2023-130AD - Laserfiche WebLink

Home Browse Search

f) Access to Protected Information. Business Associate shall make PHI maintained by Business Associate or its agents or subcontractors in Designated Record Sets available to Covered Entity for inspection and copying to enable Covered Entity to fulfill its obligations under the Privacy Rule, including, but not limited to 45 CFR Section 164.524. g) Amendment of PHI. Upon receipt of a request from Covered Entity for an amendment of PHI or a record about an individual contained in a Designated Record Set, Business Associate or its agents or subcontractors shall make such PHI available to Covered Entity for amendment and incorporate any such amendment to enable Covered Entity to fulfill its obligations under the Privacy Rule, including, but not limited to, 45 CFR Section 164.526. If any individual requests an amendment of PHI directly from Business Associate or its agents or subcontractors, Business Associate shall notify Covered Entity in writing within ten (10) days of the request. Any decision to deny the requested amendment of PHI maintained by Business Associate or its agents or subcontractors shall be the sole responsibility of Covered Entity. h) Accounting Rights. Upon request for an accounting of disclosures of PHI from Covered Entity, Business Associate and its agents or subcontractors shall make available to Covered Entity the information required to provide an accounting of disclosures to enable Covered Entity to fulfill its obligations under the Privacy Rule, including, but not limited to, 45 CFR Section 164.528. As set forth in, and as limited by, 45 CFR section 164.528, Business Associate shall not provide an accounting to Covered Entity of disclosures: (i) to carry out treatment, payment or health care operations, as set forth in 45 CFR Section 164.502; (ii) to individuals of PHI about them as set forth in 45 CFR 164.502; (iii) to persons involved in the individual's care or other notification purposes as set forth in 45 CFR Section 164.510; (iv) for national security or intelligence purposes as set forth in 45 CFR Section 164.512(k)(2); or (v) to correctional institutions or law enforcement officials as set forth in 45 CFR Section 164.512(k)(5). Business Associate agrees to implement a process that allows for an accounting to be collected and maintained by Business Associate and its agents or subcontractors for at least six (6) years prior to the request, but not before the compliance date of the Privacy rule. In the event that the request for an accounting is delivered directly to Business Associate or its agents or subcontractors, Business Associate shall forward it to Covered Entity. It shall be Covered Entity's responsibility to prepare and deliver any such accounting requested. Business Associate shall not disclose any PHI except as set forth in Sections 2(b) of this BAA. i) Governmental Access to Records. If requested, Business Associate shall make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services (the "Secretary") for purposes of determining Covered Entity's compliance with Privacy Rule in accordance with 45 CFR 164.504(e)(ii)(I). j) Minimum Necessary. Business Associate (and its agents and subcontractors) shall only request, use and disclose the minimum amount of PHI necessary to accomplish the purpose of the request, use or disclosure and consistent with Covered Entity's minimum necessary policies and procedures. k) Data Ownership. Business Associate acknowledges that Business Associate has no ownership rights with respect to the PHI.