Resolution 2024-138 - Laserfiche WebLink

Home Browse Search

Docusign Envelope lD: 69062889-783A-43C3-9277-CF5FF2FBA300 receives, maintains, or transmits on behalf of the Covered Entity as required by law. The Business Associate is direotly responsible for compliance with the secudty provisions of HIPAA and HITECH to the same extent as the Covered Entify. C. Improper Disclosures: Report all unauthorized or otherwise improper disclosures of PHI, or security incident, to the Covered Entity within two (2) days of the Business Associate's knowledge of such event. D. Notice of Breach: Within two (2) business days of the discovery of a breach as defined at 45 CFR $164.402 notify the Covered Entity of any breach of unsecured PHI. Notification shall by the rnost rapid means reasonably possible, such as telephonio notice made directly to an appropriate person within the covered entity and not including a voice mail or similar message. Written notification shall follow within that two (2) period by fax and be confirmed by direot contact with the intsnded recipient, and include the identification of each individual whose unsecured PHI has been, or is reasonably believed by the Business Associate to have been, accessed, acquiredo or disclosed during such breach; a brief desoription of what happened, including the date of the breach and the date of the discovery of the heach, if knowry a desuiption of the types of unsecured PHI that were involved in the breaoh (such as whether full name, social security number, date of birth, home address, account number, diagnosis, disability oode, or other types of infornation were involved); any steps individuals should take to protect themselves from potential harm resulting from the breach; a brief description of what the Business Associate is doing to investigate the breaoh, to mitigate harm to individuals, and to proteot against any further breaches; the contact procedures of the Business Associate for individuals to ask questions or learn additional information, which shall include a toll free number, an e-mail address, lVeb site, or postal address; and any other information required to be provided to the individual by the Covered Entity pursuant to 45 CFR $ 164.404, as amended. A breach shall be treated as discovered in accordance with the terms of 45 CFR $164.410. The information shall be updated promptly and provided to the Covered Entity as requested by the Covered Entily. E. Mitigation: Mitigate, to the extent practicable, any harmful effeot that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Addendum or the law. F. Agents: Ensure that any agent, including all of its employees, representatives, and subcontractors, to whom it provides PHI received from, or created or received by Business Associate on behalf of Covered Entity agrees to the same restrictions and conditions that apply through this Addendum to Business Assosiate with respect to such information. G. Right of Access: 1, From time to time upon reasonable advance notice, or upon a reasonable determination by Covered Entity that Business Associate has potentially or actually breached this Addendum, make internal practices, books, and records relating to the use and disclosure of PHI reoeived from, or created or reoeived by Business Associate on behalf of Covered Entity available to the Covered Entity, or at the request of the Covered Entity to the Secretary of Department of Health and Human Services, for the purpose of determining compliance with HIPAA, I-IITECH, and/or this Addendum,