2018-075S - Laserfiche WebLink

Home Browse Search

Is •benefitcxpress Benefit Express Services, LLC Technology and Services Agreement iii. Security Incidents. The Business Associate will report to The Covered Entity any Security Incident of which the Business Associate becomes aware. The Business Associate will make this report once per month, except if any such Security Incident resulted in a disclosure not permitted by this Addendum or Breach of Unsecured Protected Health Information, Business Associate will make the report in accordance with the provisions set forth above. (b) Mitigation. The Business Associate shall mitigate, to the extent practicable, any harmful effect known to the Business Associate resulting from a use or disclosure in violation of this Addendum. VIII. Term and Termination (a) Term. The term of this Addendum shall be effective as of the date specified within the Service Agreement, and shall terminate when all Protected Health Information provided by the Covered Entity to the Business Associate, or created or received by the Business Associate on behalf of the Covered Entity, is destroyed or returned to the Covered Entity, or, if it is infeasible to return or destroy Protected Health Information, protections are extended to such information, in accordance with the termination provisions in this section. (b) Right to Terminate for Cause. The Covered Entity may terminate this Addendum if it determines, in its sole discretion, that the Business Associate has breached a material term of this Addendum, and upon written notice to the Business Associate of the breach, the Business Associate fails to cure the breach within thirty (30) calendar days after receipt of the notice. Any such termination will be effective immediately or at such other date specified in the Covered Entity's notice of termination. (c) Treatment of Protected Health Information on Termination. L Return or Destruction of Covered Entity's Protected Health Information as Feasible. Upon termination or other conclusion of the Service Agreement, the Business Associate will, if feasible, return to the Covered Entity or destroy all of the Covered Entity's Protected Health Information in whatever form or medium, including all copies thereof and all data, compilations, and other works derived therefrom that allow identification of any individual who is a subject of the Covered Entity's Protected Health Information. This provision shall apply to Protected Health Information that is in the possession of Subcontractors or agents of the Business Associate. Further, the Business Associate shall, upon request, require any such Subcontractor or agent to certify to the Business Associate that it returned to the Business Associate (so that the Business Associate may return it to the Covered Entity) or destroyed all such information which could be returned or destroyed. ii. Procedure When Return or Destruction Is Not Feasible. The Business Associate will identify any of the Covered Entity's Protected Health Information, including any that the Business Associate has disclosed to subcontractors or agents as permitted under this Addendum, that cannot feasibly be returned to the Covered Entity or destroyed and explain why return or destruction is infeasible. The Business Associate will limit its further use or disclosure of such information to those purposes that make return or destruction of such information infeasible. The Business Associate will complete these obligations as promptly as possible, but not later than thirty (30) calendar days following the effective date of the termination or other conclusion of this Addendum. iii. Continuing Privacy and Security Obligation. The Business Associate's obligation to protect the privacy and safeguard the security of the Covered Entity's Protected Health Information as specified in this Addendum will be continuous and survive termination or other conclusion of this Addendum. IX. Miscellaneous Provisions (a) Definitions. All terms that are used but not otherwise defined in this Addendum shall have the meaning specified under HIPAA, including its statute, regulations and other official government guidance. (b) Inspection of Internal Practices, Books, and Records. The Business Associate will make its internal practices, books, and records relating to its use and disclosure of the Covered Entity's Protected Health Information available to the Covered Entity and to HHS to determine compliance with the HIPAA Rules. (c) Amendment to Agreement. This Addendum may be amended only by a written instrument signed by the parties. In case of a change in applicable law, the parties agree to negotiate in good faith to adopt such amendments as are necessary to comply with the change in law. (d) No Third -Party Beneficiaries. Nothing in this Addendum shall be construed as creating any rights or benefits to any third parties. (e) Regulatory References. A reference in this Business Associate Addendum to a section in the Privacy Rule means the section as in effect or as amended. (f) Survival. The respective rights and obligations of the Business Associate under this Addendum shall survive the termination of this Addendum. (g) Interpretation. Any ambiguity in this Addendum shall be resolved to permit the Covered Entity to comply with the HIPAA Rules. (h) Notices. All notices hereunder shall be in writing and delivered by hand, by certified mail, return receipt requested or by overnight delivery. Notices shall be directed to the parties at their respective addresses or at such other addresses as the parties may from time to time designate in writing.