WITTMAN ENTERPRISES, LLC HIPAA BUSINESS ASSOCIATE AGREEMENT -2009

Home Browse Search

ARTICLE II OBLIGATIONS OF BUSINESS ASSOCIATE, 2.1 Initial Effective Date of Performance. The obligations created under this Agreement shall become effective on April 14, 2001 2.2 Permitted Uses and Disclosures of Health Information. Business Associate is authorized to and shall: a. Use and Disclose Health Information as necessary to perform Services for, or on behalf of Covered Entity: b. Use Health Information to create aggregated or de- identified information (in accordance with the requirements of the Privacy Regulations); C. Use or Disclose Health Information (including aggregated or de- identified information) as otherwise directed by Covered Entity provided that Covered Entity shall not request Business Associate to Use or Disclose Health Information in a manner that would not be permissible if done by Covered Entity. Business Associate shall not Use Health Information for any other purpose, except that if necessary, Business Associate may Use Health Information for the proper management and administration of Business Associate or to carry out its legal responsibilities; provided that any Use or Disclosure described herein will not violate the Privacy Regulations or California law if done by Covered Entity. Except as otherwise limited in this Agreement, Business Associate may Disclose Health Information for the proper management and administration of the Business Associate, provided that with respect to any such Disclosure either (a) the Disclosure is required by law (within the meaning of the Privacy Regulations) or (b) the Disclosure would not otherwise violate California law and Business Associate obtains reasonable written assurances from the person to whom the information is to be Disclosed that such person will hold the information in confidence and will not Use or further Disclose such information except as required by law or for the purpose(s) for which it was Disclosed by Business Associate to such person, and that such person will notify Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached. 2.3 Adequate Safeguards for Health Information. Business Associate warrants that it shall implement and maintain appropriate safeguards to prevent the Use or Disclosure of Health Information in any manner other than as permitted by this Agreement. 2.4 Mitigation. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of Health Information by Business Associate in violation of the requirements of this Agreement. 2.5 Reporting Non - Permitted Use or Disclosure. Business Associate shall report to Covered Entity each Use or Disclosure that is made by Business Associate, its employees, representatives, agents or subcontractors that is not specifically permitted by this Agreement of which Business Associate becomes aware. The initial report shall be made by telephone call to the Covered Entity within forty-eight (48) hours from the time the Business Associate becomes aware of the non - permitted Use or Disclosure, followed by a written report to covered Entity no later than five (5) days from the date the Business Associate becomes aware of the non - permitted Use or Disclosure. 2.6 Availability of Internal Practices Books and Records. Business Associate agrees to make its internal practices, books and records relating to the Use and Disclosure of Health Information available to the Secretary of the U.S. Department of Health and Human Services ( "Secretary"), for purposes of determining Covered Entity's compliance with the Privacy Regulations. 2.7 Access to and Amendment of Health Information. Business Associate shall, to the extent Covered Entity determines that any Health Information constitutes a "designated record set" under the Privacy Regulations, (a) make the Health Information specified by Covered Entity available to Covered Entity or to the individual(s) identified by Covered Entity as being entitled to access and copy that Health Information, and (b) make any amendments to Health Information that are requested by Covered Entity. Business Associate shall provide such access and make such amendments within the time and in the manner specified by Covered Entity.