2019-097C - Laserfiche WebLink

Home Browse Search

information created, received, maintained, transmitted or accessed by Business Associate for or on behalf of Covered Entity. 1.6 Unsecured Protected Health Information ("Unsecured PHI"). "Unsecured Protected Health Information" means PHI that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary in guidance issued under section 13402(h)(2) of Pub. L. 111-5. SECTION 2 — OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE 2.1 Prohibition on Unauthorized Use or Disclosure. Business Associate will not use or disclose PHI other than as required to perform its obligations pursuant to the Program, as permitted or required by this BAA, or as required by law. 2.2 Safeguards. Business Associate will implement appropriate administrative, technical, and physical safeguards (including written policies and procedures) and comply, where applicable, with subpart C of Part 164 of HIPAA to prevent the use or disclosure of PHI other than as provided for by this BAA. 2.3 Duty to Identify, Mitigate, Document, and Report. With respect to (i) a use or disclosure of PHI by Business Associate in violation of the requirements of this BAA, (ii) a discovered Breach of Unsecured PHI, or (iii) a suspected or known security incident, excluding inconsequential incidents that occur on a daily basis such as scans or "pings" that are not allowed past Business Associate's firewalls (collectively referred to hereinafter as "Occurrences"), Business Associate agrees: (a) Identify. To identify and appropriately respond to any suspected or known Occurrences; (b) Mitigate. Mitigate, to the extent practicable, any harmful effect known to Business Associate related to any Occurrences; (c) Document. Document any Occurrences and the outcome; (d) Report. Report any Occurrences to Covered Entity in writing within ten (10) business days of the Occurrence; and (e) Additional Requirements. Comply with the additional requirements of Section 4.1 of this BAA. 2.4 Subcontractors and Agents. Business Associate agrees to ensure that any subcontractors or agents that create, receive, maintain, or transmit PHI for the Business Associate on behalf of the Covered Entity agree in writing to restrictions and conditions that are no less stringent than those that apply to the Business Associate pursuant to this BAA with respect to such information and will implement reasonable and appropriate safeguards to protect it. If Business Associate learns of a pattern of activity or practice of a subcontractor that constitutes a breach or violation of the subcontractor's obligation under the contract or other arrangement with Business Associate, Business Associate must take reasonable steps to cure the breach or end the violation, as applicable, and if such steps are unsuccessful, terminate the contract or arrangement if feasible.