Agenda 05-06-25; 6-a - Opioid Advisory Committee Settlement Fund Use Recommendations

Browse Search

36 Business Associate will forward the individual's request to Covered Entity within three (3) working days to be fulfilled by Covered Entity. 7. If Business Associate receives a request pursuant to 45 CFR 164.526 to make any amendment(s)to PHI in a designated record set directly from the individual,then Business Associate will forward the individual's request to Covered Entity within three (3) working days to be fulfilled by Covered Entity. 8. Maintain and make available upon request within three (3) working days the information required to provide an accounting of disclosures to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 CFR 164.528. If Business Associate receives a request to provide an accounting of disclosures directly from the individual,then Business Associate will forward the individual's request to Covered Entity within three (3) working days to be fulfilled by Covered Entity. 9. Make its internal practices, books, and records relating to the use of PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity, available to the Secretary of DHHS and Covered Entity for purposes of determining compliance with HIPAA. 10. To the extent practicable, mitigate any harmful effects that are known to Business Associate of a use or disclosure of PHI or a breach of Unsecured PHI in violation of this Addendum. 11. Use and disclose an individual's PHI only if such use or disclosure is in compliance with the applicable requirements of 45 CFR 164.504(e) and the terms of this Addendum. 12. Refrain from exchanging any PHI with any entity of which Business Associate knows of a pattern of activity or practice that constitutes a breach as defined by North Carolina State Law, HIPAA, or this Addendum. 13. To the extent Business Associate is to carry out one or more of Covered Entity's obligation(s) under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligation(s). B. Breach Notification: In the event that Business Associate discovers any use or disclosure of PHI not provided for by the Agreement, including breaches of Unsecured PHI as required at 45 CFR 164.410, and any security incident of which it becomes aware, Business Associate agrees to take the following measures within three (3) working days after Business Associate first becomes aware of the incident: 1. To notify Covered Entity of any incident involving the acquisition, access, use or disclosure of Unsecured PHI in a manner not permitted under 45 CFR Part E. Such notice by Business Associate shall be provided without unreasonable delay, except where a law enforcement official determines that a notification would impede a criminal investigation or cause damage to national security. For purposes of clarity for this provision, Business Associate must notify Covered Entity of any such incident within the above timeframe even if Business Associate has not conclusively determined within that time that the incident constitutes a breach as defined by HIPAA. For purposes of this Addendum, Business Associate is deemed to have become aware of the breach as of the first day on which such breach is known or reasonably should have been known to such entity or associate of Business Associate, including any person, other than the individual committing the breach,that is an employee, officer or other agent of Business Associate or an associate of Business Associate. 12