Fully Executed Contract - Laserfiche WebLink

Home Browse Search

ATTACHMENT A HIPAA AND DATA SECURITY REOUIREMENTS health care component of the Covered Entity that relates to the provision of health care to an lndividual; the past, present, or future physical or mental health or condition of an lndividual; or the past, present, or future payment for provision of health care to an lndividual. 45 CFR 160.103, PHI includes demographic information that identifies the lndividual or about which there is reasonable basis to believe can be used to identify the lndividual. 45 CFR 160,103. PHI is information transmitted or held in any form or medium and includes EPHI. 45 CFR 160.103. PHI does not include education records covered by the Family Educational Rights and Privacy Act, as amended, 20 USCA 1232g(a)(4)(BXiv) or employment records held by a Covered Entity in its role as employer, "security lncidenf' means the attempted or successful unauthorized access, use, disclosure, modification or destruction of information or interference with system operations in an information system. m. "subcontractor' as used in this HIPAA Compliance section of the Agreement means a Business Associate that creates, reoeives, maintains, or transmits Protected Health lnformation on behalf of another Business Associate, n. "Use" includes the sharing, employment, application, utilization, examination, or analysis, of PHI within an entity that maintains such information. 2, Compliance. Business Associate shall perform all Agreement duties, activities and tasks in compliance with HIPM, the HIPAA Rules, and all attendant regulations as promulgated by the U.S. Department of Health and Human Services, Otfice of Civil Rights. 3. Use and Disclosure of PHl. Business Associate is limited to the following permitted and required uses or disclosures of PHI: a. Duty to Prolect PHl. Business Associate shall ptotect PHI from, and shall use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 (Security Standards for the Protection of Electronic Protected Health lnformation) with respect to EPHI, to prevent the unauthorized Use or disclosure of PHI other than as provided for in this Agreement or as required by law, for as long as the PHt is within its possession and control, even after the termination or expiration of this Agreement. b. Minimum Necessary Standard. Business Associate shall apply the HIPAA Minirnum Necessary standard to any Use or disclosure of PHI necessary to achieve the purposes of this Agreement. See 45 CFR 164.514 (d)(2) through (dxs). c. Disclosure as Part of the Provision of Services. Business Associate shall only Use or disclose PHI as necessary to perform the services specified in this Agreement or as required by law, and shall not Use or disclose such PHI in any manner that would violate Subpart E of 45 CFR Part 164 (Privacy of lndividually ldentifiable Health lnforrnation) if done by Covered Entity, except for the specific uses and disclosures set forth below. Washington State Department of Corrections KL4W8 Attachment A Page 2 of 19 26RAD