2021-071-E Health - Everbridge vaccination software

Browse Search

DocuSign Envelope ID: 16086DFC-1613-4024-BF92-DD86916E213E 19. In accordance with the Security Rule, Business Associate agrees to: (a) Implement the administrative safeguards set forth at 45 C.F.R. 164.308, the physical safeguards set forth at 45 C.F.R. 164.310, the technical safeguards set forth at 45 C.F.R. 164.312, and the policies and procedures set forth at 45 C.F.R. 164.316 to reasonably and appropriately protect the confidentiality, integrity and availability of the ePHI that it creates, receives, maintains or transmits on behalf of Covered Entity as required by the Security Rule. Business Associate acknowledges that, effective on the Effective Date of this BAA, (i) the foregoing safeguards, policies and procedures requirements shall apply to Business Associate in the same manner that such requirements apply to Covered Entity, and (ii) Business Associate shall be liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. 1320d-5 and 1320d-6, as amended from time to time, for failure to comply with the safeguards, policies and procedures requirements and any guidance issued by the Secretary from time to time with respect to such requirements; (b) Require that any agent, including a Subcontractor, to whom it provides such PHI agrees to implement reasonable and appropriate safeguards to protect the PHI; and (c) Report to the Covered Entity any Security Incident of which it becomes aware. 20. Indemnification. The parties agree and acknowledge that except as set forth herein, the indemnification obligations contained under the Underlying Agreement shall govern each party's performance under this BAA. 21. Term and Termination. This BAA shall be in effect as of the Effective Date and shall continue in effect until all obligations of the parties have been met, unless terminated as provided in this Section 21. In addition,certain provisions and requirements of this Business Associate Agreement shall survive its expiration or other termination in accordance with this Section 21. (a) Termination by the Covered Entity. As provided for under 45 C.F.R. §164.504(e)(2)(iii),the Covered Entity may terminate this BAA if the Covered Entity makes the determination that the Business Associate has breached a material term of this BAA provided that Covered Entity provides Business Associate written notice of the existence of the alleged material breach and an opportunity to cure the alleged material breach upon mutually agreeable terms within (30)days of such notice. (b) Termination by Business Associate. If the Business Associate makes the determination that a material condition of performance has changed under this BAA, or that the Covered Entity has breached a material term of this BAA, Business Associate may terminate this BAA provided that Business Associate provides Covered Entity written notice of the existence of the alleged material breach and an opportunity to cure the alleged material breach upon mutually agreeable terms within (30) days of such notice. Business Associate agrees, however, to cooperate with Covered Entity to find a mutually satisfactory resolution to the matter prior to terminating. (c) Automatic Termination. This Business Associate Agreement will automatically terminate without any further action of the parties upon the termination or expiration of the Underlying Agreement. 22. Effect of Termination. Upon termination of this BAA, Business Associate agrees to return or destroy (which for purposes of this BAA shall mean destroy all backup tapes and permanently deleting all Electronic Protected Health Information) all Protected Health Information pursuant to 45 C.F.R. §164.504(e)(2)(I), if it is feasible to do so. Prior to doing so, the Business Associate further agrees to recover any PHI in the possession of its subcontractors or agents. If it is not feasible for the Business Associate to return or destroy the PHI, the Business Associate will promptly notify the Covered Entity in writing. Notification shall include: (i)a statement that the Business Associate has determined that it is infeasible to return or destroy the PHI in its possession, and (ii) the specific reasons for such determination. Business Associate further agrees to extend any and all protections, limitations and restrictions contained in this Business Associate Agreement to the Business Associate's use and/or disclosure of any PHI retained after the termination of this Business Associate Agreement, and to limit any further uses and/or disclosures to the purposes that make the return or destruction of the PHI infeasible. If it is infeasible for the Business Associate to obtain, from a subcontractor or agent any PHI in the possession of the subcontractor or agent, 4