Signed Amendment Between Kittitas Co and Ellensburg Family Medicine

Home Browse Search

con]|')liiiltce lvith the privacy provisions of law that apply to the BLrsiness Associatc- to the same extent as the Covered Entity. B. Security: Irrrplemcnt administrative. physical, and technical safeguards that reasonably and appropriately protect the cont'ideritiality, integrity, and availability of the PLII that it creates, receives, tnaintains, or transnrits on behalf of the Covered Entity as required by larv. The Business Associate is directly responsible tbr cornpliance r,vith the security provisions of HIPAA and I-IITECH to the sarne extent as the Covered Entiry. C. lmproper Disclosures: Report all unauthorized or otherwise improper disclosures of PI{I, or security incidcnt, to the Covered Entiry within tr.vo (2) days of the Business Associate's knou'ledge of such event. D. Notice of Breach: Within trvo [2) business days of the discovery of a breach ns defined at 45 CFR s\164.40? notily the Covered Entity of any breach of unsecurctl PHI. Notification shall by tlte most rapid nreans reasonably possible, such as telephonic notice made directly to an appropriate person rvithin the covered entity and not including a voice mail or similar message. Writtett notification shall follow rvithirr that tir o (2) period by fax and be continrted by direct contact lvith the interrded recipient, and include the identiflcation of each individual whose unsecured PHI has been. or is reasonably believed by the Business Associate to have been, accessed, acquired, or disclosed durirrg such breach; a brief description of what happened, including the date of the breach and tlre date of the discovery of the breach. if,known; a clescriptiorr of the types of unsecured PHI thal" were involved in the breach (such as whether fullname, socialsecurity number, date of birth, horne acldress, account nuntber, diagnosis, disability code, or other t-vpes of inlormation u'ere involved); any steps individuals should take to proteci themselves fi'om potential harm resulting from the breach; a brief description of what the Business Associate is doing to investigate the breach, to rnitigate harm to individuals, and to protect against any further breaches; the contact pr-ocedurcs of the Business Associate for individuals to ask questions or learn additional inft:nnation. r.vhich shall include a toll free number, an e- mail address, Web site, or postal address; and any other infomration required to be provided to the individual by the Covered Entity pumuant to 45 CFR $ 164.40-1, as amended. A br:each shall be tleated as discovered in accordance rvith the temrs ol'45 CFR $164.410. The infomratiori shall be updated promptly and provided to the Coveted Entity as requested by the Covered Entity. E. IMitigation: Mitigate, to the extent practicable, any hannful effect that is known to Business Associnte of a use or disclosure of PHI by Business Associatc in violation of the requirements of this Addendum or the law. F. Agents: Ensure that any agent, irrcludirrg all of its employees, representatives, and subconfractors, to lvhom it provides PHI received from, or created or received by Business Associate on behalf of Covered Entity agrees to the same restrictions and B. A. A. Attachrnent Page 2 of 5