2021-089B - Laserfiche WebLink

Home Browse Search

DocuSign Envelope ID: FAA4141C-02DF-41B5-A6D3-14CDB4ABD65B safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic Protected Health Information that Business Associate creates, receives, maintains, or transmits on Covered Entity's behalf. (iii) No Transfer of PHI Outside United States. Business Associate will not transfer Protected Health Information outside the United States without the prior written consent of the Covered Entity. In this context, a "transfer' outside the United States occurs if Business Associate's workforce members, agents, or subcontractors physically located outside the United States are able to access, use, or disclose Protected Health Information. d. Subcontractors. Business Associate will require each of its Subcontractors to agree, in a written agreement with Business Associate, to comply with the provisions of the Security Rule; to appropriately safeguard Protected Health Information created, received, maintained, or transmitted on behalf of the Business Associate; and to apply the same restrictions and conditions that apply to the Business Associate with respect to such Protected Health Information. e. Prohibition on Sale of Protected Health Information. Effective immediately, Business Associate shall not engage in any sale (as defined in the HIPAA rules) of Protected Health Information. f. Prohibition on Use or Disclosure of Genetic Information. Effective immediately, Business Associate shall not use or disclose Genetic Information for underwriting purposes in violation of the HIPAA rules. g. Penalties for Noncompliance. Business Associate acknowledges that it is subject to civil and criminal enforcement for failure to comply with the HIPAA Rules, to the extent provided by the HITECH Act and the HIPAA Rules. 3. Compliance with Electronic Transactions Rule. If Business Associate conducts in whole or part electronic Transactions on behalf of Covered Entity for which HHS has established standards, Business Associate will comply, and will require any Subcontractor it involves with the conduct of such Transactions to comply, with each applicable requirement of the Electronic Transactions Rule and of any operating rules adopted by HHS with respect to Transactions. 4. Individual Rights. a. Access. Business Associate will, within ten calendar days following Covered Entity's request, make available to Covered Entity (or, at Covered Entity's written direction, to an individual or the individual's designee) for inspection and copying Protected Health Information about the individual that is in a Designated Record Set in Business Associate's custody or control, so that Covered Entity may meet its access obligations under 45 CFR § 164.524. If Covered Entity requests an electronic copy of Protected Health Information that