2012-417 EMS - EMS Management & Consultants for Update Business Associate Agreement in ref to HIPAA

Browse Search

"covered account" as defined in 16 C.F.R. § 681.1 (as applicable to Covered Entity as a "creditor" and therefore to Business Associate as a "service provider" providing any service to Covered Entity), Business Associate agrees to: (i) fully adopt and comply with the Red Flag Rules currently in effect and as may be promulgated in the future; (ii) adopt a Red Flag program that is compliant with federal regulations as promulgated in 16 C.F.R. § 681.1; and (iii) take all necessary and appropriate steps to ensure that its activities undertaken as a part of this Agreement are conducted in accordance with the Red Flag Rules and its Red Flag program, including, without limitation, ensuring the adoption of and continued compliance with reasonable policies and procedures designed to detect, prevent, and mitigate the risk of identity theft, detecting any Red Flag that may arise during the term of this Agreement, reporting any such Red Flag to Covered Entity, and taking any such further steps as may be necessary to prevent or mitigate identity theft. VIII. TERM AND TERMINATION a. Term. The Term of this Agreement shall be effective as of the date first written above, and shall terminate upon the later of the following events: (i) in accordance with Section VIII.c.,when all of the Protected Health Information provided by Covered Entity to Business Associate or created or received by Business Associate on behalf of Covered Entity is destroyed or returned to Covered Entity or, if such return or destruction is infeasible, when protections are extended to such information; or(ii)upon the expiration or termination of the last of the Agreements. b. Termination for Cause. Upon Covered Entity's knowledge of a material breach of this Agreement by Business Associate, Covered Entity shall have the right to immediately terminate this Agreement and the Agreements. If termination is not feasible, Covered Entity shall report such violation to the Secretary. C. Effect of Termination. I. Except as provided in paragraph 2. of this subsection, upon termination of this Agreement, the Agreements or upon request of Covered Entity, whichever occurs first, Business Associate shall within ten (10) days return or destroy all Protected Health Information received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity. This provision shall apply to Protected Health Information that is in the possession of subcontractors or agents of Business Associate. Neither Business Associate nor its subcontractors or agents shall retain copies of the Protected Health Information. 2. In the event that Business Associate determines that returning or destroying the Protected Health Information is infeasible, Business Associate shall provide within ten(10) days to Covered Entity notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Parties that return or destruction of Protected Health Information is infeasible, Business Associate shall extend the protections of this Agreement to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such Protected Health Information. IX. MISCELLANEOUS a. Indemnification. Business Associate shall indemnify and hold Covered Entity harmless from and against all claims, liabilities, judgments, fines, assessments, penalties, awards, or other expenses, of any kind or nature whatsoever, including, without limitations, attorneys' fees, expert witness fees, and costs of investigation, litigation or dispute resolution, relating to or arising out of any breach or 8