2009-060 Health - State of NC Health Dept

Browse Search

:arolidned AOmaeM designee. Page T 7 of 19 h. "Security Incident" shell' have the same meaning as the term "security incident" in 45 CFR 164.304. Unless otherwise defined in this Agreement, terms used herein shall have the same meaning as those terms have in the Privacy and Security Rules. 3. OBLIGATIONS OF BUSINESS ASSOCIATE a: Business Associate agrees to not use or disclose electronic protected health information or other protected health information other than as permitted or required by this Agreenmennt ~ as required by Iaw. b. Business Associate agrees to implement administrative, pbysical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information and other protected health information that it creates, receives, maintains, or transmits on behalf of a Covered Entity, as required by the Privacy and Security Rules. C. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of electronic protected health information or other protected health information by a Business Associate in violation of the requirements of this Agreerrrcnt. d. Business Associate agrees to report to Covered Entity (i) any use or disclosure of electronic protected health information or other protected health information not provided for by this Agreement of which it becomes aware and (ii) any security incident of which it becomes aware. e. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides electronic protected health information and/or other protected health information recxived from, or created or received by Business Associate on behalf of Covered Entity (i) agrees to be bound by the same restrictions antl conditions that apply through this Agreement to Business Associate with respect to such information, and (ii) agrces to implement reasonable and appropriate safeguards m protect such information. Business Associate agrees to provide acces.~, at the request of Covered Entity, to electronic protected health information and other protected health information in a Designated Record Sd to a Covered Entity or, as directed by a Covered Entity, to an individual in order to rrtect the requirements order 45 CFR I64.524. g. Business Associate agrees, at the request of a Covered Entity, to make any amendment(s) to electronic protected health information and other protected health information in a Designated Record Set that a Covered Entity directs or agr+ces to pursuant. to 45 CFR 164.526. h. Unless otherwise prohibited by Law, Business Associate agrees to make internal practices, books, and records, including policies and procedures concerning electronic protected health information and other protected health informration, relating to the use and disclosure. of electronic protected health information and other protected health information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Secretary, in a time and manner designated by the Secretary, for purposes of the Secretary determining Covered Entity's compliance with the Privacy and Security Rules. Business Associate agrees to document such disclosures of electronic protected health information and other protected heahh information related to such disclosures as would be raluirod for Covered Entity to respond to a request by an individual for an accounting of disclosures of electronic protected health information and other protected health information in accordance with 45 CFR 164.528, and to provide this information to Covered Entity or an individual to permit such a response.