Orange County NC Website
Browse       Search
98 <br /> 1. Business Associate Addendum <br /> THIS ADDENDUM is made this 18th day of February, 2025 to a contractual arrangement <br /> between the parties("Agreement"). <br /> WHEREAS Orange County is itself a Covered Entity, as that term is defined in HIPAA and will be <br /> referred to as"Covered Entity"; and <br /> WHEREAS, Freedom House Recovery Center, Inc._is, or may be,a Business Associate of Covered <br /> Entity and will be referred to as"Business Associate";and <br /> WHEREAS, Business Associate performs certain services on behalf of or for Covered Entity that <br /> require the exchange of information about patients that is protected by the Health Insurance Portability <br /> and Accountability Act of 1996, as amended,and the Privacy,Security, Breach Notification, and <br /> Enforcement Rules at 45 CFR Part 160 and Part 164(collectively"HIPAA"). <br /> NOW,THEREFORE,the parties to the Agreement are entering into this Addendum to establish <br /> the responsibilities of both parties regarding HIPAA-covered information and to bring the Agreement <br /> into compliance with HIPAA. <br /> 1. DEFINITIONS <br /> Except as otherwise defined herein,terms used in this Addendum shall have the same meaning as the <br /> terms are defined in HIPAA. <br /> II.OBLIGATIONS OF BUSINESS ASSOCIATE <br /> To comply with the Privacy, Security, and Breach Notification obligations imposed by HIPAA, Business <br /> Associate agrees to: <br /> A. Privacy and Security Obligations: <br /> 1. Not use nor disclose information other than as permitted or required by the Agreement,this <br /> Addendum or as required by law. <br /> 2. Use appropriate safeguards to prevent use or disclosure of the information other than as <br /> provided for by the Agreement and this Addendum. <br /> 3. Comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI (protected health <br /> information)to prevent use or disclosure of PHI other than as provided for by the <br /> Agreement. <br /> 4. Report to Covered Entity any use or disclosure of the information not provided for by the <br /> Agreement of which Business Associate becomes aware, including breaches of Unsecured <br /> PHI as required by 45 CFR 164.410. <br /> 5. In accordance with 45 CFR 164.502(e)(1)(ii)and 164.308(b)(2), if applicable,ensure that any <br /> agents or subcontractors that create, receive, maintain,or transmit PHI on behalf of <br /> Business Associate agree, in writing,to the same restrictions, conditions,and requirements <br /> that apply to Business Associate with respect to such information. <br /> 6. Make available PHI in a designated set record set to Covered Entity upon request within <br /> three (3)working days as necessary to satisfy Covered Entity's obligations under 45 CFR <br /> 164.524. If Business Associate receives a request for access directly from the individual,then <br /> 11 <br />