2008-078 Social Services & UNC Hospital to Provide Medicaid Workers

Browse Search

• identify the individual. "Protected Health Information" includes without limitation "Electronic Protected Health Information" as defined below. The term "Electronic Protected Health Information" means Protected Health Information which is transmitted by Electronic Media (as defined in the HIPAA Security and Privacy Rule) or maintained in Electronic Media. Business Associate acknowledges and agrees that all Protected Health Information that is created or received by Covered Entity and disclosed or made available in any form, including paper record, oral communication, audio recording, and electronic display by Covered Entity or its operating units to Business Associate or is created or received by Business Associate on Covered Entity's behalf shall be subject to this Agreement. CONFIDENTIALITY AND SECURITY REQUIREMENTS (a) Business Associate agrees: (i) to use or disclose any Protected Health Information solely: (1) for meeting its obligations as set forth in any agreements between the Parties evidencing their business relationship, or (2) as required by applicable law, rule or regulation, or by accrediting or credentialing organization to whom Covered Entity is required to disclose such information or as otherwise permitted under this Agreement, the Arrangement Agreement (if consistent with this Agreement and the HIPAA Security and Privacy Rule), or the HIPAA Security and Privacy Rule, and (3) as would be permitted by the HIPAA Security and Privacy Rule if such use or disclosure were made by Covered Entity; • (ii) to account for certain disclosures of Protected Health Information as required by Section 164.528 of the HIPAA Security and Privacy Rule. A copy of Covered Entity's policy regarding accounting of disclosures is available at http~//www med.unc.edu/security/hipaa/documents/d13.pdf ; (iii) to provide appropriate HIPAA training to its personnel within thirty days of the date of this agreement as follows: (1) general HIPAA training for all of Business Associate's personnel, and (2) Business Associate will compare the UNC HCS policies and procedures outlined in the training materials to the general HIPAA training provided by the Business Associate to its personnel, and, if there are material differences, will train all of its personnel who service the UNC HCS account on those different policies/procedures. (Business Associate may obtain a copy of the UNC HCS training materials at http://www.unchealthcare.org/site/hipaa Internet); (iv) at termination of this Agreement, the Arrangement Agreement (or any similar documentation of the business relationship of the Parties), or upon request of Covered Entity, whichever occurs first, if feasible, Business Associate will return or destroy all Protected Health Information received from or created or received by Business Associate on behalf of Covered Entity that Business Associate still maintains in any form and retain no copies of such information, or if such return or destruction is not feasible, Business Associate will extend the protections of this Agreement to the information and limit further uses and disclosures to those purposes that make the return or destruction of the information not feasible; and (v) to ensure that its agents, including a subcontractor, to whom it provides Protected Health Information received from or created by Business Associate on behalf of Covered Entity, agrees to the same restrictions and conditions that apply to Business • Associate with respect to such information, and agrees to implement reasonable and appropriate safeguards to protect any of such information which is Electronic Protected Health Information. In addition, Business Associate agrees to take reasonable steps to