2013-449 Health - Starpoint Global Service for Imaging Patient Records and Other Services $33,350

Browse Search

person, and (2) Business Associate will be notified by such person of any instances of which it becomes aware in which the confidentiality of the PHI has been breached. C. Data Aggregation. Business Associate may use and disclose PHI received by Business Associate in its capacity as Business Associate of Covered Entity to provide Data Aggregation services relating to the health care operations of Covered Entity only with permission of the Covered Entity. 4. Nondisclosure. a. As Provided in Agreement. Business Associate shall not use or further disclose Covered Entity's PHI otherwise than as permitted or required by this Agreement. b. Disclosures Required By Law. Business Associate shall not, without prior written consent of Covered Entity, disclose any PHI on the chance that such disclosure is required by law without notifying Covered Entity so that the Covered Entity shall have an opportunity to object to the disclosure and to seek appropriate relief. If Covered Entity objects to such a disclosure, Business Associate shall refrain from disclosing the PHI until Covered Entity has exhausted all alternatives for relief. Business Associate shall require reasonable assurances from persons receiving PHI in accordance with Section 3b that such persons will provide Covered Entity with similar notice and opportunity to object before disclosing PHI on the chance that such disclosure is required by law. C. Additional Restrictions. If Covered Entity notifies Business Associate that Covered Entity has agreed to be bound by additional restrictions on the uses or disclosures of Covered Entity's PHI pursuant to HIPAA or the HIPAA Regulations, Business Associate shall be bound by such additional restrictions and shall not disclose Covered Entity's PHI in violation of such additional restrictions. 5. Safeguards,Reporting,Mitigation and Enforcement. a. Safeguards. Business Associate shall maintain a comprehensive written information privacy and security program that includes administrative, technical and physical safeguards that reasonably and appropriately protect the confidentiality,integrity and availability of any electronic PHI it creates,receives, maintains or transmits on behalf of Covered Entity. In addition to any safeguards specifically set forth in this Agreement, Business Associate shall use any and all appropriate safeguards to prevent use or disclosure of Covered Entity's PHI otherwise than as provided by this Agreement. b. Business Associate's Agents. Business Associate shall not disclose PHI to any agent or subcontractor except with the prior written consent of Covered Entity. Business Associate shall ensure that any agents, including subcontractors, to whom it provides PHI received from, or created or received by Business Associate on behalf of, Business Associate agree in writing to be bound by the same restrictions and conditions that apply to Business Associate with respect to such PHI including appropriate safeguards. Business Associate shall be fully liable to Covered Entity for any acts,failures or omissions of the Agent in providing the services as if they were the Business Associate's own acts,failures or omissions,to the extent permitted by law. C. Reporting. Business Associate shall report to Covered Entity within twenty-four(24)hours any use or disclosure of Covered Entity's PHI in violation of this Agreement or applicable law of which it becomes aware. d. Mitigation. Business Associate shall have procedures in place to mitigate,to the maximum extent practicable, any deleterious effect from any use or disclosure of Covered Entity's PHI in violation of this Agreement or applicable law. e. Sanctions. Business Associate shall have and apply appropriate sanctions against any employee, subcontractor or agent who uses or discloses Covered Entity's PHI in violation of the Agreement or applicable law. 17