2023-047 - Laserfiche WebLink

Home Browse Search

for an accounting from an Individual, Business Associate shall notify Client of the request and shall provide such accounting of disclosures to the Individual. Business Associate shall not disclose any PHI unless such disclosure is required by law or is in accordance with this BAA and shall document such disclosures. h. Governmental Access to Records. Business Associate shall make its internal practices, books and records relating to the use and disclosure of Protected Health Information available to Client and to the Secretary of Health and Humans Services (HISS) for purposes of determining Client's compliance with the Privacy and Security Rule. i. Minimum Necessary. Business Associate and its agents or subcontractors shall request, use, and disclose only the minimum amount of PHI necessary to accomplish the purpose of the request, use, or disclosure. j. Notification to Client of Breach or Unauthorized Disclosure. Everside shall notify Client within twenty (20) business days of any suspected or actual breach of security, intrusion or unauthorized access, use or disclosure of PHI not permitted by the Agreement and this BAA of which Business Associate becomes aware, and/or any actual or suspected Breach of unsecured PHI of which Business Associate becomes aware. A breach shall be treated as discovered in accordance with 45 CFR §164.410. The notification shall include the identification of each individual whose PHI or unsecured PHI has been, or is reasonably believed by the Business Associate to have been, accessed, acquired, or disclosed during such breach, a brief description of what happened including the date of the breach, the date of discovery of the breach and a description of the types of PHI or unsecured PHI that were involved in the Breach. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI or unsecured PHI by Business Associate in violation of the requirements of this BAA. k. Breach Pattern or Practice by Client. If Business Associate knows of a pattern of activity or practice of the Client that constitutes a material breach or violation of the Client's obligations under the Agreement, this BAA, or the Privacy and Security Rule, Business Associate must take reasonable steps to cure the breach or end the violation. 1. Audits, Inspection and Enforcement. Within twenty (20) days of a written request by Client, Business Associate and its agents or subcontractors shall allow Client to conduct a reasonable inspection of the facilities, systems, books, records, agreements, policies and procedures of Business Associate relating to the use or disclosure of PHI pursuant to this BAA. e. Termination a. Term. The term of this BAA shall be effective as of the date of execution and shall remain in effect until the later of one (1) year from the effective date or the expiration or termination of the underlying Agreement. Any provision related to the use, disclosure, access, or protection of PHI shall survive termination of the BAA and Agreement. b. Material Breach. A breach by Business Associate, or its agents or subcontractors, of any provision of this BAA or of the data provisions of the Agreement, as determined by Client, shall constitute a material breach of the Agreement and shall be grounds for immediate termination of this BAA. Client may terminate this BAA effective immediately, if (i) Business Associate is a defendant in a criminal proceeding for a violation of HIPAA, HITECH, the Privacy and Security Rule, or other security or privacy laws or (ii) there is a finding or 2022 L'vetside Ilealth. U.C. .All rights reserved. Confidential. 26