2017-121E - Laserfiche WebLink

Home Browse Search

"Security Rule" means the Security Standards and Implementation Specifications at 45 C.F.R. Parts 160 and 164, Subparts A and C. "Standards for Electronic Transactions Rule" means the final regulations issued by Health and Human Services concerning standard transactions and code sets under the Administrative Simplification provisions of HIPAA, 45 C.F.R. Parts 160 and 162. All terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in the HIPAA Rules. ARTICLE 2. OBLIGATIONS AND ACTIVITIES OF LOCKTON 2.1 Lockton agrees to not Use or further Disclose PHI other than as permitted or required by this Agreement or as Required By Law. 2.2 Lockton agrees to use appropriate safeguards to prevent the Use or Disclosure of the PHI other than as provided for by this Agreement. 2.3 Lockton agrees to implement administrative, physical, and technical safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI. 2.4 Lockton agrees to notify the Plan of any Security Incident or Use or Disclosure of PHI not permitted by this Agreement of which Lockton is aware, including any Breach of Unsecured PHI as required by 45 C.F.R. 164.410. Such notice shall be provided within three (3) business days and shall include, to the extent possible, information that is required to be included in notification to the individual under 45 C.F.R. 164.404. 2.4.1 Lockton and Plan agree that unsuccessful attempts at unauthorized access or system interference occur frequently and that there is no significant benefit for data security from requiring the documentation and reporting of such unsuccessful intrusion attempts. In addition, both parties agree that the cost of documenting and reporting such unsuccessful attempts as they occur would outweigh any potential benefit gained from reporting them. Consequently, both Lockton and Plan agree that this Agreement shall constitute the documentation, notice and written report of such unsuccessful attempts at unauthorized access or system interference as required above and by 45 C.F.R. Part 164, Subpart C and that no further notice or report of such attempts with be required. By way of example (and not limitation in any way), the Parties consider the following to be illustrative (but not exhaustive) of unsuccessful Security Incidents when they do not result in unauthorized access, use, disclosure, modification, or destruction of e -PHI or interference with an information system: 1. Pings on a Party's firewall, 2. Port scans, Lockton Business Associate Agreement_rcv42015