Laserfiche WebLink
DocuSign Envelope ID: 26BOC939-3E65-4374-8EBE-308B214EB5C7 <br />e) "Privacy Rule" means the Standards for Privacy of Individually Identifiable <br />Health Information, codified at 45 CFR parts 160 and 164, Subparts A, D, and E, <br />as currently in effect. <br />f) "Security Rule" means the Standards for Security for the Protection of Electronic <br />Protected Health Information, codified at 45 CFR parts 160 and 164, Subpart C. <br />g) "Unsecured Protected Health Information" means Protected Health <br />Information that is not rendered unusable, unreadable, or indecipherable to <br />unauthorized persons through the use of technology or methodology specified by <br />the Secretary of the Department of Health and Human Services in guidance. <br />2. Business Associate Obligations. Business Associate acknowledges and agrees that it is <br />considered a "Business Associate" as defined by HIPAA. As a Business Associate of Covered <br />Entity, Business Associate shall, in addition to complying with the terms of this Addendum, <br />comply with the following and any state provisions that are more restrictive: <br />a) Disclosure. Business Associate shall not Use or further Disclose PHI other than as <br />permitted or required by this Addendum, to perform Services under the <br />Underlying Agreement or as Required by Law. <br />b) Safeguards. Business Associate shall use safeguards that are appropriate and <br />sufficient to prevent use or disclosure of PHI other than disclosures permitted or <br />required by this Addendum. Business Associate agrees to implement <br />Administrative Safeguards, Physical Safeguards, and Technical Safeguards that <br />reasonably and appropriately protect the Confidentiality, Integrity and <br />Availability of EPHI. <br />C) Reporting. Business Associate shall report to Covered Entity any Use or <br />Disclosure of PHI not permitted or required by this Addendum and any Security <br />Incident of which it becomes aware. Further, if Business Associate is aware of <br />non-compliance by its subcontractor, the Business Associate must notify Covered <br />Entity and respond in the same manner as if Business Associate had been the <br />Covered Entity. <br />d) Agents and Subcontractors. Business Associate shall ensure that any and all <br />agents and subcontractors to whom it provides PHI as permitted or required under <br />this Addendum agree, in writing, prior to the disclosure of such PHI, to the same <br />restrictions and conditions that apply to Business Associate with respect to such <br />PHI, including without limitation the provisions of this Section. <br />e) Electronic Data Security. Business Associate agrees to comply with the <br />requirements of 45 CFR §§ 164.308, 164.312, and 164.316 to the same extent <br />such requirements apply to Covered Entity. <br />Revised 2 <br />5/21/2020 <br />