02/17/2015 (2) - Laserfiche WebLink

Home Browse Search

(ii) require any agent or contractor with whom it shares PHI to sign a business associate subcontract that complies with HIPAA; provided, however, that Service Provider shall not enter into such subcontract without prior written consent of Gehring Group. 2.5 Authorized Access to PHI. To the extent that Service Provider maintains PHI in a Designated Record Set, Service Provider shall provide Gehring Group with access to such PHI no later than five (5) business days after receipt of such written request by Gehring Group pursuant to 45 CFR 164.524. 2.6 Amendment to PHI. To the extent that Service Provider maintains PHI in a Designated Record Set, Service Provider shall amend such PHI in accordance with Gehring Group's written request no later than five (5) business days after receipt of such request by Gehring Group pursuant to 45 CFR 164.526. 2.7 Accounting of Disclosures of PHI. Service Provider shall keep records of all disclosures of PHI made by Service Provider (the "Disclosure Accounting") on an ongoing basis to the extent required by HIPAA and for the period of time for which, under HIPAA, a Covered Entity must maintain a record of such disclosures, except for disclosures: (a) To carry out Treatment, Payment, or Health Care Operations, as provided in 45 CFR 164.502; provided, however, that, Service Provider shall, to the extent required by the HITECH Act and the accompanying regulations, keep a record of disclosures to carry out Treatment, Payment, or Health Care Operations made via an electronic health record for a period of at least three (3) years; or (b) As otherwise excluded, as described at 45 C.F.R. 164.528(i) -(ix). Service Provider shall provide the Disclosure Accounting to Client and Gehring Group (or to an Individual, if so directed by Client and Gehring Group, as applicable) (i) no later than five (5) business days after receipt of written request for such Disclosure Accounting by Client and Gehring Group pursuant to 45 CFR 164.528, or (ii) in accordance with HIPAA. 2.8 Obligations of Client. (a) Client shall notify Gehring Group and Service Provider of any restriction on the use or disclosure of PHI to which Client has agreed in accordance with the relevant provisions of HIPAA, to the extent that such restriction may affect Gehring Group's use or disclosure of PHI to Service Provider. (b) Client shall notify Gehring Group and Service Provider of any changes in, or revocation of, permission by an individual to use or disclose such individual's PHI to the extent that such change may affect Gehring Group's use or disclosure of PHI to Service Provider. 2.9 Additional Obligations. (a) Electronic Copies of PHI. As applicable, Service Provider will (i) 4 17670672v.2 82