2021-089B - Laserfiche WebLink

Home Browse Search

DocuSign Envelope ID: FAA4141C-02DF-41B5-A6D3-14CDB4ABD65B (B) Business Associate obtains reasonable assurance from any person or entity to which Business Associate will disclose Protected Health Information that the person or entity will— (1) Hold the Protected Health Information in confidence and use or further disclose the Protected Health Information only for the purpose for which Business Associate disclosed Protected Health Information to the person or entity or as Required by Law; and (2) Promptly notify Business Associate of any instance of which the person or entity becomes aware in which the confidentiality of Protected Health Information was breached. (iii) Minimum Necessary. Business Associate will, in its performance of the functions, activities, services, and operations specified above, make reasonable efforts to use, to disclose, and to request only the minimum amount of Protected Health Information reasonably necessary to accomplish the intended purpose of the use, disclosure, or request, except that Business Associate will not be obligated to comply with this minimum -necessary limitation if neither Business Associate nor Covered Entity is required to limit its use, disclosure, or request to the minimum necessary under the HIPAA Rules. Business Associate and Covered Entity acknowledge that the phrase "minimum necessary" shall be interpreted in accordance with the HITECH Act and the HIPAA Rules. b. Prohibition on Unauthorized Use or Disclosure. Business Associate will neither use nor disclose Protected Health Information, except as permitted or required by this Agreement or in writing by Covered Entity or as Required by Law. This Agreement does not authorize Business Associate to use or disclose Covered Entity's Protected Health Information in a manner that would violate the HIPAA Rules if done by Covered Entity, except as permitted for Business Associate's proper management and administration, as described above. c. Information Safeguards. (i) Privacy of Protected Health Information. Business Associate will develop, implement, maintain, and use appropriate administrative, technical, and physical safeguards to protect the privacy of Protected Health Information. The safeguards must reasonably protect Protected Health Information from any intentional or unintentional use or disclosure in violation of the Privacy Rule and limit incidental uses or disclosures made pursuant to a use or disclosure otherwise permitted by this Agreement. To the extent the parties agree that the Business Associate will carry out directly one or more of Covered Entity's obligations under the Privacy Rule, the Business Associate will comply with the requirements of the Privacy Rule that apply to the Covered Entity in the performance of such obligations. (ii) Security of Covered Entity's Electronic Protected Health Information. Business Associate will comply with the Security Rule and will use appropriate administrative, technical, and physical