SH17-040 Prof Service Agreement & BAA signed

Home Browse Search

G. Right of Access: 1. From time to time upon reasonable advance notice, or upon a reasonable determination by Covered Entity that Business Associate has potentially or actually breached this Addendum, make internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of Covered Entity available to the Covered Entity, or at the request of the Covered Entity to the Secretary of Department of Health and Human Services, for the purpose of determining compliance with HIPAA, HITECH, and/or this Addendum. 2. From time to time upon reasonable advance notice, or upon a reasonable determination by Covered Entity that Business Associate has potentially or actually breached this Addendum, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528, or to permit Covered Entity to respond to a request by an Individual for access to PHI in accordance with 45 CFR § 164.524. H. Documentation of Disclosures: Document such disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528. Should an individual make a request to Covered Entity for an accounting of disclosures of his or her PHI pursuant to 45 CFR § 164.528, Business Associate agrees to promptly provide an accounting, as specified under 42 U.S.C. § 17935(c) (1) and 45 CFR § 164.528, of disclosures of PHI that have been made by the Business Associate acting on behalf of the Covered Entity. The accounting shall be provided by the Business Associate to the Covered Entity or to the individual, as directed by the Covered Entity. I. Amendments: Make any amendments to PHI that the Covered Entity directs or agrees to pursuant to 45 CFR § 164.526 at the request of Covered Entity, within five (5) business days of written request by Covered Entity. J. Other: To the extent the Business Associate is to carry out one or more of the covered entities obligations under Subpart E of 45 CFR 164, comply with the requirements of Subpart E that apply to the covered entity in the performance of such obligations. III. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE A. Except as otherwise limited in this Addendum or by law, Business Associate may use Protected Health Information for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. The Business Associate shall limit its use and disclosure of, and requests for, PHI to the minimum necessary as determined in accordance with 42 U.S.C. § 17935(b)(1), B. Except as otherwise limited in this Addendum or by law, Business Associate may use PHI to provide Data Aggregation services to Covered Entity as permitted by 45 CFR § 164.504.(e)(2)(i)(B). B. A. A. Page 3 of 6