25A - AGMT EMPLOYEE TRACKING SVCS

Home Browse Search

(111) Disclosure Information. With respect to any disclosure by the Business Associate of the Covered Entity's Protected Health Information that is not excepted from disclosure accounting under the HIPAA Rules, the Business Associate will record the following Disclosure Information as applicable to the type of accountable disclosure made: (A) Disclosure Information Generally. Except for repetitive disclosures of the Covered Entity's Protected Health Information as specified below, the Disclosure Information that the Business Associate must record for each accountable disclosure Is (1) the disclosure date, (2) the name and (if known) address of the entity to which the Business Associate made the disclosure, (3) a brief description of the Covered Entity's Protected Health Information disclosed, and (4) a brief statement of the purpose of the disclosure. (B) Disclosure Information for Repetitive Disclosures. For repetitive disclosures of the Covered Entity's Protected Health Information that the Business Associate makes for a single purpose to the same person or entity (Including the Covered Entity), the Disclosure Information that the Business Associate must record Is either the Disclosure Information specified above for each accountable disclosure, or (1) the Disclosure Information specified above for the first of the repetitive accountable disclosures; (2) the frequency, periodicity, or number of the repetitive accountable disclosures; and (3) the date of the last of the repetitive accountable disclosures. (iv) Availability of Disclosure Information. The Business Associate will maintain the Disclosure Information for at least 6 years following the date of the accountable disclosure to which the Disclosure Information relates (3 years for disclosures related to an Electronic Health Record, starting with the date specified by HHS). The Business Associate will make the Disclosure Information available to the Covered Entity within twenty-five (25) calendar days following the Covered Entity's request for such Disclosure Information to comply with an individual's request for disclosure accounting. Effective as of the date specified by HHS, with respect to disclosures related to an Electronic Health Record, the Business Associate shall provide the accounting directly to an individual making such a disclosure request, if a direct response is requested by the individual. To the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to the covered entity in the performance of such obligation(s); and make its Internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules. (d) Restriction Agreements and Confidential Communications. The Covered Entity shall notify the Business Associate of any limitations in the notice of privacy practices of Covered Entity under 45 CFR §164.520, to the extent that such limitation may affect the Business Associate's use or disclosure of Protected Health Information. The Business Associate will comply with any agreement that the Covered Entity makes that either (1) restricts use or disclosure of the Covered Entity's Protected Health Information pursuant to 45 CFR §164.522(a), or (ii) requires confidential communication about the Covered Entity's Protected Health Information pursuant to 45 CFR §164.522(b), provided that the Covered Entity notifies the Business Associate in writing of the restriction or confidential communication obligations that the Business Associate must follow. The Covered Entity will promptly notify the Business Associate in writing of the termination of any such restriction agreement or confidential communication requirement and, with respect to termination of any such restriction agreement, instruct the Business Associate whether any of the Covered Entity's Protected Health Information will remain subject to the terms of the restriction agreement. Effective February 17, 2010 (or such other date specified as the effective date by HHS), the Business Associate will comply with any restriction request If: (1) except as otherwise required by law, the disclosure is to a health plan for purposes of carrying out payment or health care operations (and is not for purposes of carrying out treatment); and (ii) the Protected Health Information pertains solely to a health care item or service for which the health care provider involved has been paid out-of-pocket in full. VII. Breaches and Security Incidents (a) Reporting. (1) Impermissible Use or Disclosure. The Business Associate will report to Covered Entity any use or disclosure of Protected Health Information not permitted by this Agreement not more than twenty-five (25) calendar days after Business Associate becomes aware of such non -permitted use or disclosure. (11) Privacy or Security Breach. The Business Associate will report to the Covered Entity any use or disclosure of the Covered Entity's Protected Health Information not permitted by this Agreement of which it becomes aware, including breaches of Unsecured Protected Health Information as required by 45 CFR 25A-17