2015-057 - Laserfiche WebLink

Home Browse Search

1.15 "Unsecured Protected Health Information" or "Unsecured PHI" shall have the meaning assigned to such term in 45 C.F.R. § 164.402 and guidance issued thereunder. 2. OBLIGATIONS OF THE PARTIES 2.1 Gehring Group shall safeguard all PHI and Electronic PHI created or received by Gehring Group on behalf of Client in accordance with HIPAA. Gehring Group shall implement administrative, physical and technical safeguards that prevent use or disclosure of the Electronic Protected Health Information other than as permitted by the Security Rules. Specifically, Gehring Group agrees to implement policies and procedures in accordance with 45 C.F.R. § 164.316 that: i. Prevent, detect, contain and correct security violations in accordance with the administrative safeguards set forth in 45 C.F.R. § 164.308; ii. Limit physical access to electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed in accordance with the physical safeguards set forth in 45 C.F.R. § 164.310; and iii. Allow access to electronic information systems that maintain Electronic PHI to only those persons or software programs that have been granted access rights in accordance with the technical safeguards set forth in 45 C.F.R. § 164.312. 2.2 Gehring Group shall not use or disclose PHI or Electronic PHI except as permitted or required by Article 3 of this Agreement or as Required by Law. Gehring Group shall notify Client of all requests for the disclosure of PHI and Electronic PHI from a law enforcement or government official, or pursuant to a subpoena, court or administrative order, or other legal request as soon as possible prior to making the requested disclosure. Gehring Group shall provide to Client all PHI and Electronic PHI necessary to respond to these requests as soon as possible, but no later than ten (10) business days following its receipt of a written request from Client. 2.3 Client shall provide to Gehring Group, and Gehring Group shall request from Client, disclose to its affiliates, subsidiaries, agents and subcontractors or other third parties, only a Limited Data Set or, if necessary or otherwise permitted by HHS regulations, the minimum PHI or Electronic PHI necessary to perform or fulfill a specific function required or permitted under the Agreement. "Minimum necessary" shall be interpreted in accordance with HITECH, and in any event shall not include any direct identifiers of individuals such as names, street addresses, phone numbers or social security numbers, except for a unique identifier assigned by Client as necessary for the strategic analysis. 2.4 Gehring Group shall comply with all granted restrictions on the use and/or disclosure of PHI, pursuant to 45 C.F.R. § 164.522(a), upon written notice from Client; provided, however, that Client shall not grant any restriction that affects Gehring Group's use or disclosure of PHI without first consulting with Gehring Group. Page 3 of 8 17535410v 1