Orange County NC Website
Browse       Search
35 <br /> I. Business Associate Addendum <br /> THIS ADDENDUM is made this day of Click or tap here to enter text., 20Click or tap here to <br /> enter text. to a contractual arrangement between the parties ("Agreement"). <br /> WHEREAS Orange County is itself a Covered Entity, as that term is defined in HIPAA and will be <br /> referred to as "Covered Entity"; and <br /> WHEREAS, Click or tap here to enter text. is, or may be, a Business Associate of Covered Entity <br /> and will be referred to as "Business Associate"; and <br /> WHEREAS, Business Associate performs certain services on behalf of or for Covered Entity that <br /> require the exchange of information about patients that is protected by the Health Insurance Portability <br /> and Accountability Act of 1996, as amended, and the Privacy, Security, Breach Notification, and <br /> Enforcement Rules at 45 CFR Part 160 and Part 164 (collectively"HIPAA"). <br /> NOW,THEREFORE, the parties to the Agreement are entering into this Addendum to establish <br /> the responsibilities of both parties regarding HIPAA-covered information and to bring the Agreement <br /> into compliance with HIPAA. <br /> I. DEFINITIONS <br /> Except as otherwise defined herein,terms used in this Addendum shall have the same meaning as the <br /> terms are defined in HIPAA. <br /> II. OBLIGATIONS OF BUSINESS ASSOCIATE <br /> To comply with the Privacy, Security, and Breach Notification obligations imposed by HIPAA, Business <br /> Associate agrees to: <br /> A. Privacy and Security Obligations: <br /> 1. Not use nor disclose information other than as permitted or required by the Agreement,this <br /> Addendum or as required by law. <br /> 2. Use appropriate safeguards to prevent use or disclosure of the information other than as <br /> provided for by the Agreement and this Addendum. <br /> 3. Comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI (protected health <br /> information)to prevent use or disclosure of PHI other than as provided for by the <br /> Agreement. <br /> 4. Report to Covered Entity any use or disclosure of the information not provided for by the <br /> Agreement of which Business Associate becomes aware, including breaches of Unsecured <br /> PHI as required by 45 CFR 164.410. <br /> 5. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any <br /> agents or subcontractors that create, receive, maintain, or transmit PHI on behalf of <br /> Business Associate agree, in writing, to the same restrictions, conditions, and requirements <br /> that apply to Business Associate with respect to such information. <br /> 6. Make available PHI in a designated set record set to Covered Entity upon request within <br /> three (3) working days as necessary to satisfy Covered Entity's obligations under 45 CFR <br /> 164.524. If Business Associate receives a request for access directly from the individual,then <br /> 11 <br />