2021-074B - Laserfiche WebLink

Home Browse Search

DocuSign Envelope ID: 29EAB906-1936-4BAB-83BE-97C974F00293 (c) Business Associate shall, without unreasonable delay, but in no event later than three (3) business days after discovery of a Breach of Protected Health Information (whether secured or unsecured), report such Breach to Covered Entity In accordance with 45 C.F.R. § 164.410. B. Access to Protected Health InformitUon. Wlthin ten (20) business days of a request by Covered Entity for access to Protected Health information about an Individual contained in any Designated Record Set of Covered Entity maintained by Business Associate, Business Associate shall make available to Covered Entity such Protected Health Information for so long as Business Associate maintains such information In the Designated Record Set. If Business Associate receives a request for access to Protected Health Information directly from an Individual, Business Associate shall forward such request to Covered Entity within fire (5) business days. 9. Availability of Protected Health Information. within ten (10) business days of receipt of a request from Covered Entity for an amendment to an individual's Protected Health Information contained in any Designated Record Set of Covered Entity maintained by Business Associate, Business Associate shall provide such Protected Health information to Covered Entity for amendment and incorporate any such amendments in the Protected Health Information (for so long as Business Associate maintains such information In the Designated Record Set) as required by 45 C.F.R. § 164.526. If Business Associate receives a request for amendment to Protected Health Information directly from an Individual, Business Associate shall forward such request to Covered Entity within five (5) business days. 10. accounting of Disclosures. Within ten (10) business days of notice by Covered Entity to Business Associate that it has received a request for an accounting of disclosures of Protected Health Information (other than disclosures to which an exception to the accounting requirement applies), Business Associate shall make available to Covered Entity such Information as is in Business Associate's possession and is required for Covered Entity to make the accounting required by 45 C.F.R. § 164.528. 11. Availability of Books and Records. Business Associate shall make Its internal practices, books and records relating to the use and disclosure of Protected Health Information received from or created or received by Business Associate on behalf of, Covered Entity available to the Secretary for purposes of determining Covered Entity's and Business Associate's compliance with HIPAA. 12. Restrictions and Limitations in Notice of PrivacPragices. Business Associate shall comply with any reasonable limitation in Covered Entity's notice of privacy practices to the extent that such limitation may affect Business Associate's use or disclosure of Protected Health Information and Business Associate receives notification of such reasonable Imitation. Business Associate shall comply with any reasonable restriction on the use or disclosure of Protected Health Information that Covered Entity has agreed to or is required to abide by under 45 C.F.R. § 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of Protected Health Information. 13. Tg.lYl. The term of this BA Agreement shall commence on the Effective !kite. This Agreement shall terminate when all of the Protected Health Information provided by Covered Entity, or created and received by Business Associate on behalf of the Covered Entity, Is returned to the Covered Entity or otherwise as set forth in Section 14 of this Agreement. 14. Termination Upon Breach. Any other provision of this BA Agreement or the Service Agreement notwithstanding, this BA Agreement and the Service Agreement may be terminated by Covered Entity in the event of a material breach by Business Associate of the terms and conditions of this BA Agreement. Covered Entity shall provide thirty (30) days' written notice In sufficient detail to enable Business Associate to understand the specific nature of the breach and afford Business Associate an opportunity for Business Associate to cure the breach or end the violation. Should Business Associate fail to cure the breach within such thirty (30) day time frame, Covered Entity may terminate this BA Agreement and the Service Agreement, provided however, that In the event termination is not feasible, in Covered Entity's sole discretion, Covered Entity shall have the right to report the breach to the Secretary. In the event that Business Associate becomes aware of a pattern of activity or a practice of Covered Entity that constitutes a breach or material violation of the obligations of Covered Entity under this BA Agreement, Business -3- kk