2025-126A - Laserfiche WebLink

Home Browse Search

A TRUE COPY A _rP117 COPY CERTIFICATION ON LAST PAGE (iv) Disclosure to the United States Department of MM, ler &1W1 nWi SPv0rC'DHHS") in accordance with Section E(1) of this Agreement (Such disclosure by Business Associate is not intended to waive any attorney-client privilege claimed by Business Associate.); (v) Use or disclosure that is Required by Law; or (vi) Any other use or disclosure that is excepted from the minimum necessary limitation as specified in 45 C.F.R. § 164.502(b) (2)• e) Exception to PHI. Parties acknowledge that Business Associate that processes consumer -conducted financial transactions by debit, credit, or other payment card, clears checks, initiates or processes electronic funds transfers, and conducts other activities that directly facilitate or effect the transfer of funds for payment for health care or health plan premiums. In doing so Business Associate is providing its normal financial transaction services to its own customers; it is not performing a function or activity for, or on behalf of, the Covered Entity. Any information disclosed to Business Associate by Covered Entity for the purposes described in this paragraph is not subject to the requirements of HIPAA and any accompanying regulations. 2. Prohibition on Unauthorized Use or Disclosure. Business Associate will neither use nor disclose Covered Entity's Protected Health Information except as permitted or required by this Agreement or in writing by Covered Entity or as Required by Law. 3. Security of Organization's Electronic Protected Health Information. Business Associate will develop, implement, maintain, and use administrative, technical, and physical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic Protected Health Information (as defined in 45 CFR 160.103) that Business Associate creates, receives, maintains, or transmits on Covered Entity's behalf as required by the Security Rule, 45 CFR Part 164, Subpart C. 4. Security Incidents. Business Associate will promptly report to Covered Entity any successful (A) unauthorized access, use, disclosure, modification, or destruction of Electronic Protected Health Information or (B) interference with Business Associate's system operations in Business Associate's information systems, of which Business Associate becomes aware. Business Associate will promptly report to Covered Entity any use or disclosure of the PHI not provided for in this Agreement upon becoming aware of it and will indemnify and hold Covered Entity harmless from all liabilities, costs and damages arising out of or in any manner connected with the disclosure by Business Associate of any PHI. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Agreement. 5. Information Safeguards. Business Associate will develop, implement, maintain and use appropriate administrative, technical and physical safeguards, in compliance with 45 C.F.R. § 164.530(c) and any other implementing regulation issued by DHHS that is applicable to Business Associate's obligations with respect to Covered Entity's Protected Health Information. The safeguards will be designed to preserve the integrity and confidentiality of, and to prevent intentional or unintentional non -permitted use or disclosure of Covered Entity's Protected Health Information. 6. Subcontractors. For purposes of this Business Associate Agreement, "Subcontractor" is defined as an agent or Subcontractor who is providing the services that the Covered Entity contracted with the Business Associate to perform. Business Associate will require any of its Subcontractors, to which Business Associate is permitted by this Agreement or in writing by Covered Entity to disclose Covered Entity's Protected Health Information to provide reasonable assurances, that such Subcontractor will comply with the same privacy and security obligations with respect to Covered Entity's Protected Health Information that are applicable to Business Associate under this Agreement. B. Compliance with Transaction Standards. If Business Associate conducts in whole or part electronic Transactions on behalf of Covered Entity for which DHHS has established Standards, Business Associate will comply, and will require any Subcontractor it involves with the conduct of such Transactions to comply, with each applicable requirement of 45 C.F.R. Part 162. Business Associate will not enter into, or permit its Subcontractors or agents to enter into, any trading partner agreement in connection with the conduct of Standard Transactions on behalf of Covered Entity that: 1. Changes the definition, data condition, or use of a data element or segment in a Standard Transaction; 2. Adds any data element or segment to the maximum defined data set; 3. Uses any code or data element that is marked "not used" in the Standard Transaction's implementation specification or is not in the Standard Transaction's implementation specification; or