2012-417 EMS - EMS Management & Consultants for Update Business Associate Agreement in ref to HIPAA

Browse Search

address,account number, diagnosis, disability code, or other types of information were involved; 4. any steps individuals should take to protect themselves from potential harm resulting from the Breach; 5. a brief description of what Business Associate is doing to investigate the Breach, to mitigate harm to individuals,and to protect against any further Breaches; and 6. contact procedures for individuals to ask questions or learn additional information, which shall include a toll-free telephone number, an e-mail address, Web site, or postal address. e. Business Associate shall provide the information specified in Section IVA., above, to Covered Entity at the time of the Breach notification if possible or promptly thereafter as information becomes available, Business Associate shall not delay notification to Covered Entity that a Breach has occurred in order to collect the information described in Section IV A. and shall provide such information to Covered Entity even if the information becomes available after the forty-five (45)-day period provided for initial Breach notification. V. WARRANTIES OF BUSINESS ASSOCIATE Business Associate warrants: a. That its internal practices, policies, and records relating to the use and disclosure of Protected Health Information will comply with the HIPAA Privacy and Security Rules; and b. That it will train all of its employees, agents, representatives, and subcontractors on the network access and other security practices, procedures and/or policies established by Covered Entity including, without limitation, those established pursuant to the HIPAA Privacy and Security Rules and the Red Flag Rules prior to permitting such employees, agents, representatives, and subcontractors to be present at any Covered Entity facility and/or to access Covered Entity's computer network(s). VI. OBLIGATIONS OF COVERED ENTITY a. Upon request of Business Associate, Covered Entity shall provide Business Associate with the notice of privacy practices that Covered Entity produces in accordance with Section 164.520 of the HIPAA Privacy and Security Rules. b. Covered Entity shall provide Business Associate with any changes in, or revocation of, permission by an individual to use or disclose Protected Health Information, if such changes affect Business Associate's permitted or required uses and disclosures. C. Covered Entity shall notify Business Associate of any restriction to the use or disclosure of Protected Health Information to which Covered Entity has agreed in accordance with Section 164.522 of the HIPAA Privacy and Security Rules, and Covered Entity shall inform Business Associate of the termination of any such restriction, and the effect that such termination shall have, if any, upon Business Associate's use and disclosure of such Protected Health Information. VII. REQUIRED COMPLIANCE WITH RED FLAG RULES In the event that Business Associate is engaged to perform an activity in connection with any 7