2012-417 EMS - EMS Management & Consultants for Update Business Associate Agreement in ref to HIPAA

Browse Search

I. DEFINITIONS Except as otherwise defined herein, any and all capitalized terms in this Agreement shall have the definitions set forth in the HIPAA Privacy and Security Rules, In the event of an inconsistency between the provisions of this Agreement and mandatory provisions of the HIPAA Privacy and Security Rules, as amended, or the Red Flag Rules, the HIPAA Privacy and Security Rules and the Red Flag Rules in effect at the time shall control. Where provisions of this Agreement are different than those mandated by the HIPAA Privacy and Security Rules or the Red Flag Rules, but are nonetheless permitted by the HIPAA Privacy and Security Rules or the Red Flag Rules,the provisions of this Agreement shall control. The term "Breach" means the unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of such information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information. The term "Breach" does not include: (1) any unintentional acquisition, access, or use of protected health information by any employee or individual acting under the authority of a covered entity or business associate if(a) such acquisition, access, or use was made in good faith and within the course and scope of the employment or other professional relationship of such employee or individual, respectively, with the covered entity or business associate, and (b) such information is not further acquired, accessed, used, or disclosed by any person; or(2) any inadvertent disclosure from an individual who is otherwise authorized to access protected health information at a facility operated by a covered entity or business associate to another similarly situated individual at same facility; and (3) any such information received as a result of such disclosure is not further acquired, accessed, used, or disclosed without authorization by any person. The term "Electronic Health Record" means an electronic record of health-related information on an individual that is created, gathered, managed, and consulted by authorized health care clinicians and staff. The term "HIPAA Privacy and Security Rules" refers to 45 C.F.R. Parts 160 and 164 as currently in effect or hereafter amended. The term "Protected Health Information" means individually identifiable health information including, without limitation, all information, data, documentation, and materials, including without limitation, demographic, medical and financial information, that relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and that identifies the individual or with respect to which there is reasonable basis to believe the information can be used to identify the individual. "Protected Health Information" includes, without limitation, "Electronic Protected Health Information,"as defined below. The term "Electronic Protected Health Information" means Protected Health Information which is transmitted by or maintained in Electronic Media(as now or hereafter defined in the HIPAA Privacy and Security Rules). The term "Red Flag Rules" refers to the provisions found at 16 C.F.R. § 681.1 as applicable to financial institutions and creditors subject to the administrative enforcement of the FCRA by the Federal Trade Commission pursuant to 15 U.S.C. § 168 1 s(a)(1). The term "Red Flag" has the same meaning as provided within 16 C.F.R. § 681.1(b)(9) and means a pattern,practice,or specific activity that indicates the possible existence of identity theft. The term"Secretary"means the Secretary of the Department of Health and Human Services. 2