Ellensburg Family Medicine - Complete copy with Amendments

Home Browse Search

C011111hancc with the privacy provisions of law that apply [,) the Business Associate to the sarlle extent as the Covered Fruity, A. Secur-it1,: 41111)1enient administrative. physical. and technical sal-eguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the PHI that it creates, receives, nlaitltarils, 01, translllits on behalf of the Covered Entity as required by la". The Business Assoc:iatC is directly responsible for conlpliatice tvitll the security provision; of HIPAA and i-IITECH to the sarlle extent as rile Covered Entity. C. Improper Disclosures: Report ,all unauthorized or otherwise improper disclosures of PI I I, or security incident, to the Covered Entity within two (2) days Of the Business Associate's knowledge of such event. D. Notice of Breach: Within two (2) business clays of the disco%cry of a breach its defined at 45 C'FIR § 164.402 notify [he Covered Entity of any bre,ich of unsecured PHI. Noti ricati oil shall by the most rapid rneans reasonably possible, such as tclephorlic notice made directly to an appropriate person within the covered entity and not including a voice mail or similar menage. written notification shall fol]Ok� within that two (2) period by Fax and be confirmed by diiect contact with the intended recipient, and include the identification of arch individual whose unsecured PHI has been, or is reasonably believed by the Busrrle.S,S Associate to have been, accessed, acquired, or disclosed during such breach; a brief description of what happened. including the date ofthe breach and the date ofthe discovery of the breach. i f known: a description of the types of unsecured PHI that were involved in the breach (such as whether fill] rlatne, social security number, date of -birth, home address. tnccount number, diagnosis, disability code, or other types of information were involved); any step,, individt_ralti should take to protect themselves frorn potential harm resulting from the breach, a brief description of what the Business Associate is doing to investigate the breach, to mitigate harm to individuals, and to protect against any fitillier breaches; the contact procedures of file Business Associate for individuals to ask questions or Darn additional information, which shall include a toll tree dumber, an e mail address, Web site, or postal address; and any other intonation required to be provided to the individual by the Covered Entity pt.n-suant to 45 CFR § 164, 404, as amended. A breach shall be treated as discovered in accordance -v►'ith the terms of 45 CFR 5164 410. The information shall be updated promptly and provided to [lie Covered Entity its requested by the Covered Entity, E. Mitigation: Mitigate, to die extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate it] violation of the requirements of this Addendum or the law. F. A+dents: Ensure that any agent, including all of its employees, representatives, and subcontractors, to whore it provides PHI received from, or created or received by Business Associate on behalf of Covered Entity agrees to the same restrictions and B. A. A. Attachment Page 2 of 5