Orange County NC Website
Browse       Search
the use and disclosure of PHI to determine Business Associate's compliance with the terms of this <br /> Agreement. <br /> k. Document all disclosures of PHI that require an accounting of disclosures as required under 45 <br /> CFR §164.528. Business Associate further agrees,within thirty (30) days of receiving a written <br /> request from the other Party, to provide to that Party such information as is requested and <br /> reasonably available to permit that Party to respond to a request by an individual for an <br /> accounting of the disclosures of the individual's PHI in accordance with 45 CFR§164.528. <br /> I. Notify the other Party within ten (10)business days of Business Associate's discovery of: <br /> i. any use or disclosure of PHI not provided for by this Agreement; <br /> ii. any breach of unsecured PHI as defined at 4S CFR§164.402;and <br /> iii. any Security Incident of which it becomes aware. Pings and related broadcast actions not <br /> resulting in any known or suspected security interference shall not be reported except as <br /> aggregate statistics of such events as requested by the other Party. <br /> Notification under this section shall include, as reasonably available, the identification of each <br /> individual whose PHI has been, or is suspected to have been, accessed, acquired, or disclosed. <br /> Business Associate further agrees to make available in a reasonable time and manner any other <br /> available information needed by the other Party to respond to individual and governmental inquiries <br /> regarding any of the notifications received from Business Associate. The Party responsible for any <br /> Data Breach,through its actions or omissions or through those of its agents,shall be responsible for <br /> notifying the persons affected and any administrative bodies in accordance with Applicable Law. The <br /> Parties agree to coordinate any public announcement required under Applicable Law. <br /> m. Comply with all the restrictions on access,use,disclosure,storage,and transmission of PHI found <br /> in the 2019 PRIMARY CARE CASE MANAGEMENT SERVICES CONTRACT#37761 BETWEEN THE <br /> NORTH CAROLINA DEPARTMENT OF HEALTH AND HUMAN SERVICES DIVISION OF HEALTH <br /> BENEFITS AND NORTH CAROLINA COMMUNITY CARE NETWORKS, INC. and any successor <br /> agreement between N3CN and the State for accessing and using State-owned data. <br /> 13. Mutual Covered Entity Obligations. To the extent either Party is a Covered Entity regarding any Data <br /> it provides,accesses,or uses through the Data Platform,that Party agrees to: <br /> a. inform the Business Associate of any changes in the notice of privacy practices that the Covered <br /> Entity provides to individuals pursuant to 45 CFR§164.520 that affect Business Associate's use or <br /> disclosure of PHI, and provide to the Business Associate, upon request, a copy of the notice of <br /> privacy practices currently in use. <br /> b. inform the Business Associate of any changes in, or revocation of, the authorization provided <br /> pursuant to 45 CFR§164.508,to the extent relevant to any obligations underthis Agreement. <br /> c. inform the Business Associate, in writing and in a timely manner, of any arrangements required <br /> of Covered Entity under 45 CFR §part 160 and 164 that may affect the use or disclosure of PHI <br /> required by the Business Associate under this Agreement,including restrictions regarding the use <br /> or disclosure of PHI as provided for in 45 CFR§164.522. <br /> d. make any amendments to PHI that Covered Entity agrees to pursuant to 45 CFR§164.526. <br /> Page 12 of 21 <br />