Fully Executed Contract - Laserfiche WebLink

Home Browse Search

ATTACHMENT A HIPAA AND DATA SECURITY REOUIREMENTS Par-t 1: HIPAA Requirements 1. Definitions. a, "Bu$iness Associate," as used in this Agreement, means the "Contractor" and generally has the same meaning as the term "business associate" al45 CFR 1 60. 1 03. Any reference to Business Associate in this Agreement includes Business Associate's employees, agents, officers, Subcontractors, third party contractors, volunteers, or directors. b. "Business Associate Agreement" means this HIPAA Compliance section of the Agreement and includes the Business Associate provisions required by the U.S. Department of Health and Human Services, Office for Civil Rights. c. "Breach" means the acquisition, access, Lrse, or disclosure of Protected Health lnformation in a manner not permitted under the HIPAA Privacy Rule which compromises the security or privacy of the Protected Health lnformation, with the exclusions and exceptions listed in 45 CFR 164.402. d. "Covered Entity" means DOC, a Covered Entity as defined at 45 CFR 160.103, in its conduct of covered functions by its health care components. e. "Designated Record Sef' means a group of records maintained by or for a Covered Entity, that is: the medical and billing records about tndividuals maintained by or for a covered health care provider; the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or Used in whole or part by or for the Covered Entity to make decisions about lndividuals. f. "Electronic Protected Health lnformation (EPHI)'means Protected Health lnformation that is transmitted by electronic media or maintained in any medium described in the definition of electronic media at 45 CFR 160"103, g. 'HIPAA" means the Health lnsurance Portability and Accountability Act of 1996, Pub. L. 104-191, as modified by the American Recovery and Reinvestment Act of 2009 ("ARRA'), Sec. 13400 * 13424, H.R, 1 (2000) (HITECH Act). h. "HIPM Rules" means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and Part 164. i, "lndividual(s)" means the person(s) who is the subject of PHI and includes a per$on who qualifies as a personal representative in accordance with 45 CFR 164.502(9). j. "Minimum Necessary" means the least amount of PHI necessary to accomplish the purposeforwhich the PHI is needed. k. "Protected Health lnformation (PHl)" means individually identifiable health information created, received, maintained or transmitted by Business Associate on behalf of a Washington State Department of Corrections Kl4078 Attachment A Page 1 of 19 25RAD