Laserfiche WebLink
ATTACHMENT A <br />HIPAA AND DATA SECURITY REQUIREMENTS <br />or created, maintained, or received by Business Associate, or any Subcontractors, on <br />behalf of DOG, Business Associate shall: <br />k. Retain only that PHI which is necessary for Business Associate to continue its proper <br />management and administration or to carry out its legal responsibilities; <br />I. Return to DOC or destroy the remaining PHI that the Business Associate or any <br />Subcontractors still maintain in any form; <br />m. Continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part <br />164 (Security Standards for the Protection of Electronic Protected Health Information) <br />with respect to Electronic Protected Health Information to prevent Use or disclosure of <br />the PHI, other than as provided for in this Section, for as long as Business Associate <br />or any Subcontractors retain the PHI; <br />n. Not Use or disclose the PHI retained by Business Associate or any Subcontractors <br />other than for the purposes for which such PHI was retained and subject to the same <br />conditions set out in the "Use and Disclosure of PHI' section of this Agreement which <br />applied prior to termination; and <br />o. Return to DOC or destroy the PHI retained by Business Associate, or any <br />Subcontractors, when it is no longer needed by Business Associate for its proper <br />management and administration or to carry out its legal responsibilities. <br />p. Survival. The obligations of the Business Associate under this section shall survive the <br />termination or expiration of this Agreement. <br />4. Individual Rights. Accounting of Disclosures. <br />a. Business Associate shall document all disclosures, except those disclosures that are <br />exempt under 45 CFR 164.528, of PHI and information related to such disclosures. <br />b. Within ten (10) business days of a request from DOC, Business Associate shall make <br />available to DOC the information in Business Associate's possession that is necessary <br />for DOC to respond in a timely manner to a request for an accounting of disclosures <br />of PHI by the Business Associate. See 45 CFR 164.504(e)(2)(ii)(G) and <br />164.528(b)(1). <br />c. At the request of DOC or in response to a request made directly to the Business <br />Associate by an Individual, Business Associate shall respond, in a timely manner and <br />in accordance with HIPAA and the HIPAA Rules, to requests by Individuals for an <br />accounting of disclosures of PHI. <br />d. Business Associate record keeping procedures shall be sufficient to respond to a <br />request for an accounting under this section for the six (6) years prior to the date on <br />which the accounting was requested. <br />Washington State K14078 Page 4 of 19 <br />Department of Corrections Attachment A 26RAD <br />