2015_1130_CCpacket - Laserfiche WebLink

Home

(a) Must impose the same or greater restrictions, requirements and conditions with respect to PHI as this BAA imposes on Business Associate; and (b) Must require, with respect to Electronic PHI, that Subcontractor comply with the applicable requirements of the Security Regulation. 2.4.2. Response required in case of Subcontractor breach. If Business Associate knows of a pattern of activity or practice of its Subcontractor that is a material breach or violation of its business associate agreement with Subcontractor, Business Associate must take reasonable steps to cure the breach or end the violation, and if not successful, must terminate the contract with Subcontractor, if feasible. 2.5. As Required by Law. Business Associate may Use or Disclose PHI as Required by Law, including but not limited to Business Associate's obligation to disclose PHI to Secretary when requested for investigation or determination of Business Associate's compliance with the Regulations. 2.6. Minimum necessary. Any Use or Disclosure of, or request for, PHI by Business Associate must comply with the "minimum necessary" standard in 45 C.F.R. § 164.502(b). 2.7. De-identification of PHL Business Associate may create De-identified Information from PHI. 2.8. Other Uses and Disclosures Prohibited. Any Use or Disclosure of PHI by the Business Associate not expressly permitted or required by this BAA is prohibited. 3. RESPONSIBILITIES OF THE PARTIES WITH RESPECT TO PROTECTED HEALTH INFORMATION 3.1. Responsibilities of Business Associate. The Business Associate has the following responsibilities with regard to its creation, receipt, maintenance, Use, transmission or Disclosure of PHI: 3.1.1. Establish and use safeguards. Business Associate must (a) Establish and use appropriate safeguards to prevent the Use or Disclosure of PHI in any manner or for any purpose not permitted by this BAA; and (b) With regard to Electronic PHI, comply with the applicable provisions of the Security Regulation. 3.1.2. Mitigate harm. Business Associate must establish and follow procedures for mitigating harmful effects of Uses or Disclosures of PHI not permitted by the Regulations or this BAA. 3.1.3. Access and inspection by the Secretary. Business Associate must make available upon request all of its internal practices, records, books, agreements, policies and procedures relating to the Use or Disclosure of PHI to the Secretary for purpose of determining Covered Entity's compliance with the Regulations. 1032762-6 17