2023-047 - Laserfiche WebLink

Home Browse Search

such third party to immediately notify Everside of any breaches of confidentiality of the PHI, to the extent it has obtained knowledge of such breach. c. Prohibited Uses and Disclosures. Business Associate shall not use or disclose PHI to a health plan for payment or health care operations purposes if the patient has requested this special restriction, and has paid out of pocket in full for the health care item or service to which the PHI solely relates. Everside shall not directly or indirectly receive remuneration in exchange for PHI, except with the prior written consent or authorization of the Individual; however, this prohibition shall not affect payment by Client to Everside for services pursuant to the Agreement. Business Associate shall not use or disclose Genetic Information for underwriting purposes in violation of HIPAA. d. Appropriate Safeguards. Business Associate shall develop, implement, maintain, and use appropriate safeguards as are necessary to prevent the use or disclosure of the PHI other than as permitted by the Agreement or this BAA, and to implement administrative, physical and technical safeguards as required by the Privacy and Security Rule in order to protect the confidentiality, integrity, and availability of PHI that Everside creates, receives, maintains, or transmits, to the same extent as if Everside were a client. e. Business Associate's Agents. Business Associate shall ensure that any agents, including subcontractors, to whom it provides PHI, agree, in writing, to the same restrictions and conditions that apply to Business Associate with respect to such PHI. Business Associate shall implement and maintain sanctions against agents and subcontractors that violate such restrictions and conditions and shall mitigate the effects of any such violation. f. Designated Record Set. If Business Associate maintains a designated record set on behalf of Client, Everside shall make such information available to Client for inspection and copying within thirty (30) days of a request by Client to enable Client to fulfill its obligations under the Privacy and Security Rule. If Business Associate maintains an Electronic Health Record on behalf of Client, Business Associate shall provide such information in electronic format to enable Client to fulfill its obligations under HIPAA. Likewise, within thirty (30) days of receipt of a request from Client for an amendment of PHI or a record about an individual contained in a Designated Record Set, Business Associate or its agents or subcontractors shall make such PHI available to Client for amendment. If any individual requests an amendment of PHI directly from Business Associate or its agents or subcontractors, and the PHI is originally received from Client, Business Associate will notify Client in writing within thirty (30) days of the request. Any approval or denial of amendment of PHI maintained by Business Associate or its agents or subcontractors shall be the responsibility of Client. Upon approval of Client, Business Associate shall appropriately amend the PHI maintained by it, or any of its agents or subcontractors. g. Accounting Rights. Within thirty (30) days of notice by Client of a request for an accounting of disclosures of PHI from an Individual under 45 CFR § 164.528, Business Associate and its agents or subcontractors shall make available to Client the information required for Client to provide an accounting of disclosures in order to enable Client to fulfill its obligations under the Privacy and Security Rule. Business Associate will not be obligated to record or otherwise account for disclosures of Client's PHI if Client need not account for such disclosures. Business Associate shall maintain the disclosure information for at least 6 years following the date of the accountable disclosure under this Section of the BAA. In the case of a direct request 2022 LYcrsidc IIcahh. I I C. All rights resoved. Conlidcnlial. 25