|
implement administrative, physical, and technical safeguards that reasonably and appropriately protect
<br /> the confidentiality, integrity, and availability of any Electronic Protected Health Information that it
<br /> creates, receives, maintains, or transmits on behalf of Covered Entity as required by the HIPAA
<br /> Security and Privacy Rule.
<br /> (f) To the extent applicable, Business Associate will comply with (i) Covered Entity's Notice
<br /> of Privacy Practices; (ii) any limitations to which Covered Entity has agreed in regard to an Individual's
<br /> permission to use or disclose his or her Protected Health Information; and (iii) any restrictions to the
<br /> use or disclosure of Protected Health Information to which Covered Entity has agreed or is required to
<br /> agree.
<br /> (g) Business Associate will make its internal practices, books and records available to the
<br /> Secretary of the Department of Health and Human Services for purposes of determining compliance
<br /> with the terms of the HIPAA Security and Privacy Rule, and, at the request of the Secretary, will comply
<br /> with any investigations and compliance reviews, permit access to information, and cooperate with any
<br /> complaints, as required by law. Without unreasonable delay and, in any event, no more than 48 hours
<br /> of receipt of the request or notification, Business Associate will notify Covered Entity in writing of any
<br /> request by any governmental entity, or its designee, to review Business Associate's compliance with
<br /> law or this BAA, to pursue a complaint, or to conduct an audit or assessment of any kind.
<br /> (h) Business Associate shall report to Covered Entity (see Exhibit B) any use or disclosure
<br /> of Protected Health Information that is not in compliance with the terms of this Agreement, as well as
<br /> any Security Incident and any actual or suspected Breach, of which it becomes aware, without
<br /> unreasonable delay, and in no event later than forty-eight (48) hours of such discovery. For purposes
<br /> of this Agreement, "Security Incident" means the attempted or successful unauthorized access, use,
<br /> disclosure, modification, or destruction of information or interference with system operations in an
<br /> information system. Such notification shall contain the elements required by 45 C.F.R. 164.410. In
<br /> addition, Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is
<br /> known to Business Associate of a use or disclosure of Protected Health Information by Business
<br /> Associate in violation of the requirements of this Agreement, as well as to provide complete cooperation
<br /> to Covered Entity should Covered Entity elect to review or investigate such noncompliance or Security
<br /> Incident. Business Associate shall cooperate in Covered Entity's breach analysis and/or risk
<br /> assessment, if requested. Furthermore, Business Associate shall cooperate with Covered Entity in the
<br /> event that Covered Entity determines that any third parties must be notified of a Breach, provided that
<br /> Business Associate shall not provide any such notification except at the direction of Covered Entity.
<br /> Business Associate shall indemnify and hold harmless Covered Entity for any injury or damages arising
<br /> from any noncompliance with this Agreement or any Security Incident attributable to the negligence of
<br /> Business Associate, including the failure to execute the terms of this Agreement.
<br /> 0) Business Associate shall permit Covered Entity, in its discretion, to conduct an audit of
<br /> Business Associate's compliance with this BAA, HIPAA, and HITECH. Such audit may consist of an
<br /> onsite visit, a series of inquiries that require written responses, or both. Business Associate shall
<br /> promptly and completely respond to Covered Entity's requests for information in support of the audit,
<br /> which shall not be conducted more than once annually except in cases of an actual or reasonably
<br /> suspected Security Incident or reasonably suspected noncompliance with this BAA, HIPAA or
<br /> HITECH. Each Party shall bear its own costs associated with the audit.
<br />
|