Laserfiche WebLink
27 <br />V. Required By Law – shall have the same meaning as the term “required <br />by law” in 45 C.F.R. Section 164.103. It does not include “permitted by <br />law.” <br />W. Secretary – means the Secretary of the Department of Health and Human <br />Services or his/her designee. <br />X. Security Incident – shall have the same meaning as the term “security <br />incident” in 45 C.F.R. Section 164.304, unless defined differently in Covered <br />Entity’s policies and procedures for compliance with the Security Rule, which <br />shall be provided to the Business Associate. <br />Y. Security Rule – means the Security Standards and Implementation <br />Specifications at 45 C.F.R. Part 160 and Part 164, subpart C and the security <br />provisions of HIPAA, as amended. <br />Z. Standards for Electronic Transactions Rule - means the final <br />regulations issued by HHS concerning standard transactions and code sets <br />under the Administrative Simplification provisions of HIPAA, 45 C.F.R. Part <br />160 and Part 162. <br />AA. Subcontractor – means an agent of a Business Associate described in 45 <br />C.F.R. Section 165.103 to whom the Business Associate provides protected <br />health information that the Business Associate creates, receives, maintains, <br />or transmits on behalf of a Covered Entity. <br />BB. Unsecured Protected Health Information – means Protected Health <br />Information that has not been rendered unusable, unreadable, or <br />indecipherable to unauthorized individuals through the use of a <br />technology or methodology specified by the Secretary. As of August 24, <br />2009, the Secretary has specified the following technologies and <br />methodologies that will render Protected Health Information unusable, <br />unreadable, and indecipherable (i.e., secured Protected Health <br />Information): (1) encryption as described in the Secretary’s guidance and <br />determined by the National Institute of Standard and Technology to meet <br />the standards described in such guidance, or (2) destruction, in <br />accordance with the procedures identified in the Secretary’s guidance, of <br />the media on which the Protected Health Information was stored or <br />recorded. <br />III. Privacy Provisions <br />A. Introduction. Business Associate, on behalf of Covered Entity, performs <br />or assists in the performance of functions and activities that may involve