2012-038 Human Resources - Delta Dental Claims & Administrative fees

Browse Search

NotiTication of Unauthorized Access, Use or Disclosure of Unsecured PHI. Business Associate shall notify Covered Entity in writing of any unauthorized access, use or disclosure of unsecured PHI as soon as reasonably possible but no later than five (5) days following the date of discovery. Such notice shall include: (a) a brief description of what happened, including the date of the breach and the date of the discovery, (b) the name(s) of the individual(s) whose PHI was used or disclosed, (c) the identity(ies) of the entity(ies)/person(s) to whom the use or disclosure was made, (d) description of the types of unsecured PHI that were disclosed, (e) the steps taken by Business Associate to discontinue and minimize the impact of any inappropriate use or disclosure. 6. Reporting. Business Associate shall report to the Plan any use or disclosure of PHI not provided for under Section III.A.2 of this Addendum of which Business Associate becomes aware. Additionally, Business Associate agrees that, to the extent practicable, it shall mitigate any harmful effect of a use or disclosure of PHI of which it becomes aware that is in violation of the requirements of Section III.A.2 of this Addendum. 7. Mitigation of Uaauthorized Access, Use or Disclosure of Unsecured PHI. Business Associate agrees that, to the extent pracricable, it shall mitigate any harmful effect resulting from any unauthorized acquisirion, use or disclosure of unsecured PHI caused by Business Associate's violation of the requirements of this Agreement or its failure to properly secure PHI in accordance with the April 17, 2009 guidelines published by the Depariment of Health and Human Services. 8. Agents and Subcontractors. Business Associate shall ensure that any subcontractors or agents to whom it provides PHI that has been created or received by Business Associate from or on behalf of the Plan agrees to the same restrictions and condirions with respect to such PHI as are applicable to Business Associate as set forth herein. Should Business Associate, at its sole discretion, enter into a written contract with such subcontractors or agents to assure that such subcontractors or agents abide by the same restrictions and conditions that apply to Business Associate with regard to PHI, Business Associate shall, upon request, provide a copy of such contract(s) to the Plan. 9. Requests for Information or Access. Business Associate shall process any requests it receives from individuals seeking access to or copies of PHI maintained by Business Associate for or on behalf of the Plan. T'he Plan hereby expressly delegates its authority regarding requests for access to Business Associate and agrees to abide by Business Associate's determinations to grant or deny access in accordance with the Privacy Rule. 10. Requests to Amend. Business Associate shall make any amendment(s) to PHI in a Designated Record Set that the Plan directs or agrees to pursuant to 45 CFR 164.526 at the request of the Plan or an Individual. The Business Associate shall make amendments as soon as administratively feasible. 11. Business Associate agrees to document disclosures of Protected Health Information, and information related to such disclosures, as would be required for Health Plan Sponsor to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR § 164.528 and any additional regulations promulgated by the Secretary pursuant to HITECH Act § 13405(c). Business Associate agrees to implement an appropriate record keeping process that will track, at a minimum, the following information: (i) the date of the disclosure; (ii) the name of the entity or person who received the Protected Health Information, and if lrnown, the address of such entity or person; (iii) a brief description of the Protected Health Information disclosed; and (iv) a brief statement of the purpose of such disclosure which includes an explanation of the basis for such disclosure. 12. Requests for Accountings. With respect to requests for an accounting, Business Associate shall notify the Plan in writing within twenty (20) business days of any requests received by Business Associate from individuals seeking an accounting of disclosures of PHI and respond to such requests only when and as directed by the Plan. Additionally, when and as directed by the Plan, Business Associate shall provide for an accounting to the Plan or the requesting individual (as directed) of any and all disclosures of PHI made Page 3 of 8 Exhibit C- Nonh Camlina - BA Addcndum 9201 I