Health Services Agreement - Laserfiche WebLink

Home Browse Search

2.3 2.4 2.5 Safeguards. Business Associate agrees to implement and use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 to prevent use or disclosure of the Protected Health lnformation other than as provided for by this BA/QSO Agreement. Agrees that, when Business Associate uses, discloses, or requests Protected Health lnformation, it will limit the use, disclosure, or request to the minimum necessary. Business Associate acknowledges that in receiving, transmitting, transporting, storing, processing, or otherwise dealing with any Protected Health lnformation or Records received from the Covered Entity identifying or otherwise relating to the patients within the Covered Entity, it is fully bound by the provisions of the federal regulations governing the Confidentiality of Substance Use Disorder Patient Records, 42 C.F.R, Part 2; and the Health lnsurance Portability and Accountability Act (HIPAA), 45 C.F.R. Parts 142, 160,162, and 154. Mitigation. Business Associate agrees to mitigate promptly, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health lnformation by Business Associate in violation of the BA Agreement, the Privacy Rule, Confidentiality Rule or other applicable federal or state law and regulations. Reoorts of lmproper Use or Disclosure. Business Associate agrees to immediately report to Covered Entity any use or disclosure of the Protected Health lnformation not provided for by this BA Agreement of which it becomes aware. Business Associate also agrees to immediately report to Covered Entity about any complaint that the Business Associate receives concerning the handling of Protected Health lnformation or compliance with this BA Agreement. Business Associate must notify Covered Entity of any Breach relating to Unsecured Protected Health lnformation, which notice shall be in compliance with the requirements of the HITECH Act and shall be given to Covered Entity at its designated address for receiving such notices, as soon as practicable and without unreasonable delay, and in no case later no later than five (5) business days after such breach is discovered by Business Associate. Such notice shall include, to the extent possible, the identification of each individual whose Unsecured Protected Health lnformation has been, or is reasonably believed by Business Associate to have been breached, along with other available information that Covered Entity may be required to include in its notification to the individual. Notice to Covered Entity may be given by email, return receipt requested or certified mail, return receipt requested. lf Business Associate learns subsequent to its initial notification to Covered Entity of any additional information that Covered Entity may need for its required notification to individuals, Business Associate shall promptly notify Covered Entity of such information in the same manner as specified above. 2.6 Disclosures to and Subcontractors.ln accordance with 45 CFR 16a.502(e)(1Xii), 164.308(bX2), and 42 CFR Part 2 if applicable, ensure that any subcontractors that create, receive, maintain, or transmit Protected Health lnformation on behalf of the business associate agree to the same restrictions, conditions, and requirements that apply to the business associate with respect to such information; B. A. A. Attachment Page 4 of 8