2014-141 Health - NC HIE to oversee, administer and operate electronic health information exchange network

Browse Search

(d) Duty to Report Violations. NC HIE agrees to report to Covered Entity Participants any use or Disclosure of PHI by NC HIE not allowed for by the Privacy Rule, the Security Rule or this Agreement of which it becomes aware. NC HIE agrees to report to Covered Entity Participants any Security Incident of which it becomes aware, except that, for purposes of this reporting requirement,the term"Security Incident"shall not include: (i)"pings" on NC HIE's firewall(s); (b)port scans;(c) attempts to log on to NC HIE's systems or to enter a database of NC HIE with an invalid security credential; (d) denial-of-service attacks that do not result in a server being taken offline; or(e)malware, (e.g., a worm or virus)that does not result in unauthorized access, use, disclosure, modification or destruction of Electronic Protected Health Information. (e) Duty to Report Breaches. NC HIE also agrees to report any other Breaches of PHI If a Breach occurs,NC HIE shall cooperate and assist in any steps taken by Covered Entity Participant to mitigate and address the Breach in accordance with Section 10 of this Agreement.Business Associate shall maintain evidence to demonstrate that any notifications required under this Section were made by Business Associate. (f) Subcontractors and Agents. NC HIE agrees to ensure that any subcontractor or agent to whom it provides PHI agrees in writing to the same restrictions and conditions that apply through this Agreement to NC HIE with respect to such PHI. NC HIE will ensure that any agent,including a subcontractor,to whom it provides Electronic Protected Health Information, agrees to implement reasonable and appropriate safeguards to protect such Electronic Protected Health Information. Personel data made available to NC HE by Covered Entity Participant for the performance or administration of this Agreement shall be used only for those purposes and shall not be used in any other way without the prior written approval of the Covered Entity Participant. (g) Access to PHI Upon request by Covered Entity Participant, NC HIE agrees to provide access to PHI in a Designated Record Set in NC HIE's possession and control to Covered Entity Participant or,at the direction of Covered Entity Participant to an Individual in order to meet the requirements of 45 C.F.R. § 164.524. (h) Amendment of PHI.Upon request by Covered Entity Participant,NC HIE agrees to make available to the Covered Entity Participant, PHI in a Designated Record Set in NC HIE's possession and control, as required for amendment of such PHI, and shall make and incorporate any amendment(s) to the PHI that the Provider agrees to pursuant to 45 C.F.R. § 164.526. (i) IMection of Books and Records.Upon reasonable notice,NC HIE agrees to make its internal practices, books, and records relating to the use and disclosure of PER available to Covered Entity Participant or, at the request of Covered Entity Participant, to the Secretary in a time and manner designated by Provider or the Secretary for purposes of the Secretary determining Provider's compliance with the Privacy Rule or Security Rule. (j) Accounting of Disclosures. NC HIE agrees to provide to Covered Entity Participants,upon request,information regarding disclosures of PHI by NC HIE through the HIE Network to permit Covered Entity Participants to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528. 20