Res-2021-108 interlocal - Laserfiche WebLink

Home Browse Search

compliance with the privacy provisions of law that apply to the Business Associate to the same extent as the Covered Entity. B. Security: Implement administrative, physical. and. technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the PHI that it creates, receives, maintains, or transmits on behalf of the Covered Entity as required by law. The Business Associate is directly responsible for compliance with the security provisions of HIPAA and HITECH to the same exten! as the Covered Entity. C. lmoroper Disclosures: Report all unauthorized or otherwise improper disclosures of pHI, or security incident, to the Covered Entity within two (2) days of the Business Associate's knowledge of such event. D. Notice of Breach: Within two (2) business days of tbe discovery of a breach as defined at 45 CFR *164.4A2 notify the Covered Entity of any breach of unsecured PHI. Notification shall by the most rapid means reasonably possible, such as telephonic notice made directly to an applopriate person within the covered entity and not including a voice mail or similar message . Written notification shall follow within that fwo (2) period by fax and be confirmed by direct contact with the intended recipient, and include fhe identification of each individual whose unsecured PHI has been, or is reasonably believed by the Business Associate to have been, accessed, acquired., or disclosed during such breach; a brief description of what happened, including the date of rhe breach and the date of the discovery of the breach, if known; a description of the types of unsecured pHI that were involved in the breach (such as whether full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved); any steps individuals should lake to protect themselves from potential harm resulting from the breach; a brief description of what the Business Associate is doing to investigate the breach, to mitigateharmto individuals, and to protect against any further breaches; the contact procedures of the Business Associate for individuals to ask questions or learu additional infbrmation, which shall include a toll free number! an e- mail address, Web site, or postal address; and any other information required to be provided to the individual by the Covered Entity pursuanr to 45 CFR g 164.404, as amended. A breach shall be treated as discovered in aceordance with the tenns of 45 CFR $ 164'410. The information shall be updated promptly and provided to the Covered Enrify as requested by the Covered Entity. E. Mitisation: Mitigate, to the extent practicable, any hannful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Addendum or the law. F. Agents: Ensure that any agent, including all of its employees, representatives, and subcontractors, to whom it provides PHI received from, or created or receivecl by Business Associate on behalf of Covered Entity agrees to the same restrictions and B. A. A. Artachment Page 2 of 5