2023-130AD - Laserfiche WebLink

Home Browse Search

xvii) "Security Rule" shall mean the standard for Security of Individually Identifiable Health Information codified at 45 CFR Parts 160, 162 and 164. xviii) "Security Incident" has the meaning in 45 CFR § 164.304, which is the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations. xix) "Subcontractor" shall have the meaning given to such term at 45 CFR § 160.103 and includes any agent/agency relationships. xx) "Unsecured Protected Health Information" (or "unsecured PHI") shall mean Protected Health Information has the meaning as set forth in 45 C.F.R. 164.402.that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary in the regulations or guidance issued pursuant to 42 U. S.C. §§17932(h)(2). xxi) "Unsuccessful Security Incident" shall mean, without limitation, pings and other broadcast attacks on Business Associate's firewall, port scans, unsuccessful log -on attempts, denial of service attacks, and any combination of the above, so long as no such incident results in unauthorized access, use, disclosure, modification or destruction of PER or intentional interference with system operations in an information system that contains PHI. b) Catch-all Definition. Terms used, but not otherwise defined, in this Addendum shall have the same meaning as those terms in the Privacy Rule and Security Rule. 2) Obligations of Business Associate. a) Permitted Uses. Business Associate shall not use PHI except for the purpose of performing Business Associate's obligations under the Service Agreement and as permitted or required by this BAA. Further, Business Associate shall not use PHI in any manner that would constitute a violation of the Privacy Rule if so used by Covered Entity. However, Business Associate may (i) use PHI for the proper management and administration of Business Associate and to carry out the legal responsibilities of Business Associate, and (ii) provide Data Aggregation services relating to the health care operations of Covered Entity if such services are provided by Business Associate to Covered Entity under the Service Agreement. b) Permitted Disclosures. Business Associate shall not disclose PHI in any manner that would constitute a violation of HITECH and HIPAA (including without limitation the Privacy Rule) if disclosed by Covered Entity. However, Business Associate may disclose PHI in a manner permitted pursuant to the Service Agreement, for the proper management and administration of Business Associate; and as required by law. Additionally, Business Associate may disclose PHI in a manner allowed by law if Covered Entity specifically authorizes the disclosure. In no event shall Business Associate be permitted to receive remuneration, either directly or indirectly, in exchange for PHI, except as may be approved by Covered Entity in its sole discretion and then, only to the extent permitted by 42 U.S.C. § 17935(d). To the extent that Business Associate discloses PHI to a third party, Business Associate must prior to making any such disclosure obtain, (i) reasonable assurances from such third party that such PHI will be held confidential as provided pursuant to this BAA and only disclosed as required by law or