2019-097C - Laserfiche WebLink

Home Browse Search

the initial report. Covered Entity will make the final determination as to whether or not the unauthorized use or disclosure constitutes a Breach and shall be responsible for providing ay required notifications. 4.3 Proposed Notice to Covered Entity. If requested by Covered Entity, Business Associate will provide Covered Entity with a draft of the proposed notice to the Individual(s), HHS, and to the media (if applicable) as required by the Breach Notification Requirements within a sufficient time prior to the required distribution of the notice for review and approval by Covered Entity. SECTION 5 — TERM & TERMINATION 5.1 Term. This BAA is effective as of the date first written above and shall terminate when all PHI is returned to Covered Entity or, with prior permission of Covered Entity, destroyed or, if it is infeasible to return or destroy PHI, protections are extended to such PHI in accordance with the termination provisions of this Section 5. 5.2 Termination for Cause. Covered Entity may terminate this BAA if Covered Entity determines that Business Associate has breached any provision of this BAA or otherwise violated HIPAA. Covered Entity will provide written notice to Business Associate and an opportunity for Business Associate to cure the breach or end the violation within thirty (30) business days of such written notice, unless cure is not possible. If Business Associate fails to cure the breach or end the violation within the specified time period or cure is not possible, this BAA shall automatically and immediately terminate, unless termination is infeasible. Business Associate acknowledges that, if cure is not possible and termination of the BAA is infeasible, Covered Entity has the right to report the violation to the Secretary. 5.3 Termination after Repeated Violations. Covered Entity may terminate this BAA if Covered Entity determines that Business Associate has repeatedly breached any provision of this BAA or otherwise violated HIPAA. 5.4 Obligations Upon Termination. Business Associate's obligations to protect the privacy and security of PHI shall be continuous and shall survive termination, cancellation, expiration or other conclusion of this BAA. Upon termination of this BAA: (a) Except as provided in paragraph (b) of this Section 5.4, Business Associate shall return or, if Covered Entity gives written permission, destroy PHI in whatever form or medium and retain no copies of such PHI. (b) In the event that Business Associate determines that returning or destroying the PHI is infeasible, Business Associate shall extend the protections of this BAA (and of any additional requirements imposed by subsequent changes to HIPAA) to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible for so long as Business Associate maintains such PHI. SECTION 6 — INDEMNIFICATION AND LIMITATION OF LIABILITY 6.1 Indemnification. (a) Business Associate shall indemnify and hold Covered Entity harmless from and against any claims, expenses (including reasonable attorneys' fees) and liabilities arising from Business Associate's gross negligence or willful misconduct, provided that Business Associate shall have no indemnity obligation to the extent any such claim is attributable to