Orange County NC Website
Browse       Search
13 <br /> <br />Administrator or other authorized personnel shall change the access or level thereof of the Authorized <br />User within five (5) business days of the employment change. <br />8. Security. <br />8.01. General. The Parties shall be responsible for maintaining secure environments for their operations, <br />data and Transactions. The Parties shall use appropriate safeguards to prevent use or disclosure of <br />HIE Data or Message Content other than as permitted by this Agreement, including appropriate <br />administrative, physical, and technical safeguards that protect the confidentiality, integrity, and <br />availability of HIE Data or Message Content. Appropriate safeguards for Participants shall be those <br />identified in the HIPAA Security Rule, 45 C.F.R. Part 160 and Part 164, Subparts A and C, as <br />safeguards, standards, “required” implementation specifications, and “addressable” implementation <br />specifications to the extent that the “addressable” implementation specifications are reasonable and <br />appropriate in the Participant’s environment. If an “addressable” implementation specification is not <br />reasonable and appropriate in the Party’s environment, then the Party must document why it would <br />not be reasonable and appropriate to implement the implementation specification and implement an <br />equivalent alternative measure if reasonable and appropriate. <br /> <br />8.02. NC HealthConnex Security. NC HIEA shall adhere to the Statewide Security Manual and Policies <br />as required by N.C.G.S. §143B-1375 et seq., Security of Information Technology, and all Applicable <br />Law that governs data confidentiality, privacy, and security. <br />8.03. Malicious Software. The Parties shall ensure that they employ security controls that meet applicable <br />industry, State or Federal standards so that HIE Data and Message Content being Transacted and any <br />method of Transacting such information and Message Content will not introduce any viruses, worms, <br />unauthorized cookies, trojans, malicious software, “malware,” or other program, routine, subroutine, <br />or data designed to disrupt the proper operation of a System or any part thereof or any hardware or <br />software used by a Participant in connection therewith, or which, upon the occurrence of a certain <br />event, the passage of time, or the taking of or failure to take any action, will cause a System or any <br />part thereof or any hardware, software or data used by a Party in connection therewith, to be <br />improperly accessed, destroyed, damaged, or otherwise made inoperable. In the absence of <br />applicable industry standards, each Party shall use all commercially reasonable efforts to comply <br />with the requirements of this Section. <br /> <br />9. NC HIEA Policies and Procedures. <br />9.01. General Compliance. The Parties shall comply with the NC HIEA Policies and Procedures adopted <br />by NC HIEA in accordance with this Agreement. The NC HIEA Policies and Procedures will be <br />made available on the NC HIEA website and by request. <br />9.02. Development of the NC HIEA Policies and Procedures. The NC HIEA may amend, repeal, <br />replace, or adopt new Policies and Procedures at any time. Any changes to the NC HIEA Policies <br />and Procedures will be developed and amended in consultation with the Advisory Board as required <br />by N.C.G.S. §90-414.7 <br />9.03. NC HIEA Policies and Procedures Change Process. <br />a. Prior to approving any new, amended, repealed or replaced NC HIEA Policies and Procedures, <br />the NC HIEA may provide notice of proposed changes to Participants. The NC HIEA may solicit <br />and consider comments from the Participants on the new, amended, repealed or replaced NC <br />HIEA Policies and Procedures. <br />b. Adoption of changes shall be determined by the NC HIEA in consultation with the Advisory <br />Board. <br />DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC