Fully Executed Contract - Laserfiche WebLink

Home Browse Search

ATTAGHMENT A HIPAA AND DATA SECURITY REOUIREMENTS sanctlons imposed against the Business Associate for violations of the HIPAA Rules and for any imposed against its Subcontractors or agents for which it is found liable. 1 0. Breach Notiflcatlon a. ln the event of a Breach of unsecured PHI or disclosure that cornpromises the privacy or security of PHI obtained from DOC or involving DOC clients, Business Associate will take all measures required by state or federal taw. b. Business Associate will notify DOC within one (1) business day by telephone and in writing of any acquisition, access, Use or disclosure of PHI not allowed by the provisions of this Agreement or not authorized by HIPM Rules or required by law of which it becomes aware which potentially compromises the security or privacy of the Protected Health lnforrnation as defined in 45 CFR 164,402 (Definitions). c. Business Associate will notify the DOC Contact shown on the cover page of this Agreement within one (1) business day by telephone or e-rnail of any potential Breach of security or privacy of PHI by the Business Associate or its Subcontractors or agents. Business Associate will follow telephone or e-mail notification with a faxed or other written explanation of the Breach, to include the following: date and time of the Breach, date Breach was discovered, location and nature of the PHl, type of Breach, origination and destination of PHl, Business Associate unit and personnel associated with the Breach, detailed description of the Breach, anticipated mitigation steps, and the narne, address, telephone nurnber, fax number, and e-mail of the individual who is responsible as the primary point of contact. Business Associate will address communications to the DOC Contact. Business Associate will coordinate and cooperate with DOC to provide a copy of its investlgation and other information requested by DOC, including advance copies of any notifications required for DOC review before disseminating and verification of the dates notifications were sent. d. lf DOC determines that Business Associate or its Subcontracto(s) or agent(s) is responsible for a Breach of unsecured PHI: (1) requiring notification of lndividuals under 45 CFR $ 164,404 (Notification to lndividuals), Business Associate bears the responsibility and costs for notifying the atfected lndividuals and receiving and responding to those lndividuals' questions or requests for additional informatlon; (2) requiring notification of the media under 45 CFR $ 164,406 (Notification to the media), Business Associate bears the responsibility and costs for notifying the media and receiving and responding to media questions or requests for additional information; (3) requiring notification of the U.S. Department of Health and Human Services Secretary under 45 CFR $ 104.408 (Notification to the $ecretary), Business Associate bears the responsibility and costs for notifying the Secretary and Washington Siato Department ol Corrections K14078 Attachment A Page 6 of 19 26RAD