Agenda - 03-20-2018 8-e - University of North Carolina Health Care System Electronic Medical Record System Access Agreement

Browse Search

Exhibit B - 2 assessment and improvement activities, as those terms are defined in the Privacy Rule or as permitted by and in accordance with a valid HIPAA authorization meeting the requirements of 45 C.F.R. § 164.508, as may be amended from time to time, so long as each Party (or its Medical Providers) has a treatment relationship with the individual who is the subject of the Protected Health Information being accessed. In consideration of its access to the Authorizing Party’s Records of Shared Patients, each Party agrees it will: (A) Restrict Medical Provider and Authorized User access to the Authorizing Party’s Records to those patients who are current patients of the Party (or its Medical Providers) at the time the Records are accessed, for the sole purposes described in this Addendum and for no other reason absent express authorization from the Authorizing Party; (B) Comply, and cause its Medical Providers and Authorized Users to comply, with the terms of this Addendum, the Agreement and all Applicable Laws, including but not limited to HIPAA; (C) Adopt, implement, and require its Medical Providers and Authorized Users accessing Records to comply with policies, procedures, and administrative, physical and technical safeguards regarding confidentiality, security and integrity of patient information and electronic information, including such Party’s own computer systems and the information on the EMR System. Such policies, procedures and safeguards shall include, without limitation, the following: (i) an overall policy and safeguards governing confidentiality, security and integrity of health information and compliance with the terms of the HIPAA and the North Carolina Identity Theft Protection Act (ITPA), and all other state and federal laws and regulations pertaining to the privacy, security, or confidentiality of information contained in the Records, as may be amended from time to time, including but not limited to the Privacy Rule, Security Rule, and Breach Notification Rule; (ii) requirements for training of Medical Providers and Authorized Users on use of the EMR System and on confidentiality, security and integrity of patient information; and (iii) sanctions that are at a minimum as stringent as those listed in Attachment 2, which will apply to individuals who breach any of the requirements of this Addendum or the Agreement regarding confidentiality, security or integrity of patient information or other information in the Records. Further, should a Party implement its sanctions policy as a result of a violation, such Party agrees to notify the other Party, and, to the extent permitted by applicable law, provide a copy of any relevant documentation to the Party which, at a minimum, provides information sufficient for such Party to determine the nature and source of any violation and to comply with any state or federal law or regulation regarding privacy and the release of medical records; (E) Complete annually and require Medical Providers and Authorized Users to 24