2015-057 - Laserfiche WebLink

Home Browse Search

2.5 Gehring Group shall comply with all granted requests for confidential communication of PHI, pursuant to 45 C.F.R. § 164.522(b), upon written notice from Client. 2.6 Gehring Group shall report to Client any use or disclosure of PHI not permitted by this Agreement of which Gehring Group becomes aware within fifteen (15) business days of its becoming aware, and will take such corrective action necessary, or as reasonably directed by Client, in order to prevent and minimize damage to any Individual and to prevent any further such occurrences. 2.7 Following the discovery of a Breach of Unsecured PHI, Gehring Group shall notify the Client without unreasonable delay and in no case no later than fifteen (15) days after discovery of the Breach. The notification shall include the identification of each Individual whose Unsecured PHI has been or is reasonably believed by Gehring Group to have been accessed, acquired, used or disclosed during the Breach. Gehring Group shall provide the Client with any other available information that the Client requires to notify affected individuals under the Privacy Rule. 2.8 Gehring Group shall make reasonable efforts to mitigate, to the extent practicable or as reasonably directed by Client, any harmful effect that is known to Gehring Group resulting from a breach of this Agreement or HIPAA that is directly caused by Gehring Group. 2.9 Gehring Group shall report to Client any Security Incident within five (5) business days of when it becomes aware of such Security Incident. Gehring Group shall mitigate to the extent practicable or as reasonably directed by Client any harmful effect that is known to Gehring Group of a Security Incident by Gehring Group. 2.10 Gehring Group shall ensure that any Subcontractor performing services for Client agrees in writing to the same restrictions and conditions that apply to Gehring Group with regard to its creation, use, and disclosure of PHI and Electronic PHI in accordance with 45 C.F.R. §§ 164.308(b)(2), 164.502(e)(1)(ii) and I64.504(e)(5). Gehring Group shall, upon written request from Client, provide a list of any Subcontractors with whom Gehring Group has contracted to perform services for Client. Gehring Group shall advise Client if any Subcontractor breaches its agreement with Gehring Group with respect to the disclosure or use of PHI or Electronic PHI. If Gehring Group knows of an activity or practice of its Subcontractor that constitutes a material breach or violation of the Subcontractor's duties and obligations under its agreement with the Subcontractor ("Subcontractor Material Breach"), Gehring Group shall cure the breach or provide a reasonable period for Subcontractor to cure the Subcontractor Material Breach; provided, however, that if Gehring Group cannot, or Subcontractor does not, cure the Subcontractor Material Breach within such period, Gehring Group shall terminate the agreement with Subcontractor, if feasible, at the end of such period. 2.11 Gehring Group shall, upon written request from Client, provide to Client a copy of any PHI or Electronic PHI in a Designated Record Set, as defined in 45 C.F.R. § 164.501, created or maintained by Gehring Group, and not also maintained by Client, within thirty (30) days of receipt of the request. Page 4 of 8 17535410v 1