Orange County NC Website
Browse       Search
co~osa~ua a~~m - Fuji Page 17 of 19 <br />h. "Security Incident" shall have the same meaning as the term "security incident" in 45 CFR 164.304. <br />i. Unless otherwise defined in this Agreement, terms used herein shall have the same meaning as those terms have <br />in the Privacy and Security Rules. <br />3. OBLIGATIONS OF BUSINESS ASSOCIATE <br />a. Business Associate agrees to not use or disclose electronic protected health information or other protected health <br />information other than as permitted or required by this Agreement or as required by law. <br />b. Business Associate agrees to implement administrative, physical, and technical safeguards that reasonably and <br />appropriately protect the confidentiality, integrity, and availability of the electronic protected health information <br />and other protected health information that it creates, receives, maintains, or transmits on behalf of a Covered <br />Entity, as required by the Privacy and Security Rules. <br />c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business <br />Associate of a use or disclosure of electronic protected health information or other protected health information <br />by a Business Associate in violation of the requirements of this Agreement. <br />d. Business Associate agrees to report to Covered Entity (i) any use or disclosure of electronic protected health <br />information or other protected health information not provided for by this Agreement of which it becomes aware <br />and (ii) any security incident of which it becomes aware. <br />e. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides electronic <br />protected health information and/or other protected health information received from, or created or received by <br />Business Associate an behalf of Covered Entity (i) agrees to be bound by the same restrictions and conditions <br />that apply through this. Agreement to Business Associate with respect to such information, and (ii) agrees to <br />implement reasonable and appropriate safeguards to protect such information. <br />f. Business Associate agrees to provide access, at the request of Covered Entity, to electronic protected health <br />information and other protected health information in a Designated Record Set to a Covered Entity or, as <br />directed by a Covered Entity, to an individual in order to meet the requirements under 45 CFR 164.524. <br />g. Business Associate agrees, at the request of a Covered Entity, to make any amendment(s) to electronic protected <br />health information and other.protected health information in a Designated Record Set that a Covered Entity <br />duects or agrees to pursuant to 45 CFR 164.526. <br />b. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, <br />including policies and procedures concerning electronic protected health information and other protected health <br />information, relating to the use and disclosure of electronic protected health information and other protected <br />health information received from, or created or received by Business Associate on behalf of, Covered Entity <br />available to the Covered Entity, or to the Secretary, in a time and manner designated by the Secretary, for <br />purposes of the Secretary determining Covered Entity's compliance with the Privacy and Security Rules. <br />i. Business Associate agrees to document such disclosures of electronic protected health information and other <br />protected health information related tQ such_disclosures-aswould.be-required--for-Covered--Ent-ity-t$~-espe~-to a- - ---- --- <br />request by an individual for an accounting of disclosures of electronic protected health information and other <br />protected health information in accordance with 45 CFR 164.528, and to provide this information to Covered <br />Entity or an individual to permit such a response. <br />• <br />