2023-130AD - Laserfiche WebLink

Home Browse Search

for the purposes for which it was disclosed to such third party, and (ii) an agreement from such third party to immediately notify Business Associate of any breaches of confidentiality of the PHI, to the extent it has obtained knowledge of such breach. c) Appropriate Safeguards. i) Business Associate will comply with all applicable federal and states laws and regulations and implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of EPHI that it creates, receives, maintains, or transmits on behalf of the Covered Entity as required by the Security Rule and as of the Compliance Date of 42 U.S.C. § 17931, comply with the Security Rule requirements set forth in 45 C.F.R. §§ 164.308, 164.310, 164.312, and 164.316; ii) Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides EPHI agrees to implement reasonable and appropriate safeguards to protect it; and iii) Business Associate will report to Covered Entity as soon as reasonably practicable (i) any use or disclosure of protected health information not provided for by this BAA of which it becomes aware in accordance with 45 C.F.R. § 164.504(e)(2)(ii)(C); and/or (ii) any security incident affecting EPHI of which Business Associate becomes aware in accordance with 45 C.F.R. § 164.314(a)(2)(C) provided, however, that the Parties acknowledge and agree that this Section constitutes notice by Business Associate to Covered Entity of the ongoing existence and occurrence of Unsuccessful Security Incidents for which no additional notice to Ameritas shall be required; and iv) Business Associate agrees to promptly report to Covered Entity any Breach of which it becomes aware as soon as reasonably practicable following Business Associate's discovery of any Breach involving Covered Entity's unsecured PHI. The foregoing report shall include identification of each Individual whose PHI Business Associate reasonably believes to have been accessed, acquired, or disclosed during such Breach. As soon as possible thereafter, and to the extent known, Business Associate shall also provide Covered Entity with a description of (i) what happened, including the date of the Breach and the date of the discovery, (ii) the types of unsecured PHI involved in the Breach, (iii) any steps individuals should take to protect themselves from potential harm from the Breach, and (iv) what Business Associate is doing to investigate the Breach, to mitigate harm to individuals, and to protect against any further Breaches. d) Restrictions on Disclosures. Business Associate will restrict its disclosures of the Individual's PHI in the same manner as would be required for Covered Entity. If Business Associate receives an Individual's request for restrictions, Business Associate shall forward such request to Covered Entity within ten (10) business days. e) Subcontractors. Business Associate shall ensure that any Subcontractor, to whom it provides PHI agree in writing to the same or substantially similar restrictions and conditions that apply to Business Associate with respect to such PHI. Business Associate will advise Covered Entity if any such Subcontractor breaches its agreement with Business Associate with respect to the disclosure or use of Covered Entity's Protected Health Information or EPHI.