2023-098B - Laserfiche WebLink

Home Browse Search

8. Record Disclosure Information as defined above for each disclosure that Employer makes of Protected Health Information that is not excepted from disclosure accounting and provide that Disclosure Information to GHP on request so that GHP can meet its disclosure accounting obligations under 45 C.F.R. § 164.528. 9. Make its internal practices, books, and records relating to its use and disclosure of Protected Health Information available to GHP and to DHHS to determine GHP's compliance with 45 C.F.R. Part 164, Subpart E "Privacy of Individually Identifiable Health Information." 10. Return to GHP or destroy if feasible all Protected Health Information in whatever form or medium that Employer (and any subcontractor or agent of Employer) received from GHP or Administrator, including all copies thereof and all data, compilations, and other works derived there from that allow identification of any present or past Covered Person who is the subject of Protected Health Information, when Employer no longer needs Protected Health Information for the plan administration functions for which the Employer received Protected Health Information. Employer will limit the use or disclosure of any of Protected Health Information that Employer (or any subcontractor or agent of Employer) cannot feasibly return to GHP or destroy to the purposes that make its return to GHP or destruction infeasible. PART 2 - Employer to Amend Plan Documents for Security provisions Employer further certifies that Employer has amended GHP's Plan Document to incorporate the provisions required by 45 C.F.R. § 164.314(b)(2), as set forth below, and agrees to comply with GHP's Plan Document as amended. 1. Implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of Electronic Protected Health Information that Employer creates, receives, maintains or transmits on GHP's behalf. 2. Ensure that the adequate separation between Employer and GHP required by 45 C.F.R. § 164.504(f)(2)(iii) (as described in item 3 above) is supported by reasonable and appropriate Security Measures. 3. Ensure that any subcontractor or agent to which Employer provides Electronic Protected Health Information agrees to implement reasonable and appropriate Security Measures to protect the Electronic Protected Health Information. 4. Report to GHP any incident of which Employer becomes aware that is (a) a successful unauthorized access, use or disclosure of Electronic Protected Health Information; or (b) a successful major (i) modification or destruction of Electronic Protected Health Information or (ii) interference with system operations in an Information System containing Electronic Protected Health Information. Upon GHP's request, Employer will report any incident of which Employer becomes aware that is a successful minor (a) modification or destruction of Electronic Protected Health Information or (b) interference with system operations in an Information System containing Electronic Protected Health Information. 51