2013-094 Health - State of NC Department of Health for Maintaining and Promoting the Advancement of Public Health in NC

Browse Search

Consolidated Agreement-FY14 Page 21 of 23 AMENDMENT TO THE NORTH CAROLINA DEPARTMENT OF HEALTH AND HUMAN SERVICES BUSINESS ASSOCIATE ADDENDUM TO CONSOLIDATED AGREEMENT This document amends North Carolina Department of Health and Human Services Business Associate Addendum to the Consolidated A eement. This amendment is made effective the 1"day of July, 2012, by and between 0f0-f' (name of Local Health Department or"Covered Entity")and the Division o ublic Health Business Associate") (collectively the"Parties")for the purpose of specifying the breach reporting and notification requirements following an unauthorized disclosure of unsecured Protected Health Information(PHI). I. DEFINITIONS: The terms defined below shall have the following meaning in this Amendment: a. `Breach"means the acquisition,access,use,or disclosure of PHI in a manner not permitted under the HIPAA Privacy Rule which compromises the security or privacy of the PHI. For the purpose of this definition,"compromises the security or privacy of the PHI'means poses a significant risk of financial,reputational,or other harm to the individual. A use or disclosure of PHI that does not include the identifiers listed at§ 164.514(e)(2),limited data set,date of birth, and zip code does not compromise the security or privacy of the PHI. Breach excludes: • Any unintentional acquisition,access or use of PHI by a workforce member or person acting under the authority of a Covered Entity(CE)or Business Associate(BA)if such acquisition, access,or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under the HIPAA Privacy Rule. • Any inadvertent disclosure by a person who is authorized to access PHI at a CE or BA to another person authorized to access PHI at the same CE or BA,or organized health care arrangement in which the CE participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted under the HIPAA Privacy Rule; or • A disclosure of PHI where a CE or BA has a good faith belief that an unauthorized person to whom the disclosure was made could not have expected to use or further disclose that information. b. "HITECH Act"means the"Health Information Technology for Economic and Clinical Health ("HITECH")Act,Title XIII of Division A of the American Recovery and Reinvestment Act of 2009 (P.L. 111-5). C. "Security breach"means an incident of unauthorized access to and acquisition of unencrypted and un-redacted records or data containing personal information where illegal use of the personal information has occurred or is reasonably likely to occur or that creates a material risk of harm to a consumer. Any incident of unauthorized access to and acquisition of encrypted records or data