CONEXIS (2) - Laserfiche WebLink

Home Browse Search

013CON EXIS human resourceful' HIPAA BUSINESS ASSOCIATE SCHEDULE This HIPAA Business Associate Schedule (the "HIPAA Schedule") is entered into by Client, on behalf of itself as a group health plan sponsor and one or more of the Group Health Plans maintained by Client, and CONEXIS. This HIPAA Schedule is specifically incorporated into and made a part of this Services Agreement between CONEXIS and Client ("Agreement"). CONEXIS recognizes that in the course of performing services for and on behalf of the Group Health Plants) in accordance with the Agreement. CONEXIS will create, receive, or maintain Protected Health Information ("PHI") on behalf of the Plan. Consequently, CONEXIS is a "Business Associate" (as defined in 45 CFR § 160.103) of the Plan and is entering into this Schedule as necessary to satisfy the requirements of 45 CFR §§ 164.502(e) and 164.504(e)(1). Both Client and CONEXIS acknowledge and agree that CONEXIS is an independent contractor and is not an "agent" of Client. All provisions of this Schedule reflect the requirements of the Health Information Technology for Economic and Clinical Health Act ("HITECH") that are effective as of September 23, 2013. If there is a conflict between the Agreement and this HIPAA Schedule with regard to the subject matter herein, this HIPAA Schedule controls. SECTION 1.0 DEFINITIONS The following terms are capitalized throughout and are specifically defined as follows: 1.1 "Group Health Plan" or "Plan" will have the same meaning as the term "group health plan" in 45 CFR § 160.103; however, such term shall be limited to the group health plans administered by CONEXIS in accordance with the Agreement. This term does not include any Health Savings Account, as defined in 26 USC § 223, for which CONEXIS provides related services in accordance with the Agreement. 1.2 "Privacy Breach" will have the same meaning as "Breach" set forth in 45 CFR § 164.402. 1.3 "Privacy Rule" will mean the Standards for Privacy of Individually Identifiable Health Information in 45 CFR Part 160 and 164, Subparts A and E. 1.4 "Protected Health Information" or "PHI" will have the same meaning as the term "protected health information" in 45 CFR § 160.103 and will include any electronic protected health information as defined in 45 CFR § 160.103. Notwithstanding anything to the contrary herein, PHI will not include information received by CONEXIS from Client or its designee that is related to an individual's enrollment (or disenrollment) in the Plan and is provided to CONEXIS solely for the purpose of assisting Client with its enrollment obligations under the Plan. 1.5 "Required by Law" will have the same meaning as the term "required by law" in 45 CFR § 160.103. 1.6 "Secretary" will mean the Secretary of the Department of Health and Human Services or his designee. 1.7 "Security Incident" will have the same meaning as the term "security incident" in 45 CFR § 164.304. 1.8 "Security Rule" will mean the Security Standards for the Protection of Electronic Protected Health Information in 45 CFR § 164.302 at seq. All other terms not specifically defined above shall have the same meanings specifically allocated to such terms by the Privacy and Security Rule. Direct Client Services Agreement 10 V10.0-050114