2003-04-23 CC Packet - Laserfiche WebLink

Home Browse Search

f. Access to and Accountings of PHI. STANTON shall make available to CE's Plan Participants such information as required to fulfill the Plan's obligations to provide access to, provide a copy of, and account for disclosures with respect to PHI pursuant to HIPAA and the HIPAA Regulations, including, but not limited to, 45 CFR Sections 164.524 and 164.528. STANTON shall also retain a copy of its list of disclosures of PHI and provide such list to CE upon request and/or upon termination of this Agreement g. Amendment of PHI. STANTON shall make the PHI of a Plan Participant available to that Participant and also shall receive, review and respond to requests for amendment or correction of the PHI of a requesting Plan Participant as required to fulfill the Plan's obligations to amend PHI pursuant to HIPAA and the HIPAA Regulations, including, but not limited to, 45 CFR Section 164.526 and STANTON shall incorporate any amendments to the Plan's PHI into copies of such PHI maintained by Business Associate h. Internal Practices. STANTON shall make its internal practices, books and records relating to the use and disclosure of PHI received from CE (or created or received by STANTON on behalf of CE) available to the Secretary for purposes of determining STANTON's compliance with the Privacy Rule. i. Notification of Breach. During the term of this Addendum, STANTON shall notify CE within forty-eight (48) hours or if later, by the end of the next business day of any suspected or actual breach of security, intrusion or unauthorized use or disclosure of PHI and/or any actual or suspected use or disclosure of data in violation of any applicable federal or state laws or regulations. STANTON shall take (i) prompt corrective action to cure any such deficiencies and (ii) any action pertaining to such unauthorized disclosure required by applicable federal and state laws and regulations. j. Document Retention. STANTON shall maintain PHI for a period of six years from the date received or transmitted, unless CE agrees to receive and store the PHI itself. 3. Obligations of CEo a. Disclosure of PHI in accordance with Privacy Rule. Pursuant to the terms of this Addendum and the Privacy Rule, CE shall disclose PHI to STANTON in accordance with the Privacy Rule and this Addendum. Disclosure under this Addendum may also include disclosure directly to STANTON from CE's agents or subcontractors, or another covered entity or business associate of the CE (besides the health plan, which may include but is not limited to a claims administrator, insurer, third party administrator or health care provider or clearinghouse) which maintains and has access to the CE's PHI, provided that such disclosure is in accordance with the Privacy Rule and any contracts regarding disclosures of PHI entered into between the CE and the agent, subcontractor, other covered entity or business associate of the CEo 1514541v4 A-3