2025-125 - Laserfiche WebLink

Home Browse Search

A TRUE COPY CERTIFICATION ON LAST PAGE RYAN L. BUTLER, CLERK 2.3.4. For BCBSF's proper management and administration or to carry out BCBSF's legal responsibilities. Disclosure of PHI for BCBSF's proper management and administration or to carry out BCBSF's legal responsibilities is permitted only if (i) the Disclosure is Required by Law, or (ii) before the Disclosure, BCBSF obtains from the entity to which the Disclosure is to be made reasonable assurance, evidenced by written contract, that the entity will (1) hold PHI in confidence, (2) Use or further Disclose PHI only for the purposes for which BCBSF disclosed it to the entity or as Required by Law; and (3) notify BCBSF of any instance of which the entity becomes aware in which the confidentiality of any PHI was Breached. 2.3.5. To create De -Identified Health Information in conformance with 45 C.F.R. § 164.514(b). BCBSF may use and disclose De -Identified Health Information for any purpose, including after any termination of the Agreement and this BAA. 2.3.6. To create a Limited Data Set. 2.4. Minimum Necessary. BCBSF, in the performance of services under the Agreement, will make reasonable efforts to comply with the minimum necessary standard for PHI under HIPAA. 2.5. Disclosure to BCBSF's Subcontractors. BCBSF may disclose PHI to a Subcontractor. BCBSF will require each Subcontractor and agent to which BCBSF disclose PHI to provide reasonable assurance, evidenced by written contract, that such Subcontractor or agent will comply with the similar but no less restrictive privacy and security obligations with respect to PHI as this BAA applies to BCBSF. 2.6. Reporting Non -Permitted Use or Disclosure and Security Incidents. 2.6.1. Privacy Breach. BCBSF will report to the Plan within ten (10) calendar days any use or disclosure of PHI of which BCBSF becomes aware that is not permitted by this BAA and that constitutes a Breach of Unsecured PHI. The Plan hereby delegates to BCBSF (i) the responsibility for determining whether any use or disclosure of Protected Health Information under this BAA constitutes a Breach of Unsecured PHI, and (ii) the implementation of notification and reporting obligations associated with a Breach of Unsecured PHI in accordance with relevant legal requirements. 2.6.2. Security Incidents. BCBSF will report to the Plan within ten (10) calendar days any incident of which BCBSF becomes aware that is (a) a successful unauthorized access, use or disclosure of EPHI; or (b) a successful major (i) 19