Ellensburg Family Medicine - Complete copy with Amendments

Home Browse Search

compliance with the privacy provisions of law that apply to the Business Associate to the same extent as the Covered Entity. B. Security: implement administrative. physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the PHI that it creates, receives, maintains, or transmits on behalf of the Covered Entity as required by law. The Business Associate is directly responsible for compliance with the security provisions of HIPAA and HITECH to the same extent as the Covered Entity. C. Improper Disclosures: Report all unauthorized or otherwise improper disclosures of PHI, or security incident, to the Covered Entity within two (2) days of the Business Associate's knowledge of such event. D. Notice of Breach: Within two (2) business days of the discovery of breach as defined at 45 CFR § 164.402 notify the Covered Entity of any breach of unsecured PHI. Notification shall by the most rapid means reasonably possible, such as telephonic notice made directly to an appropriate person within the covered entity and not including a voice mail or similar message. Written notification shall follow within that two (2) period by fax and be confirmed by direct contact with the intended recipient, and include the identification of each individual whose unsecured PHi has been, or is reasonably believed by the Business Associate to have been, accessed, acquired, or disclosed during such breach; a brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known; a description of the types of unsecured PHI that were involved in the breach (such as whether fall name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved); any steps individuals should take to protect themselves from potential harm resulting from the breach; a brief description of what the Business Associate is doing to investigate the breach, to mitigate harm to individuals, and to protect against any further breaches; the contact procedures of the Business Associate for individuals to ask questions or learn additional information, which shall include a toll free number, an e- mail address, Web site, or postal address; and any other information required to be provided to the individual by the Covered Entity pursuant to 45 CFR § 164.404, as amended. A breach shall be treated as discovered in accordance with the terms of45 CFR §164.410. The information shall be updated promptly and provided to the Covered Entity as requested by the Covered Entity. E. Mitigation: Mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Addendum or the law. F. Agents. Ensure that any agent, including all of its employees, representatives, and subcontractors, to whom it provides PHI received from, or created or received by Business Associate on behalf of Covered Entity agrees to the same restrictions and B. A. A. Attachment Page 2 of 5