2020_0608_CCPacket - Laserfiche WebLink

Home

C. Limitations oand Disclosures. With respect to Protected Health Information that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity, Business Associate will not use or further disclose the Protected Health Information other than as permitted or required by this Agreement (including, but not limited to, any restrictions described in Section III.E.4) or as Required by Law. D. Additional Obligations of Business Associate. Except as otherwise specified in this Agreement, the provisions of this Paragraph III.D. apply only to Protected Health Information that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity. 1. Safeguards. Business Associate will use appropriate safeguards to prevent the improper use of, disclosure of, and tampering with Protected Health Information and to reasonably and appropriately protect the confidentiality, integrity, and availability of the Protected Health Information. 2. Reporting and Mitigation. Business Associate will report to Covered Entity any acquisition, access, use, or disclosure of Protected Health Information of which Business Associate becomes aware, or that is reported to Business Associate by an agent or Subcontractor, that is in violation of this Agreement. Such report shall be made within ten (10) business days of its discovery (as that term is defined in 45 C.F.R. Section 164.410(a)(2)) by Business Associate. Business Associate agrees to promptly mitigate, to the extent practicable, any harmful effect that is known to Business Associate of an acquisition, access, use, or disclosure in violation of this Agreement. This obligation includes, but is not limited to, any acquisition, access, use, or disclosure of Unsecured Protected Health Information that may constitute a Breach. The determination of whether a Breach has occurred, and of the resultant action, shall be the responsibility of Covered Entity. 3. Agents and Subcontractors. Business Associate will enter into a written contract with any agent or Subcontractor who creates, receives, maintains, or transmits Protected Health Information on behalf of Business Associate that requires such agent or Subcontractor to comply with the same restrictions and conditions that apply by and through this Agreement to Business Associate with respect to such information. 4. Access to Protected Health Information. Within fifteen (15) days of a request by Covered Entity for access to Protected Health Information about a Covered Individual, Business Associate shall make available to Covered Entity or, as directed by Covered Entity, a Covered Individual such Protected Health Information contained in a Designated Record Set. If the Protected Health Information requested by Covered Entity is maintained in a Designated Record Set electronically, Business Associate shall make available, within the time period specified above, a copy of such information in the electronic form and format specified by Covered Entity, provided such information is readily producible in such form and format. If the information is not readily producible in such form and format, Business Associate shall make the information available in a readable electronic form and format as agreed to by the parties. In the event any Covered Individual requests access to Protected Health Information directly from Business Associate, Business Associate shall within five (5) days forward such MEDSURETY, LLC 30 Administration Agreement (Non-ERISA) Exhibit Business Associate Agreement