Agreement between DSHS Division of Behavioral Health and Recovery and KCPHD

Home Browse Search

Use or disclose such PHI in any manner that would violate Subpart E of 45 CFR Part 164 (Privacy of Individually Identifiable Health Information) if done by Covered Entity, except for the specific uses and disclosures set forth below. d. Use for Proper Management and Administration. Business Associate may Use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. e. Disclosure for Proper Management and Administration. Business Associate may disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of the Business Associate, provided the disclosures are required by law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been Breached. Impermissible Use or Disclosure of PHI. Business Associate shall report to DSHS in writing all Uses or disclosures of PHI not provided for by this Contract within one (1) business day of becoming aware of the unauthorized Use or disclosure of PHI, including Breaches of unsecured PHI as required at 45 CFR 164.410 (Notification by a Business Associate), as well as any Security Incident of which it becomes aware. Upon request by DSHS, Business Associate shall mitigate, to the extent practicable, any harmful effect resulting from the impermissible Use or disclosure. g. Failure to Cure. If DSHS learns of a pattern or practice of the Business Associate that constitutes a violation of the Business Associate's obligations under the terms of this Contract and reasonable steps by DSHS do not end the violation, DSHS shall terminate this Contract, if feasible. In addition, If Business Associate learns of a pattern or practice of its Subcontractors that constitutes a violation of the Business Associate's obligations under the terms of their contract and iedsunable steps by the Business Associate do not end the violation, Business Associate shall terminate the Subcontract, if feasible. h. Termination for Cause. Business Associate authorizes immediate termination of this Contract by DSHS, if DSHS determines that Business Associate has violated a material term of this Business Associate Agreement. DSHS may, at its sole option, offer Business Associate an opportunity to cure a violation of this Business Associate Agreement before exercising a termination for cause. Consent to Audit. Business Associate shall give reasonable access to PHI, its internal practices, records, books, documents, electronic data and/or all other business information received from, or created or received by Business Associate on behalf of DSHS, to the Secretary of DHHS and/or to DSHS for use in determining compliance with HIPAA privacy requirements. j. Obligations of Business Associate Upon Expiration or Termination. Upon expiration or termination of this Contract for any reason, with respect to PHI received from DSHS, or created, maintained, or received by Business Associate, or any Subcontractors, on behalf of DSHS, Business Associate shall: (1) Retain only that PHI which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities; (2) Return to DSHS or destroy the remaining PHI that the Business Associate or any Subcontractors still maintain in any form; (3) Continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 DSHS Central Contract Services 1644CS Prevention Services - County (6-26-2015) Page 26