2005-063 - Laserfiche WebLink

Home Browse Search

( 2 ) In the event that any member of the Employer's workforce uses or discloses Protected Health Information other than as permitted by this Section and the Privacy Standards , the incident shall be reported to the Plan ' s privacy officer. The privacy officer shall take appropriate action , including : ( i ) investigation of the incident to determine whether the breach occurred inadvertently, through negligence or deliberately; whether there is a pattern of breaches ; and the degree of harm caused by the breach ; ( ii ) appropriate sanctions against the persons causing the breach which , depending upon the nature of the breach , may include oral or written reprimand , additional training , or termination of employment; ( iii ) mitigation of any harm caused by the breach , to the extent practicable ; and ( iv) documentation of the incident and all actions taken to resolve the issue and mitigate any damages . (e ) The Employer must provide certification to the Plan that it agrees to : ( 1 ) Not use or further disclose the information other than as permitted or required by the Plan documents or as required by law ; ( 2 ) Ensure that any agent or subcontractor, to whom it provides Protected Health Information received from the Plan , agrees to the same restrictions and conditions that apply to the Employer with respect to such information ; ( 3 ) Not use or disclose Protected Health Information for employment- related actions and decisions or in connection with any other benefit or employee benefit plan of the Employer; ( 4 ) Report to the Plan any use or disclosure of the Protected Health Information of which it becomes aware that is inconsistent with the uses or disclosures permitted by this Section , or required by law; ( 5 ) Make available Protected Health Information to individual Plan members in accordance with Section 164 . 524 of the Privacy Standards ; ( 6 ) Make available Protected Health Information for amendment by individual Plan members and incorporate any amendments to Protected Health Information in accordance with Section 164 . 526 of the Privacy Standards ; ( 7 ) Make available the Protected Health Information required to provide an accounting of disclosures to individual Plan members in accordance with Section 164 . 528 of the Privacy Standards ; ( 8 ) Make its internal practices , books and records relating to the use and disclosure of Protected Health Information received from the Plan 26