Access to Business Associate’s Internal Practices. Except to the extent that it violates or interferes with attorney-client privilege, the duty of client confidentiality, or the applicable rules of professional responsibility, Business Associate will make its internal practices, books, and records, including policies and procedures and PHI, relating to the use and disclosure of (a) PHI received from, or created or received by Business Associate on behalf of, Covered Entity; and (b) EPHI created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity, available to the Secretary or to Covered Entity, in a time and manner designated by the Secretary or reasonably specified by Covered Entity, for purposes of the Secretary determining Covered Entity’s compliance with the HIPAA Privacy Regulations and HIPAA Security Regulations.
Access to Business Associate’s Internal Practices. Except to the extent that it violates or interferes with attorney-client privilege, the duty of client confidentiality, or the applicable rules of professional responsibility, Business Associate will make its internal practices, books, and records, including policies and procedures and PHI, relating to the use and disclosure of (a) PHI, including ePHI, created, used, disclosed, received, maintained, or transmitted by Business Associate on behalf of Covered Entity, available to the Secretary, in a time and manner designated by the Secretary, for purposes of the Secretary determining Business Associate or Covered Entity’s compliance with the HIPAA Privacy Regulations and HIPAA Security Regulations.
Access to Business Associate’s Internal Practices. Business Associate will make its internal practices, books, and records, including policies and procedures and PHI, relating to the use and disclosure of PHI, including EPHI, created, used, disclosed, received, maintained, accessed, or transmitted by Business Associate on behalf of Covered Entity, available to the Secretary or to Covered Entity, in a time and manner designated by the Secretary or reasonably specified by Covered Entity, for purposes of the Secretary determining Business Associate or Covered Entity’s compliance with the HIPAA Privacy Regulations and HIPAA Security Regulations.
Access to Business Associate’s Internal Practices. [Business Associate] will make its internal practices, books and records relating to the use and disclosure of PHI received from, or created or received by [Business Associate] on behalf of, Customer available to the Secretary of the federal Department of Health and Human Services for purposes of determining Customer’s compliance with 45 C.F.R. § 164, Subpart E.
Access to Business Associate’s Internal Practices. At the request of Covered Entity, Business Associate shall make its internal practices, books, records, policies and procedures relating to the use and disclosure of PHI, including ePHI that is created, used, disclosed, received, maintained, or transmitted by Business Associate on behalf of Covered Entity, available to the Secretary or Covered Entity, as applicable, in a time and manner designated by the Secretary or reasonably specified by Covered Entity, for purposes of determining compliance with the HIPAA Privacy Regulations and the HIPAA Security Regulations. In the event Business Associate receives a request from the Secretary that would require access to or disclosure of PHI, Business Associate shall consult with Covered Entity regarding the implications of permitting such access. Notwithstanding the foregoing, nothing in this section will be read to provide Covered Entity a right to access any books, records, work papers or data maintained by Business Associate on behalf of any other client of Business Associate.
