Security of EPHI Sample Clauses

Security of EPHI. Business Associate agrees to comply with the applicable standards of 45 CFR §§ 164.306, 164.308, 164.310, 164.312, 164.314, and 164.316 with respect to EPHI.
Sample 1Sample 2Sample 3See All (5)
AutoNDA by SimpleDocs
Security of EPHI. In the event County discloses ePHI to Contractor or Contractor needs to create, receive, maintain, transmit or have access to County ePHI, in accordance with 42 USC §17931 and 45 CFR §164.314(a)(2)(i), and §164.306, Contractor shall: 1. Comply with the applicable requirements of the Security Rule, and implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI that Contractor creates, receives, maintains, or transmits on behalf of County in accordance with 45 CFR §164.308, §164.310, and §164.312; 2. Comply with each of the requirements of 45 CFR §164.316 relating to the implementation of policies, procedures and documentation requirements with respect to ePHI; 3. Protect against any reasonably anticipated threats or hazards to the security or integrity of ePHI; 4. Protect against any reasonably anticipated uses or disclosures of ePHI that are not permitted or required under the Privacy Rule; 5. Ensure compliance with the Security Rule by Contractor’s workforce; 6. In accordance with 45 CFR §164.308(b)(2), require that any subcontractors that create, receive, maintain, transmit, or access ePHI on behalf of Contractor agree through contract to the same restrictions and requirements contained in this Addendum and comply with the applicable requirements of the Security Rule; 7. Report to County any security incident of which Contractor becomes aware, including breaches of unsecured PHI as required by 45 CFR §164.410; and, 8. Comply with any additional security requirements that are applicable to covered entities in Title 42 (Public Health and Welfare) of the United States Code, as may be amended from time to time, including but not limited to HITECH.
Sample 1Sample 2
Security of EPHI. With respect to the use or disclosure of ePHI, the Manager agrees: (a) To implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of ePHI that it creates, receives, maintains or transmits on behalf of the Partnership, as required by 45 C.F.R. Part 164, Subpart C; (b) Promptly report to the Partnership any "Security Incident" of which it becomes aware (as such term is defined by 45 C.F.R. Section 164.304). The Security Incident report shall include, but not be limited to, the following information: (i) The date of the Security Incident; (ii) The scope of the Security Incident; (iii) The Manager's response to the Security Incident; (iv) The identification of the party responsible for causing the Security Incident, if known; and (v) Any additional information the Partnership may request in connection with the Security Incident; and (c) Ensure that any agent, including a subcontractor, to whom it provides ePHI agrees to implement reasonable and appropriate safeguards to protect ePHI.
Sample 1Sample 2
Security of EPHI. In the event County discloses ePHI to Contractor or Contractor needs to create, 35 receive, maintain, transmit or have access to County ePHI, in accordance with 42 USC §17931 and 36 45 CFR §164.314(a)(2)(i), and §164.306, Contractor shall: 37 A. Comply with the applicable requirements of the Security Rule, and implement administrative, 38 physical, and technical safeguards that reasonably and appropriately protect the confidentiality, 39 integrity, and availability of ePHI that Contractor creates, receives, maintains, or transmits on 40 behalf of County in accordance with 45 CFR §164.308, §164.310, and §164.312; 1 B. Comply with each of the requirements of 45 CFR §164.316 relating to the implementation of 2 policies, procedures and documentation requirements with respect to ePHI; 3 C. Protect against any reasonably anticipated threats or hazards to the security or integrity of ePHI; 4 D. Protect against any reasonably anticipated uses or disclosures of ePHI that are not permitted or 5 required under the Privacy Rule; 6 E. Ensure compliance with the Security Rule by Xxxxxxxxxx’s workforce; 7 F. In accordance with 45 CFR §164.308(b)(2), require that any subcontractors that create, receive, 8 maintain, transmit, or access ePHI on behalf of Contractor agree through contract to the same 9 restrictions and requirements contained in this Addendum and comply with the applicable 10 requirements of the Security Rule; 11 G. Report to County any security incident of which Contractor becomes aware, including breaches 12 of unsecured PHI as required by 45 CFR §164.410; and, 13 H. Comply with any additional security requirements that are applicable to covered entities in Title 14 42 (Public Health and Welfare) of the United States Code, as may be amended from time to time, 15 including but not limited to HITECH.
Sample 1

Related to Security of EPHI

  • Security of Data a. Each of the parties shall: i. ensure as far as reasonably practicable, that Data is properly stored, is not accessible to unauthorised persons, is not altered, lost or destroyed and is capable of being retrieved only by properly authorised persons; ii. subject to the provisions of Sub-Clause 8.a. ensure that, in addition to any security, proprietary and other information disclosure provision contained in the Contract, Messages and Associated Data are maintained in confidence, are not disclosed or transmitted to any unauthorised person and are not used for any purpose other than that communicated by the sending party or permitted by the Contract; and iii. protect further transmission to the same degree as the originally transmitted Message and Associated Data when further transmissions of Messages and Associated Data are permitted by the Contract or expressly authorised by the sending party. b. The sending party shall ensure that Messages are marked in accordance with the requirements of the Contract. If a further transmission is made pursuant to Sub-Clause 3. a. iii. the sender shall ensure that such markings are repeated in the further transmission. c. The parties may apply special protection to Messages by encryption or by other agreed means, and may apply designations to the Messages for protective Interchange, handling and storage procedures. Unless the parties otherwise agree, the party receiving a Message so protected or designated shall use at least the same level of protection and protective procedures for any further transmission of the Message and its Associated Data for all responses to the Message and for all other communications by Interchange or otherwise to any other person relating to the Message. d. If either party becomes aware of a security breach or breach of confidence in relation to any Message or in relation to its procedures or systems (including, without limitation, unauthorised access to their systems for generation, authentication, authorisation, processing, transmission, storage, protection and file management of Messages) then it shall immediately inform the other party of such breach. On being informed or becoming aware of a breach the party concerned shall: i. immediately investigate the cause, effect and extent of such breach; ii. report the results of the investigation to the other party; and iii. use all reasonable endeavours to rectify the cause of such breach. e. Each party shall ensure that the contents of Messages that are sent or received are not inconsistent with the law, the application of which could restrict the content of a Message or limit its use, and shall take all necessary measures to inform without delay the other party if such an inconsistency arises.

  • Security of Vendor Facilities All Vendor and Vendor Staff facilities in which Citizens Confidential Information is located or housed shall be maintained in a reasonably secure manner. Within such facilities, all printed materials containing Citizens Confidential Information should be kept locked in a secure office, file cabinet, or desk (except when materials are being used).

  • Security Bond The security bond provides protection to Owner if Contractor presents an acceptable guaranteed maximum price (“GMP”) to Owner but is unable to deliver the required payment and performance bonds within the time period stated below.

  • Security of processing (a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter ‘personal data breach’). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subjects. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security. (b) The data importer shall grant access to the personal data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. (c) In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify the data exporter without undue delay after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the breach including, where appropriate, measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay. (d) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.

  • Contractor Security Clearance Customers may designate certain duties and/or positions as positions of “special trust” because they involve special trust responsibilities, are located in sensitive locations, or have key capabilities with access to sensitive or confidential information. The designation of a special trust position or duties is at the sole discretion of the Customer. Contractor or Contractor’s employees and Staff who, in the performance of this Contract, will be assigned to work in positions determined by the Customer to be positions of special trust, may be required to submit to background screening and be approved by the Customer to work on this Contract.

  • Security of Information Unless otherwise specifically authorized by the DOH Chief Information Security Officer, Contractor receiving confidential information under this contract assures that: • Encryption is selected and applied using industry standard algorithms validated by the National Institute of Standards and Technology (NIST) Cryptographic Algorithm Validation Program against all information stored locally and off-site. Information must be encrypted both in-transit and at rest and applied in such a way that it renders data unusable to anyone but authorized personnel, and the confidential process, encryption key or other means to decipher the information is protected from unauthorized access. • It is compliant with the applicable provisions of the Washington State Office of the Chief Information Officer (OCIO) policy 141, Securing Information Technology Assets, available at: xxxxx://xxxx.xx.xxx/policy/securing-information-technology-assets. • It will provide DOH copies of its IT security policies, practices and procedures upon the request of the DOH Chief Information Security Officer. • DOH may at any time conduct an audit of the Contractor’s security practices and/or infrastructure to assure compliance with the security requirements of this contract. • It has implemented physical, electronic and administrative safeguards that are consistent with OCIO security standard 141.10 and ISB IT guidelines to prevent unauthorized access, use, modification or disclosure of DOH Confidential Information in any form. This includes, but is not limited to, restricting access to specifically authorized individuals and services through the use of: o Documented access authorization and change control procedures; o Card key systems that restrict, monitor and log access; o Locked racks for the storage of servers that contain Confidential Information or use AES encryption (key lengths of 256 bits or greater) to protect confidential data at rest, standard algorithms validated by the National Institute of Standards and Technology (NIST) Cryptographic Algorithm Validation Program (CMVP); o Documented patch management practices that assure all network systems are running critical security updates within 6 days of release when the exploit is in the wild, and within 30 days of release for all others; o Documented anti-virus strategies that assure all systems are running the most current anti-virus signatures within 1 day of release; o Complex passwords that are systematically enforced and password expiration not to exceed 120 days, dependent user authentication types as defined in OCIO security standards; o Strong multi-factor authentication mechanisms that assure the identity of individuals who access Confidential Information; o Account lock-out after 5 failed authentication attempts for a minimum of 15 minutes, or for Confidential Information, until administrator reset; o AES encryption (using key lengths 128 bits or greater) session for all data transmissions, standard algorithms validated by NIST CMVP; o Firewall rules and network address translation that isolate database servers from web servers and public networks; o Regular review of firewall rules and configurations to assure compliance with authorization and change control procedures; o Log management and intrusion detection/prevention systems; o A documented and tested incident response plan Any breach of this clause may result in termination of the contract and the demand for return of all personal information.

  • Security of State Information The Contractor represents and warrants that it has implemented and it shall maintain during the term of this Contract the highest industry standard administrative, technical, and physical safeguards and controls consistent with NIST Special Publication 800-53 (version 3 or higher) and Federal Information Processing Standards Publication 200 and designed to (i) ensure the security and confidentiality of State Data; (ii) protect against any anticipated security threats or hazards to the security or integrity of the State Data; and (iii) protect against unauthorized access to or use of State Data. Such measures shall include at a minimum: (1) access controls on information systems, including controls to authenticate and permit access to State Data only to authorized individuals and controls to prevent the Contractor employees from providing State Data to unauthorized individuals who may seek to obtain this information (whether through fraudulent means or otherwise); (2) industry-standard firewall protection; (3) encryption of electronic State Data while in transit from the Contractor networks to external networks; (4) measures to store in a secure fashion all State Data which shall include multiple levels of authentication; (5) dual control procedures, segregation of duties, and pre-employment criminal background checks for employees with responsibilities for or access to State Data; (6) measures to ensure that the State Data shall not be altered or corrupted without the prior written consent of the State; (7) measures to protect against destruction, loss or damage of State Data due to potential environmental hazards, such as fire and water damage; (8) staff training to implement the information security measures; and (9) monitoring of the security of any portions of the Contractor systems that are used in the provision of the services against intrusion on a twenty-four (24) hour a day basis.

  • Security Audit Customer agrees that PROS’ Audit Report will be used to satisfy any audit or inspection requests by or on behalf of Customer, and PROS will make Audit Reports available to Customer upon request. PROS will promptly remediate any material weaknesses or significant control deficiencies identified in any Audit Reports. In the event that an audit opinion is qualified and the qualification has not been remediated by the date of the Audit Report, PROS shall (i) provide Customer with PROS remediation plan; and (ii) execute such plan in accordance with its terms.

  • Security of Access Code You may use one (1) or more access codes with your electronic fund transfers. The access codes issued to you are for your security purposes. Any access codes issued to you are confidential and should not be disclosed to third parties or recorded on or with the card. You are responsible for safekeeping your access codes. You agree not to disclose or otherwise make your access codes available to anyone not authorized to sign on your accounts. If you authorize anyone to use your access codes, that authority shall continue until you specifically revoke such authority by notifying the Credit Union. You understand that any joint owner you authorize to use an access code may withdraw or transfer funds from any of your accounts. If you fail to maintain the security of these access codes and the Credit Union suffers a loss, we may terminate your EFT services immediately.

  • Priority of Security Interest Borrower represents, warrants, and covenants that the security interest granted herein is and shall at all times continue to be a first priority perfected security interest in the Collateral (subject only to Permitted Liens that are permitted pursuant to the terms of this Agreement to have superior priority to Bank’s Lien under this Agreement). If Borrower shall acquire a commercial tort claim, Borrower shall promptly notify Bank in a writing signed by Borrower of the general details thereof and grant to Bank in such writing a security interest therein and in the proceeds thereof, all upon the terms of this Agreement, with such writing to be in form and substance reasonably satisfactory to Bank.

Draft better contracts in just 5 minutes Get the weekly Law Insider newsletter packed with expert videos, webinars, ebooks, and more!