Agenda - 05-19-2009 - 4l - Laserfiche WebLink

Browse Search

ensure that its employees' actions or omissions do not cause Business Associate to breach the terms of this Agreement. (b) Notwithstanding the prohibitions set forth in this Agreement, Business Associate may use and disclose Protected Health Information as follows: (i) if necessary, for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided that as to any such disclosure, the following requirements are met: (A) the disclosure is required by law; or (B) Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached; (ii) for data aggregation services, if to be provided by Business Associate for the health care operations of Covered Entity pursuant to any agreements between the Parties evidencing their business relationship. For purposes of this Agreement, data aggregation services means the combining of Protected Health Information by Business Associate with the protected health information received by Business Associate in its capacity as a business associate of another covered entity, to permit data analyses that relate to the health care operations of the respective covered entities. (c) Business Associate will implement appropriate safeguards to prevent use or disclosure of Protected Health Information other than as permitted in this Agreement. Business Associate will implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of any Electronic Protected Health Information that it creates, receives, maintains, or transmits on behalf of Covered Entity as required by the HIPAA Security and Privacy Rule. (d) The Secretary of Health and Human Services shall have the right to audit Business Associate's records and practices related to use and disclosure of Protected Health Information to ensure Covered Entity's compliance with the terms of the HIPAA Security and Privacy Rule. (e) Business Associate shall report to Covered Entity (see Exhibit B) any use or disclosure of Protected Health Information which is not in compliance with the terms of this Agreement, as well as any Security Incident, of which it becomes aware within forty-eight (48) hours of such discovery. For purposes of this Agreement, "Security Incident" means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system. In addition, Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement, as well as to provide complete cooperation to Covered Entity should Covered Entity elect to review or investigate such noncompliance or Security Incident. Business Associate shall indemnify and hold harmless Covered Entity for any injury or damages arising from any noncompliance or Security Incident attributable to the negligence of Business Associate, including the failure to execute the terms of this Agreement. III. AVAILABILITY OF PHI