2019-097C - Laserfiche WebLink

Home Browse Search

2.5 Access and Amendment of PHI. To the extent that Business Associate maintains PHI in a designated record set for, or on behalf of, Covered Entity: Responsibility. Business Associate is responsible to make available and timely respond to requests to access or amend such PHI, by an Individual or the Individual's designee, and to otherwise take any measures necessary to satisfy Covered Entity's obligations under HIPAA. Limited Delegation of Authority. Covered Entity delegates to Business Associate sole authority to determine on behalf of Covered Entity whether to deny a request for access or amendment of such PHI, provided that this delegation is revocable at will by Covered Entity upon notice to Business Associate. 2.6 Accounting of Disclosures. (a) Disclosure Tracking and Accounting. Business Associate agrees to document such non- routine disclosures of PHI, any required information related to such disclosures, and otherwise maintain and timely provide to Covered Entity or directly to an Individual, upon request, the information required for an accounting of disclosures in the time and manner required by, and as otherwise necessary to satisfy Covered Entity's obligations under HIPAA. Accounting of Disclosures of Electronic Health Records. If and to the extent Business Associate uses or maintains an Electronic Health Record that includes PHI, Business Associate will respond to requests from Individuals for an accounting of disclosures as described, and in the time and manner required by HIPAA. Business Associate acknowledges that Covered Entity will, in response to a request for an accounting by an Individual, provide to Individual a list of business associates and contact information as permitted by HIPAA. Survival of Accounting Obligation. Business Associate agrees to maintain an accounting of disclosures described in subsection (a) above for a period of six (6) years after termination of this BAA. 2.7 Inspection of Books and Records. Business Associate agrees to make internal practices, books, and records relating to its use and disclosure of PHI pursuant to the Program or this BAA available to the Secretary, in a time and manner designated by the Secretary, for purposes of determining compliance with HIPAA. 2.8 Compliance with HIPAA. Except as otherwise set forth herein, to the extent that Business Associate is obligated by the Program or this BAA to carry out one or more of Covered Entity's obligations under HIPAA, Business Associate agrees to comply with those requirements under HIPAA that apply to Covered Entity in the performance of such obligations. 2.9 Compliance with Standard Transactions and Code Sets. If Business Associate conducts in whole or part a Transaction for or on behalf of Covered Entity, Business Associate will comply, and will require any subcontractor or agent involved with the conduct of such Transaction to comply, with each applicable standard, implementation specification, or other requirement as set forth in HIPAA.