CSA East Bay Innovations 04062020

Home

DocuSign Envelope ID: 26BOC939-3E65-4374-8EBE-308B214EB5C7 health care operations during the previous three (3) years, thus Business Associate agrees that: (1) If Covered Entity acquired an electronic health record before January 1, 2009, then effective January 1, 2014, Business Associate must maintain a list of disclosures made for treatment, payment or operations purposes for a minimum of three (3) years from the date of such disclosure; or (2) If Covered Entity acquired an electronic health record after January 1, 2009, then effective January 1, 2011, Business Associate must maintain a list of disclosures made for treatment, payment or operations purposes for a minimum of three (3) years from the date of such disclosure. iv) Accounting to Covered Entity. To assist Covered Entity in complying with the patient rights provisions of HIPAA, Business Associate shall, at any time during this Agreement, make PHI in its possession available to Covered Entity within ten (10) business days of Covered Entity's request. v) Record Keeping. Business Associate agrees to implement an appropriate record keeping process to enable it to comply with the requirements of this Section. g) Audit. Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of Covered Entity available to the Secretary of Health and Human Services ("Secretary"), upon request for purposes of determining and facilitating the parties' compliance with HIPAA. h) Miti ag tion. Business Associate shall mitigate promptly, to the extent practicable, any harmful effect that is known to Business Associate of a Use of Disclosure of PHI by Business Associate in violation of this Agreement, the Privacy Rule, the Security Rule, or other applicable federal or state law. i) Uses Permitted By Law. As permitted by the Privacy Rule Business Associate may use or disclose PHI: (a) as is necessary for the proper management and administration of Business Associate's organization, (b) to provide data aggregation services relating to the health care services of the Covered Entity; and (c) to carry out the legal responsibilities of Business Associate; provided, however, that any permitted Disclosure of PHI to a third party must be either Required By Law or subject to reasonable assurances obtained by Business Associate from the third party that the PHI will be held confidentially, and securely, and used or disclosed only as Required By Law or for the purposes for which it was disclosed to such third party, and that any breaches of confidentiality of the PHI which become known to such third party will be immediately reported Revised 4 5/21/2020