02/17/2015 (2) - Laserfiche WebLink

Home Browse Search

that is not provided for or permitted by this Agreement or under HIPAA. Service Provider shall be responsible for all reasonable costs of notification associated with a breach or impermissible disclosure. (b) Service Provider agrees to report to Client and Gehring Group the aggregate number of unsuccessful, unauthorized attempts to access, use, disclose, modify or destroy electronic versions of any of PHI or interfere with systems operations in an Information System containing PHI, of which Service Provider becomes aware, provided that: (a) such reports will be provided only as frequently as the Parties mutually agree, but no more than once per month; and, (b) if the definition of "Security Incident' is amended under the Security Rule to remove the requirement for reporting "unsuccessful" attempts to use, disclose, modify or destroy electronic PHI, this Section 2.3 shall no longer apply as of the effective date of such amendment. (c) Service Provider shall notify Client and Gehring Group of a Breach of unsecured PHI within ten (10) business days after discovery of such a Breach in accordance with 45 CFR 164.410. The notice required by this Section 2.3(c) shall include, to the extent possible, the identification of each individual whose unsecured protected health information has been, or is reasonably believed by Service Provider to have been, accessed, acquired, used, or disclosed during the breach. Such notice shall also include, any of the following information, if available: (i) A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known; (ii) A description of the types of unsecured protected health information that were involved in the breach; and (iii) A brief description of what the breaching Party is doing to investigate the breach, to mitigate harm to individuals, and to protect against any further breaches. 2.4 Use of Subcontractors. (a) Service Provider shall not delegate the performance of any Services without the prior written consent of Gehring Group and Client. (b) To the extent that Service Provider uses one or more subcontractors or agents to perform its obligations under the Service Provider Agreement, and such subcontractors or agents receive or have access to PHI, Service Provider agrees to obtain written Service Providers that any such subcontractor or agent agrees to the same restrictions and conditions that apply to Service Provider with respect to such PHI, including the requirement that subcontractors and agents agree to implement reasonable and appropriate safeguards to protect electronic PHI that is disclosed to subcontractors and agents by Subcontractor. Service Provider will disclose to any such subcontractor no more than a limited data set or the Minimum Necessary, as applicable, pursuant to HIPAA requirements. (c) If, pursuant to future regulations promulgated by HHS, subcontractors of business associates are deemed to be business associates, Service Provider will (i) ensure its subcontractors comply with all of the provisions of HIPAA applicable to business associates; and 3 17670672v.2 81