2019-097C - Laserfiche WebLink

Home Browse Search

2.10 Demands for Production of PHI. (a) Receipt by Business Associate. If Business Associate receives a subpoena, civil or administrative demand, or any other demand for production of PHI, other than an Individual right request, Business Associate shall provide a copy of such demand to Covered Entity within five (5) business days of receipt. To the extent the PHI that is the subject of the demand is in the possession of Business Associate and a response is warranted according to the standards set forth under HIPAA, Business Associate shall timely respond to the document demand. Receipt by Covered Entity. If Covered Entity receives a subpoena, civil or administrative demand, or any other demand for production of PHI, other than an Individual right request, Business Associate shall provide to Covered Entity any PHI responsive to such demand and shall assist and cooperate with Covered Entity in responding to such document demand in a timely manner and in accordance with the standards set forth under HIPAA. SECTION 3 — PERMITTED USES AND DISCLOSURES 3.1 Business Associate Services. Business Associate may use or disclose PHI as only required by law, or as necessary to perform its obligations and services set forth in the Program or this BAA, provided that such use or disclosure would not violate HIPAA if carried out by Covered Entity. 3.2 Minimum Necessary. Business Associate will comply with the minimum necessary standard as defined under HIPAA in its uses and disclosures of, and requests for, PHI and, to the extent practicable, will restrict its uses and disclosures to a Limited Data Set. 3.3 Other Permitted Uses. Business Associate may also, but only if necessary and as specifically permitted or required by the Program and in accordance with HIPAA, use and disclose PHI as follows: (i) for the proper management and administration, or to carry out the legal responsibilities, of Business Associate, provided any disclosures are required by law or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and only used or further disclosed as required by law or for the purposes for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached; and (ii) if applicable, for the provision of data aggregation services to the Covered Entity relating to the health care operations of Covered Entity. SECTION 4 — BREACH IDENTIFICATION AND NOTIFICATION 4.1 Monitoring and Reporting Incidents. Throughout the term of this BAA, Business Associate will take reasonable steps to monitor the unauthorized acquisition, access, use, and disclosure (subsequently referred to collectively as use or disclosure) of PHI, and will have a policy that requires any unauthorized use or disclosure of PHI to be reported promptly to Business Associate's Privacy Officer or designated individual as well as to Covered Entity. 4.2 Determination Whether Unauthorized Use or Disclosure Constitutes Breach. Upon receiving a report of unauthorized use or disclosure, Business Associate will undertake a risk assessment to determine whether the unauthorized use or disclosure constitutes a Breach of Unsecured PHI. Business Associate will make and retain records of such determinations, including the basis for determinations that unauthorized uses or disclosures are not Breaches of Unsecured PHI. All risk assessments and determinations will be shared with Covered Entity as soon as possible, and in no event later than ten (10) business days following