25D - AGMT - BENEFITS SRVS - Laserfiche WebLink

Home Browse Search

(b) Neither Sponsor nor Covered Entity shall request Business Associate to use or disclose PI-II in any rnanner that would not be permitted or required bylaw if done by Covered Entity, (c) Covered Entity shat! notify Business Associate in writing of any restriction to the use or disclosure of PIII that Covered Entityhas agreed to in accordance with 45 CFR § 164.522. MEMNIPI .ATI N (ai) Business Associate agrees to indemnify, defend, and hold harmless the Covered Entity, its trustees, officers, directors, employees, agents, or representatives, from anyclaim or penaltyarising out of any improper use and /or disclosure of PHI in violation of the Privacy Regulation, to the extent that such improper use and /or disclosure resulted from Business Associate's negligence or failure to comply with the terms of this Agreement or the Privacy Regulation. (b) The Sponsor and Covered Entity agree to indemnify, defend and hold harmless Business Associate and /or all of Business Associate's officers, directors, employees, agents, or representatives, from any claim or penalty from any improper use anti /or disclosure of PHI, to the extent that such improper use and /or disclosure resulted from the Sponsor's or Covered E atity's negligence, failure to comply with the terms of this Agreement or the Privacy Regulation, or was based upon the Sponsor's or Covered Entity's written direction to use and /or disclose PIT in the manner challenged. SECURITY Business Associate agrees to: a) Implement safeguards that reasonably and appropriately protect the confidentiality; integrity, and availability of the electronic PI -II that it creates, receives, maintains, or transmits on behalf of the Cknvered Entity; ii) Ensure that any Subcontractor, to whom it provides this information agrees to implement reasonable and appropriate safeguards; iu) Report on a quarterly basis to the Covered Entity, in writing, any Security Incident involving Covered Entitys data. If, however, a Security Incident results in the unauthorized disclosure of Unsecured PHI, Business Associate shall notify Covered Entity in accordance with the Breach notification provisions below. iv) Notify Covered Entity no later than ten (10) days after discovery of a Breach of Unsecured PE-U v) Performthe four factor riskassessuient of anyBreaeh that is discovered in accordance with the I-IIPAA Rules to deten- nine if notification is required, and advise Covered Entity of its findings. Covered Entity has 60 clays from the discovery date of a reportnbte Breach to report said Breach to the Individual and I-IHS (if Breach involves 500 or more Individuals.) Kcennn & As.aciatrs - License HO,151271 [Business Associate Commut (SnatterJay) (Rev. (17/29/ 17) page 5 of 3 f1 \if;ti 25D -19