2023-130AD - Laserfiche WebLink

Home Browse Search

1) Retention of PHI. Upon termination of the Service Agreement for any reason, Business Associate shall return or destroy all PHI that Business Associate or its agents or subcontractors still maintain in any form and shall retain no copies of such PHI. If return or destruction is not feasible, Business Associate shall continue to extend the legally required protections of this BAA to such information, and limit further use of such PHI to those purposes that make the return or destruction of such PHI infeasible. If Business Associate elects to destroy the PHI, Business Associate shall certify in writing to Covered Entity that such PHI has been destroyed. m) Electronic Health Record. In the event that Business Associate in connection with rendering the services under the Service Agreement uses or maintains an Electronic Health Record of PHI of or about an individual, the Business Associate will provide an electronic copy of such PHI in accordance with 42 U.S.C. § 17935(e) as of its Compliance Date. Moreover, in the event that Business Associate uses or maintains an Electronic Health Record of PHI of or about an individual, then Business Associate shall make an accounting of disclosures of such PHI in accordance with the requirements for accounting of disclosures made through an Electronic Health Record in 42 U.S.C. 17935(c), as of its Compliance Date. n) Business Associate will not make or cause to be made any communication about a product or service that is prohibited by 42 U.S.C. § 17936(a) as of its Compliance Date. o) Business Associate will not make or cause to be made any written fundraising communication that is prohibited by 42 U.S.C. § 17936(b) as of its Compliance Date. p) Pursuant to the Privacy Rule, made applicable to Business Associate by HITECH, Business Associate shall adopt, implement, and follow privacy policies and procedures in the same manner and to the same extent as if it were a Covered Entity. q) Pursuant to the Security Rule, made applicable to Business Associate by HITECH, Business Associate shall adopt, implement, and follow security policies and procedures in the same manner and to the same extent as if it were a Covered Entity. 3) Obligations of Covered Entity. a) Covered Entity shall be responsible for using appropriate safeguards to maintain and ensure the confidentiality, privacy and security of PHI transmitted to Business Associate pursuant to this BAA, in accordance with the Covered Entity and requirements of the Privacy Rule, until such PHI is received by Business Associate. b) Covered Entity shall notify Business Associate of any limitation(s) in its notice of privacy practices of Covered Entity in accordance with 45 CFR § 164.520, to the extent that such limitation may affect Business Associate's use or disclosure of PHI. c) Covered Entity shall notify Business Associate of any changes in, or revocation of, permission by Individual to use or disclose PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI. d) Covered Entity shall notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR § 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of PHI.