2015_1130_CCpacket - Laserfiche WebLink

Home

3.1.4. Designated Record Set. If Business Associate maintains PHI in a Designated Record Set: (a) Access Request. Business Associate will provide PHI in a Designated Record Set to Covered Entity in order for Covered Entity to meet its obligations under 45 C.F.R. § 164.524. (b) Requests to Amend Designated Record Set. Business Associate will, upon written request from Covered Entity, amend PHI in a Designated Record Set, in order for Covered Entity to meet its obligations under 45 C.F.R. § 164.526. 3.1.5. Accounting for Disclosures. If Business Associate Discloses PHI that the Covered Entity must account for to an Individual under 45 C.F.R. § 164.528, Business Associate must document and keep sufficient records of each Disclosure so that Covered Entity can provide the required accounting. In arder far Covered Entity to meet its obligations under 45 C.F.R. § 164.528, Business Associate will provide the documentation to Covered Entity upon written request. 3.1.6. Reporting to Covered Entity. Except as provided in (b), Business Associate must report in writing to Covered Entity any Use or Disclosure of PHI not permitted or required by this BAA and any Security Incident involving Covered Entity's Electronic PHI, of which Business Associate becomes aware. (a) Business Associate will provide any and all information reasonably requested by Covered Entity with regard to any unauthorized Use, Disclosure, or Security Incident. This Section 3.1.6 applies in addition to, and whether or not there is a Breach of Unsecured PHI, as provided in Section 3.1.7. (b) An attempt by a third party to probe or test the vulnerability of Business Associate's information system or to interfere with that system that does not result in penetration of the firewall or perimeter security measures of Business Associate's system is not considered a"Security Incident" far purposes of Business Associate's reporting obligations under this BAA. 3.1.7. Notification of Breach of Unsecured PHI. Business Associate must provide written notice to the Covered Entity of any Breach of Unsecured PHI by Business Associate or Subcontractor ("BA Breach"), within 30 days of Business Associate's discovery of the BA Breach, or earlier if required by law. Each party agrees to cooperate with the other party's investigation of a Breach of Unsecured PHI, and each party bears the costs of its own investigation. 3.1.8. Performance by Business Associate of Covered Entity Obligation. To the extent Business Associate is carrying out an obligation of Covered Entity under the Privacy Regulation, Business Associate will comply with the requirements of the Privacy Regulation that would be applicable to Covered Entity in performance of that obligation. 1032762-6 18