Laserfiche WebLink
(2) Return to DSHS or destroy the remaining PHI that the Business Associate or any <br />Subcontractors still maintain in any form; <br />(3) Continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part <br />164 (Security Standards for the Protection of Electronic Protected Health <br />Information) with respect to Electronic Protected Health Information to prevent Use <br />or disclosure of the PHI, other than as provided for in this Section, for as long as <br />Business Associate or any Subcontractors retain the PHI; <br />(4) Not Use or disclose the PHI retained by Business Associate or any Subcontractors <br />other than for the purposes for which such PHI was retained and subject to the <br />same conditions set out in the "Use and Disclosure of PHI" section of this Contract <br />which applied prior to termination; and <br />(5) Return to DSHS or destroy the PHI retained by Business Associate, or any <br />Subcontractors, when it is no longer needed by Business Associate for its proper <br />management and administration or to carry out its legal responsibilities. <br />k. Survival. The obligations of the Business Associate under this section shall survive the <br />termination or expiration of this Contract. <br />4. Individual Rights. <br />a. Accounting of Disclosures. <br />(1) Business Associate shall document all disclosures, except those disclosures that <br />are exempt under 45 CFR 164.528, of PHI and information related to such <br />disclosures. <br />(2) Within ten (10) business days of a request from DSHS, Business Associate shall <br />make available to DSHS the information in Business Associate's possession that is <br />necessary for DSHS to respond in a timely manner to a request for an accounting <br />of disclosures of PHI by the Business Associate. See 45 CFR 164.504(e)(2)(ii)(G) <br />and 164.528(b)(1 ). <br />(3) At the request of DSHS or in response to a request made directly to the Business <br />Associate by an Individual, Business Associate shall respond, in a timely manner <br />and in accordance with HIPAA and the HIPAA Rules, to requests by Individuals for <br />an accounting of disclosures of PHI. <br />(4) Business Associate record keeping procedures shall be sufficient to respond to a <br />request for an accounting under this section for the six (6) years prior to the date on <br />which the accounting was requested. <br />b. Access <br />(1) Business Associate shall make available PHI that it holds that is part of a <br />Designated Record Set when requested by DSHS or the Individual as necessary to <br />satisfy DSHS's obligations under 45 CFR 164.524 (Access of Individuals to <br />Protected Health Information). <br />Washington State <br />Health Care Authority Page 56 of90 HCA Contract No. K3924