INTERLOCAL CWU MAT EVALUATOR - FY23 COSSUP - NEEDS BOCC

Home Browse Search

receives, maintains, or transmits on behalf of the Covered Entity as required by law. The Business Associate is directly responsible for compliance with the security provisions of HIPAA and HITECH to the same extent as the Covered Entity. C. Improper Disclosures: Report all unauthorized or otherwise improper disclosures of PHI, or security incident, to the Covered Entity within two (2) days of the Business Associate's knowledge of such event. D. Notice of Breach: Within two (2) business days of the discovery of a breach as defined at 45 CFR § 164.402 notify the Covered Entity of any breach of unsecured PHI. Notification shall by the most rapid means reasonably possible, such as telephonic notice made directly to an appropriate person within the covered entity and not including a voice mail or similar message. Written notification shall follow within that two (2) period by fax and be confirmed by direct contact with the intended recipient, and include the identification of each individual whose unsecured PHI has been, or is reasonably believed by the Business Associate to have been, accessed, acquired, or disclosed during such breach; a brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known; a description of the types of unsecured PHI that were involved in the breach (such as whether full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved); any steps individuals should take to protect themselves from potential harm resulting from the breach; a brief description of what the Business Associate is doing to investigate the breach, to mitigate harm to individuals, and to protect against any further breaches; the contact procedures of the Business Associate for individuals to ask questions or learn additional information, which shall include a toll free number, an e-mail address, Web site, or postal address; and any other information required to be provided to the individual by the Covered Entity pursuant to 45 CFR § 164.404, as amended. A breach shall be treated as discovered in accordance with the terms of 45 CFR § 164.410. The information shall be updated promptly and provided to the Covered Entity as requested by the Covered Entity. E. Miti aQ tion: Mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Addendum or the law. F. Agents: Ensure that any agent, including all of its employees, representatives, and subcontractors, to whom it provides PHI received from, or created or received by Business Associate on behalf of Covered Entity agrees to the same restrictions and conditions that apply through this Addendum to Business Associate with respect to such information. G. Right of Access: 1. From time to time upon reasonable advance notice, or upon a reasonable determination by Covered Entity that Business Associate has potentially or actually breached this Addendum, make internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of Covered Entity available to the Covered Entity, or at the request of the Covered Entity to the Secretary of Department of Health and Human Services, for the purpose of determining compliance with HIPAA, HITECH, and/or this Addendum.