Agreement between DSHS Division of Behavioral Health and Recovery and KCPHD

Home Browse Search

(Security Standards for the Protection of Electronic Protected Health Information) with respect to Electronic Protected Health Information to prevent Use or disclosure of the PHI, other than as provided for in this Section, for as long as Business Associate or any Subcontractors retain the PHI; (4) Not Use or disclose the PHI retained by Business Associate or any Subcontractors other than for the purposes for which such PHI was retained and subject to the same conditions set out in the "Use and Disclosure of PHI" section of this Contract which applied prior to termination; and (5) Return to DSHS or destroy the PHI retained by Business Associate, or any Subcontractors, when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities. k. Survival. The obligations of the Business Associate under this section shall survive the termination or expiration of this Contract. 17. Individual Rights. a. Accounting of Disclosures. (1) Business Associate shall document all disclosures, except those disclosures that are exempt under 45 CFR 164.528, of PHI and information related to such disclosures. (2) Within ten (10) business days of a request from DSHS, Business Associate shall make available to DSHS the information in Business Associate's possession that is necessary for DSHS to respond in a timely manner to a request for an accounting of disclosures of PHI by the Business Associate. See 45 CFR 164.504(e)(2)(ii)(G) and 164.528(b)(1). (3) At the request of DSHS or in response to a request made directly to the Business Associate by an Individual, Business Associate shall respond, in a timely manner and in accordance with HIPAA and the HIPAA Rules, to requests by Individuals for an accounting of disclosures of PHI. (4) Business Associate record keeping procedures shall be sufficient to respond to a request for an accounting under this section for the six (6) years prior to the date on which the accounting was requested. b. Access (1) Business Associate shall make available PHI that it holds that is part of a Designated Record Set when requested by DSHS or the Individual as necessary to satisfy DSHS's obligations under 45 CFR 164.524 (Access of Individuals to Protected Health Information). (2) When the request is made by the Individual to the Business Associate or if DSHS asks the Business Associate to respond to a request, the Business Associate shall comply with requirements in 45 CFR 164.524 (Access of Individuals to Protected Health Information) on form, time and manner of access. When the request is made by DSHS, the Business Associate shall provide the records to DSHS within ten (10) business days. c. Amendment. (1) If DSHS amends, in whole or in part, a record or PHI contained in an Individual's Designated Record Set and DSHS has previously provided the PHI or record that is the subject of the amendment to Business Associate, then DSHS will inform Business Associate of the amendment pursuant to 45 CFR 164.526(c)(3) (Amendment of Protected Health Information). DSHS Central Contract Services 1644CS Prevention Services - County (6-26-2015) Page 27