Orange County NC Website
Browse       Search
2 <br />carrying out Covered Entity’s Privacy Rule obligations. Business Associate will also comply <br />with its own direct obligations under HIPAA. Business Associate will not engage in <br />marketing or fundraising that involves the use or disclosure of PHI and will not otherwise <br />receive direct or indirect remuneration for PHI, except as expressly permitted in writing by <br />Covered Entity in connection with the provision of the Services. <br />Section 2. Safeguards for the Protection of PHI. <br /> Business Associate will implement and maintain commercially appropriate <br />administrative, physical, and technical security safeguards to ensure that PHI obtained by or <br />on behalf of Covered Entity is not used or disclosed by Business Associate in violation of this <br />Agreement. Such safeguards will be designed to protect the confidentiality and integrity of <br />such PHI obtained, accessed, created, maintained, or transmitted from or on behalf of <br />Covered Entity. Business Associate will comply with the applicable requirements of the <br />Security Rule. Upon request by Covered Entity, Business Associate will provide a written <br />description of such safeguards. <br />Section 3. Reporting and Mitigating the Effect of Unauthorized Uses and <br />Disclosures. <br /> Business Associate will report without unreasonable delay and in no case later <br />than sixty (60) calendar days , upon discovery, in writing and in accordance with Section <br />10.6, any Security Incident or Breach (as defined below) by it or any of its employees, <br />directors, officers, agents, subcontractors or representatives concerning the use or <br />disclosure of PHI. For purposes of this Agreement, “Breach” means any acquisition, access, <br />use or disclosure of PHI under this Agreement that is (a) in violation of HIPAA or (b) not <br />permitted under this Agreement. Business Associate will be deemed to have discovered a <br />Breach as of the first day on which the Breach is, or should reasonably have been, known to <br />(a) Business Associate or (b) any employee, officer, or other agent of Business Associate <br />other than the individual committing the Breach. Business Associate further will investigate <br />the Breach and provide to Covered Entity, as soon as possible all information Covered Entity <br />may require to make notifications of the Breach to Individuals and/or other persons or <br />entities (“Notifications”). Business Associate will cooperate with Covered Entity in <br />addressing the Breach. Business Associate will not notify Individuals or other persons or <br />entities of the Breach without the express written consent of Covered Entity, unless required <br />by applicable law. Covered Entity may direct Business Associate to make the Notifications <br />and implement other mitigation steps, in a reasonable form and manner, and within <br />reasonable timeframes directed by Covered Entity, consistent with Covered Entity’s legal <br />obligations. Business Associate will be responsible for the reasonable costs of required <br />notifications and mitigation directly resulting from such Breach to the extent the Breach is <br />determined to have resulted from the negligence, wrongful acts, or omissions of Business <br />Associate or its employees or agents. Nothing in this Agreement shall be construed to waive <br />Business Associate’s governmental immunities or defenses under North Carolina law <br />Docusign Envelope ID: 1EF8AF85-BDAA-4C06-85CF-46E260B29929