Orange County NC Website
Browse       Search
• ensure that any agent of Business Associate, including a subcontractor, to whom <br /> Business Associate provides such EPHI agrees to implement substantially the same <br /> safeguards and other measures to protect such EPHI as set forth in this Agreement; and <br /> • report to Covered Entity any successful Security Incident of which Business Associate <br /> becomes aware. This Agreement shall serve as notice of all attempted but unsuccessful <br /> Security Incidents. <br /> C. report to Covered Entity any use or disclosure of PHI in violation of this Agreement, as well as <br /> any incident which, in Business Associate's view, compromises the security of PHI, of which <br /> Business Associate becomes aware. Business Associate shall use reasonable efforts to mitigate <br /> any deleterious effects from any use or disclosure of PHI that Business Associate reports to <br /> Covered Entity as provided herein. <br /> d. ensure that any agent, including any subcontractor, to whom Business Associate provides PHI <br /> agrees to the same restrictions and conditions on the use and disclosure of PHI that apply to <br /> Business Associate pursuant to this Agreement. <br /> e. make available, in the form, time, and manner reasonably requested by Covered Entity, any and <br /> all PHI maintained in a Designated Record set as required for Covered Entity to respond to an <br /> Individual's request for access to PHI about them in accordance with 45 C.F.R. 164.524. <br /> Business Associate will provide PHI in such electronic format as may be reasonably requested <br /> by Covered Entity to the extent that Business Associate maintains such PHI in electronic format. <br /> f. make available, in the form, time, and manner reasonably requested by Covered Entity, PHI <br /> maintained in a Designated Record Set for amendment and incorporate any such amendment as <br /> directed by Covered Entity to allow Covered Entity to comply with 45 C.F.R. 164.526. <br /> g. document any and all disclosures of PHI by Business Associate or its agents, including <br /> subcontractors, as well as any other information related to such disclosures of PHI that would be <br /> required for Covered Entity to respond to an Individual's request for an accounting of <br /> disclosures in accordance with 45 C.F.R. 164.528. <br /> h. make available, in the form, time, and manner reasonably requested by Covered Entity, any and <br /> all information documented in accordance with subsection 3.1.g. <br /> L make available to the Secretary of the U.S. Department of Health and Human Services ("HHS") <br /> any and all internal practices, books, and records of Business Associate or its agents, including <br /> subcontractors, relating to the use and disclosure of PHI, for purposes of determining Covered <br /> Entity's compliance with the Privacy Rule. <br /> j. comply with the Security Rule. <br /> k. determine the Minimum Necessary PHI to be used, disclosed, or requested in order to <br /> accomplished the intended purpose of the use, disclosure, or request, except when the use, <br /> disclosure, or request is exempt from the Minimum Necessary requirement under 45 C.F.R. <br /> 164.502(b)(2). <br /> 2 <br />