.
d. Business Associate recognizes that, as of February 18, 2010, the administrative, physical, and
e. Business Associate recognizes that, as of Februa...
Responsibilities of the Business Associate. With regard to its use and/or disclosure of PHI, the Business Associate hereby agrees to do the following:
a. Not use or disclose PHI other than as permitted or required by the Underlying Arrangement or as required by law, subject to Section 3(c) below.
b. Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to secure and protect electronic PHI to prevent use or disclosure of PHI other than as provided for by the Agreement, and to protect the integrity and availability of PHI.
c. Report, in writing, to the UCMC privacy officer within five (5) business days any use or disclosure of PHI not provided for by the Agreement of which it becomes aware, including breaches of unsecured PHI, and any security incident of which it becomes aware, and cooperate with UCMC in any mitigation or breach reporting efforts. The UCMC will determine whether the Business Associate or the UCMC will be responsible to send breach notification to affected individuals. If the UCMC provides the breach notification, the Business Associate will reimburse the UCMC for all related expenses which can include but are not limited to the investigation and notification. This can include but is not limited to: outside legal counsel, forensic fees, vendor fees for notification purposes, credit monitoring for affected individuals. All outside counsel and vendors utilized for investigation and breach notification will be chosen by the UCMC. The notice will provide as much information as Business Associate has gathered as of that time. A subsequent notice, which Business Associate will provide no later than fifteen (15) days after the first discovery of the use or disclosure, will include the identification of each individual whose PHI has been or is reasonably believed by Business Associate to have been affected by or during such use or disclosure and the type of PHI disclosed for each individual affected. Business Associate will make no public disclosure including to the media of such use or disclosure without the approval of UCMC. Business Associate will make no public disclosure of such use or disclosure without the approval of UCMC.
d. In accordance with 45 CFR §§ 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, to ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to s...
Responsibilities of the Business Associate. With regard to its use and/or disclosure of PHI, the Business Associate hereby agrees to do the following:
(a) Not use or disclose PHI other than as permitted or required by the Agreement or as required by law;
(b) Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by the Agreement;
(c) Report, in writing, to Covered Entity within f ive ( 5 ) bus iness day s any use or disclosure of PHI not provided for by the Agreement of which it becomes aware, including breaches of unsecured PHI as required at 45 CFR 164.410, and any security incident of which it becomes aware, and cooperate with the Covered Entity in any mitigation or breach reporting efforts; this notice shall be deemed sufficient if it is delivered to the Parties at their respective addresses listed above and the Privacy Officer using the following contact information: E-mail: xxxxxxxxxx@xxxxxxxxx.xxx (Please confirm receipt)
(d) In accordan ce with 4 5 CF R 164.502(e)( 1)(ii) an d 164.308 (b)(2), if applicable, to ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information;
(e) Except as provided in this subsection, ensure that any agent or subcontractor to whom the Business Associate provides PHI, as well as Business Associate, shall not export PHI beyond the borders of the United States of America. If the Business Associate or its agent or subcontractor exports PHI beyond the borders of the United States of America, then, subject to the United States and New York State export control and foreign outsourcing laws, rules and regulations, the Business Associate will provide to Covered Entity prior to such export, a reasonable assurance, evidenced in writing, that the Business Associate, subcontractor, or agent will comply with the privacy and security obligations of Business Associate the set forth either in this Agreement or in applicable law, rules and regulations with respect to such PHI.
(f) Agrees to provide the Covered Entity, at the Covered Entity’s request, a list of all agents and subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate.
(g) Within five (5) business days of a request from Covered Entity, make available PHI in a designated record set, i f a ...
Responsibilities of the Business Associate. To the extent applicable and with the understanding by the County that Business Associate will not respond to requests from, or provide PHI directly to, any individuals whose PHI is governed by this Agreement, the Business Associate agrees to the following:
a. The Business Associate shall use and/or disclose the PHI only as permitted or required by this Agreement or as otherwise required by law;
b. The Business Associate shall use appropriate safeguards to maintain the privacy and security of PHI, and prevent unauthorized use and/or disclosure of PHI in violation of this Agreement.
c. The Business Associate shall report to the designated Privacy Officer of the County, in writing, any use or disclosure of PHI not provided for in this Agreement, including Security Incidents and Breaches of uPHI, of which Business Associate becomes aware.
(1) Business Associate shall provide such notice without unreasonable delay, but in any event no later than five (5) business days from the Business Associate’s discovery of such Security Incident or Breach. Such written notice shall include:
A. A brief description of what happened, including the date of the Breach and the date of the discovery of the Breach, if known;
B. The scope of the incident, including the types of uPHI involved such as full name, social security number, date of birth, home address, account number, billing code, disability code, or other types of similar information;
C. The identification of each individual whose uPHI has been, or is reasonably believed by Business Associate to have been accessed, acquired, or disclosed during such Breach, including the individual’s first and last name, mailing address, street address, phone number, email address, if known;
D. The identification of the party responsible for causing the Breach or Security Incident, including first and last name, mailing address, street address, phone number, email address, if known;
E. The steps individuals should take to protect themselves from potential harm resulting from the Breach or Security Incident;
F. A description of what the Business Associate is doing to investigate the Breach or Security Incident, to mitigate losses and to protect against any further breaches or incidents; and
G. Contact procedures for individuals to ask questions or learn additional information, which shall include a toll-free number, an e- mail address, web site, or postal address.
(2) The Business Associate shall have a continuing duty to inform the Coun...
