Orange County NC Website
Browse       Search
3 <br />October 2013 <br /> <br />Information by Business Associate in violation of the requirements of this Agreement, as well as to provide <br />complete cooperation to Covered Entity should Covered Entity elect to review or investigate such <br />noncompliance or Security Incident. Business Associate shall cooperate in Covered Entity’s breach <br />analysis and/or risk assessment, if requested. Furthermore, Business Associate shall cooperate with <br />Covered Entity in the event that Covered Entity determines that any third parties must be notified of a <br />Breach, provided that Business Associate shall not provide any such notification except at the direction of <br />Covered Entity. <br /> <br />(f) Breach Reporting. Business Associate shall report in writing to Covered Entity’s Privacy <br />Officer (see Exhibit A), any use or disclosure of Protected Health Information that is not in compliance <br />with the terms of this Agreement, as well as any Security Incident and any actual or suspected Breach, of <br />which it becomes aware, without unreasonable delay, and in no event later than ten (10) business days of <br />such discovery. For purposes of this Agreement, “Security Incident” means the attempted or successful <br />unauthorized access, use, disclosure, modification, or destruction of information or interference with system <br />operations in an information system. Such notification shall contain the elements required by 45 <br />C.F.R. § 164.410. <br /> <br />(g) Compliance. To the extent applicable, Business Associate will comply with (i) Covered <br />Entity’s Notice of Privacy Practices; (ii) any limitations to which Covered Entity has agreed in regard to an <br />Individual’s permission to use or disclose his or her Protected Health Information; and (iii) any restrictions <br />to the use or disclosure of Protected Health Information to which Covered Entity has agreed or is required <br />to agree. <br /> <br />(h) Government Access. Business Associate will make its internal practices, books and records <br />available to the Secretary of the Department of Health and Human Services for purposes of d etermining <br />compliance with the terms of the HIPAA Security and Privacy Rule, and, at the request of the Secretary, <br />will comply with any investigations and compliance reviews, permit access to information, and cooperate <br />with any complaints, as Required by Law. Without unreasonable delay and, in any event, no more than 48 <br />hours of receipt of the request or notification, Business Associate will notify Covered Entity in writing of <br />any request by any governmental entity, or its designee, to review Business assessment of any kind. <br /> <br />(i) Electronic Transactions. If Business Associate conducts any Standard Transactions for or <br />on behalf of Covered Entity, Business Associate shall comply with the requirements under the Electronic <br />Transaction Rule. <br /> <br />(j) Audit. Business Associate shall permit Covered Entity, in its discretion, to conduct an audit <br />of Business Associate’s compliance with this Agreement, HIPAA, and HITECH. Such audit may consist <br />of an onsite visit, a series of inquiries that require written responses, or both. Business Associate shall <br />promptly and completely respond to Covered Entity’s requests for information in support of the audit, which <br />shall not be conducted more than once annually except in cases of an actual or reasonably suspected Security <br />Incident or reasonably suspected noncompliance with this Agreement, HIPAA or HITECH. Each Party <br />shall bear its own costs associated with the audit. <br /> <br />(k) Identity Theft. Business Associate shall implement Identity Theft Monitoring Policies and <br />Procedures to protect any patient information that may be breached by the Business Associate to the extent <br />applicable under the Federal Trade Commission’s Red Flag Rules. <br /> <br />(l) HITECH Compliance. Business Associate shall: <br /> <br />A. Not receive, directly or indirectly, any impermissible remuneration in exchange <br />for Protected Health Information or Electronic Protected Health Information, <br />except as permitted by HITECH § 13405(d) or the HIPPA Regulations; <br />DocuSign Envelope ID: 6AD3FC72-1379-49D2-81C9-A007D8F3B667