SHJ25-010 CHCW SUD ASSESSMENT - BAA - PARTIALLY EXECUTED

Home Browse Search

2.3 Safeguards. Business Associate agrees to implement and use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 to prevent use or disclosure of the Protected Health Information other than as provided for by this BA/QSO Agreement. Business Associate agrees that, when Business Associate uses, discloses, or requests Protected Health Information, it will limit the use, disclosure, or request to the minimum necessary. Business Associate acknowledges that in receiving, transmitting, transporting, storing, processing, or otherwise dealing with any Protected Health Information or Records received from the Covered Entity identifying or otherwise relating to the patients within the Covered Entity, it is fully bound by the provisions of the federal regulations governing the Confidentiality of Substance Use Disorder Patient Records, 42 C.F.R. Part 2; and the Health Insurance Portability and Accountability Act (HIPAA), 45 CF.R. Parts 142, 160, 162, and 164. 2.4 Mitigation. Business Associate agrees to mitigate promptly, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the BA Agreement, the Privacy Rule, Confidentiality Rule or other applicable federal or state law and regulations. 2.5 Reports of Improper Use or Disclosure. Business Associate agrees to immediately report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this BAA/QSO Agreement of which it becomes aware. Business Associate also agrees to immediately report to Covered Entity about any complaint that the Business Associate receives concerning the handling of Protected Health Information or compliance with this BA/QSO Agreement. Business Associate must notify Covered Entity of any Breach relating to Unsecured Protected Health Information, which notice shall be in compliance with the requirements of the HITECH Act and shall be given to Covered Entity at its designated address for receiving such notices, as soon as practicable and without unreasonable delay, and in no case later no later than five (5) business days after such breach is discovered by Business Associate. Such notice shall include, to the extent possible, the identification of each individual whose Unsecured Protected Health Information has been, or is reasonably believed by Business Associate to have been breached, along with other available information that Covered Entity may be required to include in its notification to the individual. Notice to Covered Entity may be given by email, return receipt requested or certified mail, return receipt requested. If Business Associate learns subsequent to its initial notification to Covered Entity of any additional infonnation that Covered Entity may need for its required notification to individuals, Business Associate shall promptly notify Covered Entity of such information in the same manner as specified above. 2.6 Disclosures to Agents and Subcontractors. In accordance with 45 CFR 164.502(e)(1)(ii), 164.308(b)(2), and 42 CFR Part 2 if applicable, ensure that any subcontractors that create, receive, maintain, or transmit Protected Health Information on behalf of the business associate agree to the same restrictions, conditions, and requirements that apply to the business associate with respect to such information;