2025-126B - Laserfiche WebLink

Home Browse Search

DocuSign Envelope ID: 29EAB906-1936-4BAB-83BE-97C974F00293 A TRUE COPY CERTIFICATION ON LAST PAGE "''`!AN L. BUTLER, CLERK (1) the disclosure is Required by law; (ii) Business Associate makes the disclosure pursuant to an agreement consistent with Section 6 of this BA Agreement; or (iii) Business Associate makes the disclosure pursuant to a written confidentiality agreement under which the third -party is required to: (A) protect the confidentiality of the Protected Health information; (0) only use or further disclose the Protected Health Information as Required by Law or for the purpose for which it was disclosed to the third -party; and (C) notify Covered Entity of any acquisition, access, use, or disclosure of Protected Health Information in a manner not permitted by the confidentiality agreement. (c) Business Associate may use Protected Health Information to provide Data Aggregation services relating to the Health Care Operations of Covered Entity if required or permitted under the Service Agreement. (d) Business Associate maybe -identify any and all Protected Health Information obtained by Business Associate under this BA Agreement or the Service Agreement at any location, and use such de -identified data, all in accordance with the de -identification requirements of the Privacy Rule. 3. Sam. Business Associate shall use appropriate safeguards to prevent the use or disclosure of Protected Health Information other than as permitted or required by this BA Agreement. In addition, Business Associate shall implement Administrative Safeguards, Physical Safeguards and Technical Safeguards that reasonably and appropriately protect the Confidentiality, Integrity and Availability of Electronic Protected Health Information that It creates, receives, maintains or transmits on behalf of Covered Entity. Business Associate shall comply with the HIPAA Security Rule with respect to Electronic Protected Health Information. 4. Minimum Necessary Standard. To the extent required by the "minimum necessary" requirements of HIPAA, Business Associate shall only request, use and disclose the minimum amount of Protected Health information necessary to accomplish the purpose of the request, use or disclosure. 5. Mitigation. Business Associate shall take reasonable steps to mitigate, to the extent practicable, any harmful effect (that is known to Business Associate) of a use or disclosure of Protected Health information by Business Associate in violation of this BA Agreement or HIPAA. 6. Subcontractors. Business Associate shall enter into a written agreement meeting the requirements of 45 C.F.R. §§ 164.504(e) and 164.314{a)(2) with each Subcontractor (including, without limitation, a Subcontractor that is an agent under applicable law) that creates, receives, maintains or transmits Protected Health information on behalf of Business Associate. Business Associate shall ensure that the written agreement with each Subcontractor obligates the Subcontractor to comply with restrictions and conditions that are at least as restrictive as the restrictions and conditions that apply to Business Associate under this BA Agreement. 7. Reporting Requirements. (a) Business Associate shall, without unreasonable delay, but in no event later than three (3) business days after becoming aware of any acquisition, access, use, or disclosure of Protected Health Information in vlolation of this BA Agreement by Business Associate, its employees, other agents or contractors, or by a third -party to which Business Associate disclosed Protected Health Information (each, an 'Unauthorized Use or Disclosure'), report such Unauthorized Use or Disclosure to Covered Entity. (b) Business Associate shall, without unreasonable delay, but in no event later than three (3) business days after becoming aware of any Security Incident, report it to Covered Entity. Notwithstanding the foregoing, pings, port scans, and similar routine attempts on Business Assoclate's firewall that are successfully blocked shall not require reporting due to the Infeasibility of recording and reporting all such pings, port scans, and other routine events. 51