25A - AGMT FOR FLEX SPENDING - Laserfiche WebLink

Home Browse Search

DocuSign Envelope ID: CFCE3443-EF37-4FD4-8DCD-D85D559F77AE (2) Identify the individuals whose Unsecured PHI has been, or is reasonably believed to have been, the subject of a Breach; and (3) Include any other available information that the Covered Entity requires in order to complete a risk assessment under 45 CFR § 164.402 with respect to the Individuals affected by the Breach, or in order to notify such Individuals of the Breach, as well as the Secretary and the media, to the extent required under §13402(f) of the HITECH Act, 42 U.S.C. § 17932 and 45 CFR §§ 164.404, 164.406 and 164.408. Business Associate shall provide such information to Covered Entity promptly upon such information becoming available to Business Associate. Covered Entity solely shall be responsible for providing notification to any Individual, the Secretary, or the media with regard to a Breach. (4) Each party shall bear its own costs and expenses required to comply with notification duties resulting from a breach of Unsecured PHI as set forth in 45 CFR §§ 164.404, 164.406, and 164.408, with regard to Covered Entity, and as set forth in 45 CFR § 164.410, with regard to Business Associate. (5) Each party shall mitigate, to the extent practicable, any harmful effect known to them resulting from a use or disclosure of PHI in violation of this Agreement. i. In accordance with 45 CFR §§ 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, Business Associate agrees to require that any of its Subcontractors that create, receive, maintain or transmit Protected Health Information from or on behalf of Business Associate agree in writing to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information, including the obligation promptly to notify Business Associate of any use or disclosure of PHI not provided for by the agreement between the Business Associate and the Subcontractor, and to report to Business Associate any Security Incident of which Subcontractor becomes aware, or Breach that Subcontractor discovers. ii. In the event Business Associate becomes aware of a pattern or practice of a Subcontractor that violates the privacy and security safeguard obligations made to Business Associate, Business Associate will take reasonable steps to cure such violation and otherwise will respond to non-compliance by a Subcontractor in the same way that Covered Entity is required to respond to non-compliance by Business Associate. III. Effective as of September 23, 2013, or the Effective Date of this Agreement, if later, Business Associate will refrain from engaging in the sale of any Protected AGUE Document Generated on June 16, 2020 City of Santa Ana Business Associate Agreement Client Initials: Page 8 25A-31