2014-318 HR - UnitedHealthCare for United HealthCare Application for Excess Loss Insurance Policy $1,625,322

Browse Search

2.3 without unreasonable delay,report to Covered Entity: (i)any use or disclosure of PHI not provided for by this BAA and/or Agreement, of which it becomes aware in accordance with 45 C.F.R. 164.504(e)(2)(ii)(C); and/or(ii) any Security Incident of which Business Associate becomes aware in accordance with 45 C.F.R. 164.314(a)(2)(i)(C). 2.4 with respect to any use or disclosure of Unsecured PHI not permitted by the Privacy Rule that is caused solely by Business Associate's failure to comply with one or more of its obligations under this BAA, Covered Entity hereby delegates to Business Associate the responsibility for determining when any such incident is a Breach and for providing all legally required notifications to Individuals, HHS and/or the media,on behalf of Covered Entity. Business Associate shall provide these notifications in accordance with the notification requirements set forth in the Breach Rule, and shall pay for the reasonable and actual costs associated with those notifications. In the event of a Breach, without unreasonable delay, and in any event no later than sixty(60) calendar days after Discovery, Business Associate shall provide Covered Entity with written notification in accordance with 45 C.F.R. 164.410 that includes a description of the Breach,a list of Individuals(unless Covered Entity is a plan sponsor ineligible to receive PHI)and,in the event the delegation set forth above has been triggered,a copy of the template notification letter to be sent to Individuals. 2.5 in accordance with 45 C.F.R. 164.502(e)(1)(ii) and 45 C.F.R. 164.308(b)(2), ensure that any subcontractors of Business Associate that create, receive, maintain or transmit PHI on behalf of Business Associate agree, in writing, to the same restrictions and conditions on the use and/or disclosure of PHI that apply to Business Associate with respect to that PHI,including complying with the applicable Security Rule requirements with respect to ePHI. 2.6 make available its internal practices,books and records relating to the use and disclosure of PHI to the Secretary for purposes of determining Covered Entity's compliance with the Privacy Rule. 2.7 document, and within thirty (30) days after receiving a written request from Covered Entity or an Individual, make available an accounting of disclosures of PHI about the Individual, m accordance with 45 C.F.R. 164.528. 2.8 provide access, within twenty (20) days after receiving a written request from Covered Entity or an Individual, to PHI in a Designated Record Set about an Individual, in accordance with the requirements of 45 C.F.R. 164.524 including as of the Compliance Date,providing or sending a copy to a designated third party and providing or sending a copy in electronic format. 2.9 to the extent that the PHI in Business Associate's possession constitutes a Designated Record Set, make available, within thirty (30) days after a written request by Covered Entity, PHI for amendment and incorporate any amendments to the PHI,as requested by Covered Entity,all in accordance with 45 C.F.R. 164.526. 3. RESPONSIBILITIES OF COVERED ENTITY In addition to any other obligations set forth in the Agreement,including in this BAA,Covered Entity: 3.1 shall identify the records it furnishes to Business Associate it considers to be PHI for purposes of this BAA. 3.2 shall provide to Business Associate only the minimum PHI necessary to accomplish the Services. 3.3 in the event that the Covered Entity honors a request to restrict the use or disclosure of PHI pursuant to 45 C.F.R. 164.522(x) or makes revisions to its notice of privacy practices of Covered Entity in accordance with 45 C.F.R. 164.520 that increase the limitations on uses or disclosures of PHI or agrees to a request by an Individual for confidential communications under 45 C.F.R. § 164.522(b),Covered Entity agrees not to provide Business Associate any PHI that is subject to any of those restrictions or limitations to the extent any may limit Business Associate's ability to use and/or disclose PHI as permitted or required under this BAA unless Covered Entity notifies Business Associate of the restriction or limitation and Business Associate agrees in writing to honor the restriction or limitation. In addition, if those limitations or revisions materially increase Business Associate's cost of providing services under the Agreement, including this BAA,Covered Entity shall reimburse Business Associate for such increase in cost. 30