Laserfiche WebLink
24 <br />EXHIBIT B <br />Business Associate Agreement <br /> <br />I. Purpose <br />A. Business Associate is contractually obligated to provide certain services <br />related to one or more “covered entities” as that term is defined and <br />regulated under HIPAA. The parties to this Business Associate Agreement <br />acknowledge that (1) Business Associate is a “business associate” as that <br />term is defined and regulated under the Health Insurance Portability and <br />Accountability Act of 1996, as amended (“HIPAA”); and (2) Business <br />Associate provides services to one of more “covered entities” as that term <br />is defined and regulated under HIPAA. <br />B. This Business Associate Agreement is intended to constitute a “business <br />associate” agreement between the Plan, as a Covered Entity, and the <br />Business Associate, as required under the privacy and security provisions of <br />HIPAA, as amended. Portions of HIPAA apply directly to Business Associate <br />as provided in the Health Information Technology for Economic and Clinical <br />Health Act (“HITECH”), part of the American Recovery and Reinvestment <br />Act of 2009 (“ARRA”). Business Associate’s obligations under this Business <br />Associate Agreement may be the same as, or in some cases in addition to, <br />Business Associate’s own obligations under HIPAA as provided in HITECH. <br />II. Special Definitions <br />The definitions applicable under the Master Administration Agreement entered <br />between Business Associate and Plan Sponsor apply to this Business Associate <br />Agreement. In addition, the following definitions apply to terms used in this <br />Business Associate Agreement: <br /> <br />A. Business Associate Agreement – means this Business Associate <br />Agreement, which is an agreement required under 45 C.F.R. Section <br />164.314(a)(2) between a Business Associate and a Covered Entity. <br />B. ARRA – means the American Recovery and Reinvestment Act of 2009. <br />C. Breach – means the unauthorized acquisition, access, use, or disclosure of <br />Protected Health Information regarding a Covered Individual that (1) prior <br />to September 23, 2013, poses a significant risk of financial, reputational, or <br />other harm to such Covered Individual, or (2) on or after September 23, <br />2013, compromises the security or privacy of the Protected Health <br />Information as determined in accordance with 45 C.F.R. Section 164.402. <br />Notwithstanding the foregoing, a Breach does not include: (1) any <br />unintentional acquisition, access, or use of Protected Health Information by