CONEXIS (2) - Laserfiche WebLink

Home Browse Search

0113C0NEXIS human resourceful® SECTION 2.0 OBLIGATIONS OF CONEXIS IN ITS CAPACITY AS BUSINESS ASSOCIATE 2.1 Not use or disclose PHI other than as permitted or required by this Schedule; 2.2 Use appropriate safeguards, and comply with the Security Rule to prevent use or disclosure of PHI other than as provided for by this HIPAA Schedule. Except as otherwise set forth in Section 2.3, CONEXIS will report to the Plan any use or disclosure of PHI than as otherwise provided by this Agreement, including but not limited to any Privacy Breaches and any successful Security Incidents, as soon as reasonably possible, but in no event later than thirty (30) calendar days, of becoming aware of such use or disclosure. CONEXIS will periodically report any unsuccessful Security Incidents, as determined necessary by CONEXIS; 2.3 If CONEXIS determines that any such use or disclosure is a Privacy Breach, it will provide notice to the Plan in accordance with 45 CFR § 164.410 and 45 CFR § 164.412. With respect to any Privacy Breaches, CONEXIS may, in its sole discretion, provide any of the following: (i) notice to affected individuals, including any substitute notice as necessary in accordance with 45 CFR § 164.404; (ii) if required, notice to a media outlet in accordance with 45 CFR § 164.406; 2.4 In accordance with 45 CFR § 164.502(e)(1)(ii) and 45 CFR § 164.308(b)(2), if applicable, ensure that any subcontractors that create receive, maintain, or transmit PHI on behalf of CONEXIS on or after September 23, 2014 agree to the same restrictions, conditions, and requirements that apply to. CONEXIS with respect to such information. Prior to September 23, 2014, CONEXIS agrees to obtain reasonable assurances from any subcontractors who receive PHI from CONEXIS that such subcontractors will use and disclose PHI received from CONEXIS according to terms and conditions that are substantially similar to those applicable to CONEXIS herein; 2.5 Make available PHI in a designated record set to the Individual in accordance with 45 CFR § 164.524. If the individual makes the request directly to the Plan and Plan requests such PHI from CONEXIS, CONEXIS will provide such information to the Plan as soon as reasonably possible but not later than ten (10) business days following the request; 2.6 Make any amendment(s) to Protected Health Information in a designated record set as directed or agreed to by the Plan pursuant to 45 CFR § 164.526, or take other measures as necessary to satisfy Plan's obligations under 45 CFR § 164.526; 2.7 Maintain and make available the information required to provide an accounting of disclosures to the individual in accordance with 45 CFR § 164.528. If the individual makes the request directly to the Plan and Plan requests such PHI from CONEXIS, CONEXIS will provide such information to the Plan as soon as reasonably possible but not later than ten (10) business days following the request; 2.8 To the extent CONEXIS agrees to carry out one or more of Plan's obligation(s) under the Privacy Rule, CONEXIS will comply with the requirements of the Privacy Rule that apply to the Plan in the performance of such obligation(s); and 2.9 Make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules, Direct Client Services Agreement 11 V10.0-050114