25A - AGMT EMPLOYEE TRACKING SVCS

Home Browse Search

(iii) Minimum Necessary. The Business Associate will, in Its performance of the functions, activities, services, and operations specified above, make reasonable efforts to use, to disclose, and to request only the minimum amount of the Covered Entity's Protected Health Information reasonably necessary to accomplish the intended purpose of the use, disclosure or request, except that the Business Associate will not be obligated to comply with this minimum -necessary limitation if neither the Business Associate nor the Covered Entity is required to limit Its use, disclosure or request to the minimum necessary. The Business Associate and the Covered Entity acknowledge that the phrase "minimum necessary' shall be interpreted in accordance with the HITECH Act. (b) Prohibition on Unauthorized Use or Disclosure. The Business Associate will neither use nor disclose the Covered Entity's Protected Health Information, except as permitted or required by this Agreement or in writing by the Covered Entity or as Required by Law. This Agreement does not authorize the Business Associate to use or disclose the Covered Entity's Protected Health Information in a manner that will violate Subpart E of 45 CFR Part 164 if done by the Covered Entity. (c) information Safeguards. (i) Privacy of the Covered Entity's Protected Health information. The Business Associate will develop, Implement, maintain, and use appropriate administrative, technical, and physical safeguards to protect the privacy of the Covered Entity's Protected Health Information. The safeguards must reasonably protect the Covered Entity's Protected Health Information from any Intentional or unintentional use or disclosure in violation of the Privacy Rule and limit incidental uses or disclosures made to a use or disclosure otherwise permitted by this Agreement. (ti) Security of the Covered Entity's Electronic Protected Health Information. The Business Associate will develop, implement, maintain, and use administrative, technical, and physical safeguards that reasonably and appropriately protect the confidentiality, Integrity, and availability of Electronic Protected Health Information that the Business Associate creates, receives, maintains, or transmits on the Covered Entity's behalf as required by the Security Rule. The Business Associate will comply with Subpart C of 45 CFR Part 164 with respect to Electronic Protected Health Information, to prevent use or disclosure of protected health information other than as provided for by the Agreement, (iii) No Transfer of PHI Outside United States. Business Associate will not transfer Protected Health Information outside the United States without the prior written consent of the Covered Entity. In this context, a "transfer" outside the United States occurs if Business Associate's workforce members, agents, or subcontractors physically located outside the United States are able to access, use, or disclose Protected Health Information. (iv) Policies and Procedures. The Business Associate shall maintain written policies and procedures, conduct a risk analysis, and train and discipline its workforce. (d) Subcontractors and Agents. In accordance with 45 CFR 164.502(e)(1)(11) and 164.308(b)(2), if applicable, the Business Associate will ensure that any of Its Subcontractors and agents that create, receive, maintain, or transmit Protected Health Information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such Information. (e) Prohibition on Sale of Records. As of the effective date specified by HHS in final regulations to be Issued on this topic, the Business Associate shall not directly or Indirectly receive remuneration in exchange for any Protected Health Information of an individual unless the Covered Entity or Business Associate obtained from the individual, in accordance with 45 CFR §164.508, a valid authorization that includes a specification of whether the Protected Health Information can be further exchanged for remuneration by the entity receiving Protected Health Information of that individual, except as otherwise allowed under the HITECH Act. (f) Prohibition on Use or Disclosure of Genetic Information. Business Associate shall not use or disclose Genetic Information for underwriting purposes in violation of the HIPAA rules. (g) Penalties For Noncompliance. The Business Associate acknowledges that it is subject to civil and criminal enforcement for failure to comply with the privacy rule and security rule under the HIPAA Rules, as amended by the HITECH Act. 25A-15