25A - AGMT FOR FLEX SPENDING - Laserfiche WebLink

Home Browse Search

DocuSign Envelope ID: CFCE3443-EF37-4FD4-8DCD-D85D559F77AE existence of a business associate agreement between Covered Entity, on the one hand, and, on the other hand, another business associate of Covered Entity. Where required by service agreements and/or business associate agreements prepared by other business associates, Covered Entity shall expressly authorize transmission of PHI to Business Associate. Covered Entity promptly shall notify Business Associate of any changes to its relationships with other business associates with which Business Associate may have dealings in fulfilling its duties hereunder. 3. Duties of Business Associate Relative to PHI. a. Business Associate shall not use or disclose PHI other than as permitted or required by this Agreement or as Required by Law, and otherwise comply with all applicable provisions of the Privacy Rule. b. Business Associate shall use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information, to prevent use or disclosure of protected health information other than as provided for by this Agreement, and otherwise comply with all applicable provisions of the Security Rule. c. Business Associate will report to Covered Entity any use or disclosure of Protected Health Information not provided for by this Agreement of which it becomes aware, including Security Incidents of which Business Associate becomes aware. Business Associate shall not, however be required to report to Covered Entity the ongoing existence and occurrence of "Attempted but Unsuccessful Security Incidents," defined as activity such as pings and other broadcast attacks on Business Associate's firewall, port scans, unsuccessful log -on attempts, denial of service and any combination of the above, so long as no such incident results in unauthorized access, use or disclosure of Electronic PHI as defined under the HIPAA Rules. d. Business Associate promptly shall notify Covered Entity of a Breach of Unsecured PHI upon Business Associate's discovery of same. Business Associate will treat any Breach as being discovered in accordance with 45 CFR § 164.410. Business Associate's notification to Covered Entity hereunder shall: (1) Be made to Covered Entity without unreasonable delay and in no event later than 60 calendar days after discovery of the Breach, except where a law enforcement official determines that a notification would impede a criminal investigation or cause damage to national security; 4 _. /GDE 111111........... 41N\Il fl Document Generated on June 16, 2020 City of Santa Ana Business Associate Agreement Client Initials: Page 7 25A-30