Fully Executed Contract - Laserfiche WebLink

Home Browse Search

ATTACHMENT A HIPAA AND DATA SECURITY REOUIREMENTS or created, maintained, or received by Business Associate, or any Subcontractors, on behalf of DOC, Business Associate shall: k, Retain only that PHI which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities; l. Return to DOC or destroy the remaining PHI that the Business Associate or any Subcontractors stillmaintain in any form; m. Continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 (Security Standards for the Protection of Electronic Protected Health lnformation) with respect to Electronic Protected Health lnfomation to prevent Use or disclosute of the PHl, other than as provided for in this Section, for as long as Business Associate or any Subcontractors retain the PHI; n. Not Use or disclose the PHI retained by Business Assoclate or any Subcontractors other than for the purpose$ for which such PHI was retained and subject to the same conditions set out in the "Use and Disclosure of PHl" section of this Agreement which applied prior to termination; and o. Return to DOC or destroy the PHI retained by Business Associate, or any Subcontractors, when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities. p. Survival, The obligations of the Business Associate under this section shall survive the termination or expiration of this Agreement. 4. lndividual Rights. Accounting of Disclosures. a. Business Associate shall document all di$closures, except those disclosures that are exempt under 45 CFR 164.528, of PHI and information related to such disclosures. b. Within ten (10) business days of a request from DOC, Business Associate shall make available to DOC the information in Business Associate's possession that is necessary for DOC to respond in a timely manner to a request for an accounting of disclosures of PHI by the Business Associate. See 45 CFR 164.504(e)(2XiiXG) and 164.528(bX1). c. At the request of DOC or in response to a request made directly to the Business Associate by an lndividual, Business Associate shall respond, in a timely manner and in accordance with HIPAA and the HIPAA Rules, to requests by lndividuals for an accounting of disclosures of PHl. d. Business Associate record keeping procedures shall be sufficient to respond to a request for an accounting under this section for the six (6) years prior to the date on which the accounting was requested. Washington State Depariment of Corrections K:L4O7B Attachment A Page 4 of 19 26RAD