2020_0608_CCPacket - Laserfiche WebLink

Home

IV. Electronic Security Provisions A. Introduction. This section applies where Business Associate, on behalf of Covered Entity, performs or assists in the performance of functions and activities that may involve the creation, maintenance, receipt, or transmission of Electronic Protected Health Information. This Section IV along with the other sections of the Business Associate Agreement are (1) provisions of Security Rule, and (2) govern the terms and conditions under which the Business Associate may create, maintain, receive, and transmit Electronic Protected Health Information on behalf of Covered Entity. In general, Business Associate agrees and intends to act such that (1) Covered Entity can fulfill its responsibilities under HIPAA; (2) Business Associate can fulfill its responsibilities under HIPAA; and (3) Business Associate can fulfill its contractual obligations under this Agreement. B. Obligations of Business Associate. In accordance with the Security Rule, Business Associate agrees to: 1. Conduct a security risk assessment (in accordance with 45 C.F.R. Section 164.308(a)(1)(ii)(A)) and adopt and implement policies and procedures designed to ensure compliance with the Security Rule and this Agreement including, but not limited to, identifying a security officer and training personnel. This Paragraph IV.B.1 shall be effective as of the compliance date applicable under the final regulations issued under HITECH that address this requirement. 2. Implement administrative, physical and technical safeguards (including written policies and procedures) that reasonably and appropriately protect the confidentiality, integrity, and availability of the Electronic Protected Health Information that Business Associate creates, maintains, receives, or transmits on behalf of Covered Entity; 3. Report to Covered Entity any Security Incident of which Business Associate becomes aware within ten (10) business days of its discovery by the Business Associate; 4. Promptly mitigate, to the extent practicable, any harmful effect of a Security Incident that is known to Business Associate; and 5. Enter into a written contract with any agent or Subcontractor to whom Business Associate provides Electronic Protected Health Information that requires such agent or Subcontractor to comply with the same restrictions and conditions that apply under this Section IV to Business Associate, including, but not limited to, implementing reasonable and appropriate safeguards to protect such information. C. Obligations of Covered Entity. Covered Entity shall not request or direct Business Associate to create, maintain, receive, or transmit Electronic Protected Health Information in any manner that would not be permissible under the Security Rule. V. Breach Notification Requirements If Business Associate accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses Unsecured Protected Health Information, Business Associate shall notify Covered Entity of a Breach of such Unsecured Protected Health Information without MEDSURETY, LLC 33 Administration Agreement (Non-ERISA) Exhibit Business Associate Agreement