2021-089C - Laserfiche WebLink

Home Browse Search

DocuSign Envelope ID: FAA4141C-02DF-41B5-A6D3-14CDB4ABD65B disclosures; (ii) the frequency, periodicity, or number of the repetitive accountable disclosures; and (iii) the date of the last of the repetitive accountable disclosures. (iv) Availability of Disclosure Information. Business Associate will maintain the Disclosure Information for at least six years following the date of the accountable disclosure to which the Disclosure Information relates. Business Associate will make the Disclosure Information available to Covered Entity fifty-nine calendar days following Covered Entity's request for such Disclosure Information to comply with an individual's request for disclosure accounting. d. Restriction Agreements and Confidential Communications. Covered Entity shall notify Business Associate of any limitations in the notice of privacy practices of Covered Entity under 45 CFR § 164.520, to the extent that such limitation may affect Business Associate's use or disclosure of Protected Health Information. Business Associate will comply with any notice from Covered Entity to (1) restrict use or disclosure of Protected Health Information pursuant to 45 CFR § 164.522(a), or (2) provide for confidential communications of Protected Health Information pursuant to 45 CFR § 164.522(b), provided that Covered Entity notifies Business Associate in writing of the restriction or confidential communications obligations that Business Associate must follow. Covered Entity will promptly notify Business Associate in writing of the termination of any such restriction or confidential communications requirement and, with respect to termination of any such restriction, instruct Business Associate whether any of the Protected Health Information will remain subject to the terms of the restriction agreement. 5. Breaches and Security Incidents. a. Reporting. (i) Impermissible Use or Disclosure. Business Associate will report to Covered Entity any use or disclosure of Protected Health Information not permitted by this Agreement not more than fifty-nine calendar days after Business Associate discovers such non -permitted use or disclosure. (ii) Breach of Unsecured Protected Health Information. Business Associate will report to Covered Entity any potential Breach of Unsecured Protected Health Information not more than fifty-nine calendar days after discovery of such potential Breach. Business Associate will treat a potential Breach as being discovered in accordance with 45 CFR § 164.410. Business Associate will make the report to Covered Entity's Privacy Officer. If a delay is requested by a law-enforcement official in accordance with 45 CFR § 164.412, Business Associate may delay notifying Covered Entity for the applicable time period. Business Associate's report will include at least the following, provided that absence of any information will not be cause for Business Associate to delay the report: