Agenda - 02-05-2008-4j - Laserfiche WebLink

Browse Search

3 (iii) implement appropriate safeguards to prevent use or disclosure of protected health information other than as permitted or required by this Agreement; (iv) permit the Secretary of Health and Human Services to audit Business Associate's records and practices related to use and disclosure of protected health information to ensure Covered Entity's compliance with the terms of the HIPAA Security and Privacy Rule; (v) report to Covered Entity any use or disclosure of protected health information which is not in compliance with the terms of this Agreement of which it becomes aware; (vi) report to Covered Entity any Security Incident of which it becomes aware. For purposes of this Agreement, "Security Incident" means the attempted or successful unauthorized access, use disclosure, modification, or destruction of information or interference with system operations in an information system; and (vii) mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of protected health information by Business Associate in violation of the requirements of this Agreement. (b) Notwithstanding the prohibitions set forth in this Agreement or the Arrangement Agreement, Business, Associate may use and disclose protected health information as follows: (i) if necessary, for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided that as to any such disclosure, the following requirements are met: (A) the disclosure is required by law; or (B) Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which.the confidentiality of the information has been breached; (ii) for data aggregation services, if such services are to be provided by Business Associate for the health care operations of Covered Entity pursuant to any agreements between the Parties evidencing their business relationship. III. AVAILABILITY OF PROTECTED HEALTH INFORMATION Business Associate shall: (a) at the request of Covered Entity, provide access to protected health information in a designated record set to Covered Entity or, as directed by Covered Entity, to an individual, in a time and manner sufficient to permit Covered Entity to comply with the requirements of 45 CFR 164.524. (b) at the request of Covered Entity or an individual, make any amendment(s) to protected health information in a designated record set that are directed by or agreed to by Covered Entity, in a time and manner sufficient to permit Covered Entity to comply with the requirements of 45 CFR 164.526. (c) document disclosures of protected health information and information related to such disclosures in a manner sufficient to permit Covered Entity to respond to a request by an individual for an accounting of disclosures of protected health information in accordance with 45 CFR 164.528 and provide such documentation to Covered Entity or an individual as directed by Covered Entity. 2