2018-075S - Laserfiche WebLink

Home Browse Search

benefitexprcss Benefit Express Services, LLC Technology and Services Agreement request Protected Health Information on the Covered Entity's behalf (collectively, "Covered Entity's Protected Health Information") only: i) Functions and Activities on the Covered Entity's Behalf. To perform those services referred in the Exhibit A. ii) Business Associate's Operations. For the Business Associate's proper management and administration or to carry out the Business Associate's legal responsibilities, provided that, with respect to disclosure of the Covered Entity's Protected Health Information, either: (a) The disclosure is Required by Law; or (b) The Business Associate obtains reasonable assurance from any person or entity to which the Business Associate will disclose the Covered Entity's Protected Health Information that the person or entity will: (i) Hold the Covered Entity's Protected Health Information in confidence and use or further disclose the Covered Entity's Protected Health Information only for the purpose for which the Business Associate disclosed the Covered Entity's Protected Health Information to the person or entity or as Required by Law; and (ii) Promptly notify the Business Associate (who will in turn notify the Covered Entity in accordance with the breach notification provisions) of any instance of which the person or entity becomes aware in which the confidentiality of the Covered Entity's Protected Health Information was breached. (c) To de -identify the information in accordance with 45 CFR 164.514 as necessary to perform those services required under the Addendum. iii) Minimum Necessary. The Business Associate will, in its performance of the functions, activities, services, and operations specified above, make reasonable efforts to use, to disclose, and to request only the minimum amount of the Covered Entity's Protected Health Information reasonably necessary to accomplish the intended purpose of the use, disclosure or request, except that the Business Associate will not be obligated to comply with this minimum -necessary limitation if neither the Business Associate nor the Covered Entity is required to limit its use, disclosure or request to the minimum necessary. The Business Associate and the Covered Entity acknowledge that the phrase "minimum necessary" shall be interpreted in accordance with the HITECH Act. (b) Prohibition on Unauthorized Use or Disclosure. The Business Associate will neither use nor disclose the Covered Entity's Protected Health Information, except as permitted or required by this Addendum or in writing by the Covered Entity or as Required by Law. This Agreement does not authorize the Business Associate to use or disclose the Covered Entity's Protected Health Information in a manner that will violate Subpart E of 45 CFR Part 164 if done by the Covered Entity. (c) Information Safeguards. i) Privacy of the Covered Entity's Protected Health Information. The Business Associate will develop, implement, maintain, and use appropriate administrative, technical, and physical safeguards to protect the privacy of the Covered Entity's Protected Health Information. The safeguards must reasonably protect the Covered Entity's Protected Health Information from any intentional or unintentional use or disclosure in violation of the Privacy Rule and limit incidental uses or disclosures made to a use or disclosure otherwise permitted by this Addendum. ii) Security of the Covered Entity's Electronic Protected Health Information. The Business Associate will develop, implement, maintain, and use administrative, technical, and physical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic Protected Health Information that the Business Associate creates, receives, maintains, or transmits on the Covered Entity's behalf as required by the Security Rule. The Business Associate will comply with Subpart C of 45 CFR Part 164 with respect to Electronic Protected Health Information, to prevent use or disclosure of protected health information other than as provided for by the Addendum. iii) No Transfer of PHI Outside United States. Business Associate will not transfer Protected Health Information outside the United States without the prior written consent of the Covered Entity. In this context, a "transfer" outside the United States occurs if Business Associate's workforce members, agents, or subcontractors physically located outside the United States are able to access, use, or disclose Protected Health Information. iv) Policies and Procedures. The Business Associate shall maintain written policies and procedures, conduct a risk analysis, and train and discipline of its workforce. (d) Subcontractors and Agents. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, the Business Associate will ensure that any of its Subcontractors and agents that create, receive, maintain, or transmit Protected Health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information. (e) Prohibition on Sale of Records. As of the effective date specified by HHS in final regulations to be issued on this topic, the Business Associate shall not directly or indirectly receive remuneration in exchange for any Protected Health Information of an individual unless the Covered Entity or Business Associate obtained from the individual, in accordance with 45 CFR §164.508, a valid authorization that includes a specification of whether the Protected Health Information can be further exchanged for remuneration by the entity receiving Protected Health Information of that individual, except as otherwise allowed under the HITECH Act. (f) Prohibition on Use or Disclosure of Genetic Information. Business Associate shall not use or disclose Genetic Information for underwriting purposes in violation of the HIPAA rules.