CONEXIS - Laserfiche WebLink

Home Browse Search

N. CONEXIS human rosovrc viuf "Security Incident" will have the same meaning as the term "security incident" in 45 CFR § 164.304 "Security Rule" will mean the Security Standards for the Protection of Electronic Protected Health Information in 45 CFR § 164.302 at seq. "Unsecured Protected Health Information" or "Unsecured PHI" will have the same meaning as the term "Unsecured Protected Health Information" in 45 C.F.R. 164.402. II. Confidentiality At all times, both during and after the termination of its relationship with the Employer for any reason, CONEXIS will not use or disclose PHI in any manner whatsoever, except as otherwise permitted by this Addendum. III. Permitted Uses and Disclosures of Business Associate. (a) Except as otherwise limited in this Addendum, CONEXIS may use or disclose PHI, provided that such use or disclosure of PHI would not violate the Privacy Rule, as follows: (a) as permitted or required in this Addendum and in the Agreement; (b) as otherwise permitted by the Privacy Rule; (c) as Required by Law; (d) for the proper management and administration of CONEXIS; (e) to fulfill any present or future legal responsibilities of CONEXIS; (f) for Data Aggregation services to the Plan (as defined in 45 CFR § 164.501); or (g) any use and disclosure of PHI that has been de -identified in accordance with 45 CFR § 164.514. (b) CONEXIS agrees to document any disclosures of PHI and the information related to such disclosures to respond to an accounting of disclosures of PHI if requested by the Plan in accordance with 45 CFR §164.528, and to provide such documentation to the Plan as it may request from time to time. (c) In the event that CONEXIS maintains PHI in a Designated Record Set, CONEXIS agrees to provide access to such PHI that it maintains in a Designated Record Set to the Individual to whom the PHI relates in accordance with 45 CFR § 164.524. Furthermore, at the reasonable request of the Plan, CONEXIS agrees to make amendments to PHI that it maintains in a Designated Record Set as directed by the Plan and to reasonably incorporate any amendments to PHI in accordance with 45 CFR § 164.526. (d) CONEXIS may disclose PHI to its agents or subcontractors with a bona fide need to know such PHI, but only if, prior to such disclosure, such agents or subcontractors provide reasonable assurances that they will agree to substantially the same restrictions and conditions that apply to CONEXIS with respect to such PHI, including electronic PHI. (e) CONEXIS may disclose the PHI revealed to it by the Plan if and to the extent that such disclosure is required by law or court order or as otherwise permitted by law. Further, CONEXIS agrees to make its internal practices, books, and records, including policies and procedures, relating to the use and disclosure of PHI received from, or created or received by CONEXIS on behalf of the Plan available to the Secretary, as requested by the Plan or designated by the Secretary, for purposes of the Secretary determining the Plan's compliance with the Privacy Rule. (f) In accordance with 45 CFR §164.520, and to the extent that such a limitation may affect the Business Associate's use or disclosure of PHI, Employer, acting on behalf of the Plan, agrees to notify CONEXIS of any limitation(s) in the notice of privacy practices required by the Privacy Rules, including, without limitation, any changes in or revocation of permission by an Individual to use or disclose PHI. Employer, acting on behalf of the Plan, also agrees to notify CONEXIS of any restriction to the use or disclosure of PHI that Employer has agreed to in accordance with 45 CFR § 164.522, to the extent that such restriction may affect CONEXIS' use or disclosure of PHI. Employer acknowledges and agrees that CONEXIS is not bound by any such restrictions that impact CONEXIS' use or disclosure of PHI to the extent such restrictions are not otherwise required by the HIPAA Privacy Rules and CONEXIS has not consented to such restrictions in advance. CONEXIS agrees not to unreasonably withhold consent. (g) CONEXIS agrees to take steps to implement safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of electronic PHI maintained by CONEXIS on behalf of the Plan. CONEXIS will report to the Plan's designated representative any use or disclosure of PHI otherwise than as provided by this Agreement, including any Security Incident, as soon as reasonably possible of becoming aware of such use or disclosure. As of the Compliance Date of 42 U.S.C. § 17931 and the regulations issued thereunder, CONEXIS agrees to comply with the Security Rule requirements set forth in 45 C.F.R. §§ 164.308, 164.310, 164.312, and 164.316.ln addition, CONEXIS hereby agrees that it shall report to the Plan's designated representative, without unreasonable delay, but not CONEXIS Initials I ClienInitials Direct Client Services Agreement 11 V9.0-040111