2015-057 - Laserfiche WebLink

Home Browse Search

2.12 Gehring Group shall, upon written request from Client, make any amendment to PHI in a Designated Record Set maintained by Gehring Group within thirty (30) days of receipt of the request unless Gehring Group can establish to Client's satisfaction that the PHI at issue is accurate and complete. 2.13 If an Individual's PHI is held in an Electronic Health Record, Gehring Group shall provide requested copies in electronic format to the individual or to an entity or person designated by the Individual, provided such designation is clearly and conspicuously made by the Individual or Client. 2.14 Gehring Group shall make its internal practices, written policies and procedures, books, records, and other documents relating to the use and disclosure of PHI and/or Electronic PHI created or maintained by Gehring Group on behalf of Client available to the Secretary of the Department of Health and Human Services, or his or her designee, for purposes of the Secretary determining Client's compliance with HIPAA. 2.15 Gehring Group shall make available the information required to provide an accounting of disclosures made on and after the Effective Date, as necessary for Client to comply with 45 C.F.R. § 164.528, within twenty (20) business days of receipt of the request. Gehring Group shall provide one such accounting within a twelve month period without charge, but may make a reasonable charge for any additional such accountings within the same twelve month period. 2.16 Gehring Group shall maintain all records, other than those records that are also maintained by Client, for six (6) years from the date created or last in effect, whichever is later, as necessary for Client to comply with 45 C.F.R. § 164.530(j)(2). 3. PERMITTED USES OF PHI 3.1 Gehring Group may use and disclose PHI and Electronic PHI as necessary to provide services to Client, subject to Section 2.3 of this Agreement and consistent with the requirements of HIPAA. 3.2 Gehring Group may use and disclose PHI and Electronic PHI as necessary for the proper management and administration of Gehring Group or to carry out Gehring Group's legal responsibilities, subject to Section 2.4 of this Agreement and consistent with the requirements of HIPAA; provided, however, that Gehring Group may disclose the PHI and Electronic PHI for such purposes only if: i. the disclosure is Required by Law, or ii. Gehring Group obtains reasonable assurances that the party to whom the PHI or Electronic PHI is disclosed (a) will protect the confidentiality of the PHI and Electronic PHI, (b) will not further disclose the PHI or Electronic PHI except as Required by Law or for the purposes for which it was disclosed to the other party, and (c) will report any improper use or disclosure of the PHI and/or Electronic PHI to Gehring Group. Page 5 of 8 17535410v 1