2014-141 Health - NC HIE to oversee, administer and operate electronic health information exchange network

Browse Search

i E7111BIT A TO THE NC HIE PARTICIPATION AGREEMENT BUSINESS ASSOCIATE OBLIGATIONS 1. PURPOSE: The purpose of this Exhibit A is to provide satisfactory written assurances to Covered Entity Participants that NC HIE will comply with applicable business associate requirements of the HIPAA Regulations,specifically,45 C.F.R. §§ 164.314(a),.502(e), .504(e), of the privacy and security regulations as modified by the HITECH Act and implemented by Regulations and Guidance. 2. APPLICATION: In addition to the requirements set forth in this Agreement,NC HIE agrees to the following responsibilities which shall apply solely in NC HM's capacity as a Health Information Exchange and on behalf of a Covered Entity Participant: (a) Creates, receives, maintains, or transmits Protected Health Information (PHI)for a function or activity regulated by the HIPAA Privacy Rule;or (b) Provides, other than in the capacity of a member of the Work force of a Covered Entity Participant, HIE Services, consulting, data aggregation (as defined in 45 CFR §164-50 1),management,administrative,or other services to or for a Covered Entity Participant, where the provision of the service involves the Disclosure of PHI from such Covered Entity Participant,or from another Business Associate of the Covered Entity Participant,to NC HIE. 3. DEFINITIONS. All capitalized terms used, but not otherwise defined in this Agreement, shall have the same meaning for those terms as set forth in the HIPAA Privacy and Security Rules for purposes of this Exhibit A. (a) Breach shall the same meaning as the term"Breach" set forth in 45 C.F.R. § 164.402. (b) Designated Record_ Set shall have the same meaning as "Designated Record Set"set forth in 45 C.FR § 164.501. (c) HITECH Act means Title XIII and Title IV of Division B of the American Recovery and Reinvestment Act of 2009,Public Law No. 1 1 1-5. (d) Individual has the same meaning as the term "individual" in 45 C.F.R. § 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 C.F.R.. § 164.502(g). (e) Privacy Rule means the Standards for Privacy of Individually Identifiable Health Information at 45 C.FR part 160 and part 164,subparts A and E. (f) Protected Health Information or PHI and ePHI shall have the same meaning as the term"protected health information"in the HIPAA Regulations and shall include em. Specific references to"ePHP' shall be deemed to refer only to PHI in electronic form All references to PHI or ePHI shall refer only to PHI or ePHI of Covered Entity Disclosed to, accessed,used,held,or created by NC HIE under an applicable Subscription Agreement and this Agreement unless specifically stated otherwise. (g) Required By Law has the same meaning as the term"required by law"in 45 CF.R-§ 164.103. 18