CSA East Bay Innovations 04062020

Home

DocuSign Envelope ID: 26BOC939-3E65-4374-8EBE-308B214EB5C7 to Business Associate. Business Associate shall follow the procedures set forth herein for Disclosures of PHI Required By Law. j) Breach. If Business Associate has knowledge or a reasonable belief that a Breach of Unsecured Protected Health Information has occurred or may have occurred, Business Associate shall promptly (but in no event later than thirty (30) days after it has knowledge that a Breach or reasonable belief that a Breach has or may have occurred) notify the Covered Entity in accordance with the requirements of 45 CFR § 164.410. For avoidance of doubt, Business Associate shall notify Covered Entity if it has knowledge of a potential Breach so that Covered Entity may determine and confirm whether a Breach has occurred. Such notification shall include, to the extent possible, the identification of each Individual whose PHI has been or is reasonably believed to have been accessed, acquired, used or disclosed during the Breach, along with any other information that the Covered Entity will be required to include in its notification to the Individual, the media and/or the Secretary, as applicable, including, without limitation, a description of the Breach, the date of the Breach and its discovery, the types of Unsecured Protected Health Information involved and a description of the Business Associate's investigation, mitigation, and prevention efforts. k) Remuneration in Exchange for PHI. Except as permitted by the HITECH Act or regulations issued by the Department of Health and Human Services ("HHS") in accordance with the HITECH Act, and as of the effective date of such regulations, Business Associate shall not directly or indirectly receive remuneration in exchange for any PHI unless Covered Entity notifies Business Associate that it obtained a valid authorization from the Individual specifying that the Individual's PHI may be exchanged for remuneration by the entity receiving such Individual's PHI. 1) Minimum Necessary. Business Associate agrees to follow any guidance issued by HHS regarding what constitutes "minimum necessary" with respect to the use or disclosure of PHI. Until the time that any such guidance is issued, Business Associate shall limit its use or disclosure of PHI, to the extent practicable, to the limited data set (as defined in section 45 CFR § 164.514 (e)(2)) or, to the minimum necessary to accomplish the intended purpose of such use, disclosure, or request, respectively. m) Marketing. Unless otherwise permitted in the Underlying Agreement, Business Associate must obtain or confirm that Covered Entity has obtained an authorization for any use or disclosure of PHI for marketing, unless the marketing communication is made without any form of remuneration (i) to describe medical services or products provided by Covered Entity or Business Associate; (ii) for treatment of the Individual; or (iii) for case management or care coordination for the Individual or to direct or recommend alternative treatments, therapies, providers or settings. Revised 5/21/2020