Business Associates Obligations Clause Samples
Business Associates Obligations. BUSINESS ASSOCIATE agrees to:
a. Not use or disclose PHI other than as permitted or required by this Agreement or as Required by Law. In no event may BUSINESS ASSOCIATE use or further disclose PHI in a manner that would violate the Privacy Rule if done by the STATE, except as expressly provided in this Agreement and as required by 45 CFR §§ 164.502(a)(3), 164.502(a)(4) and 164.504(e)(2(ii)(A).
b. Implement appropriate safeguards, and comply, where applicable, with the Security Rule to ensure the confidentiality, integrity, and availability of all EPHI the BUSINESS ASSOCIATE creates, receives, maintains, or transmits on behalf of the STATE; protect against any reasonably anticipated threats or hazards to the security or integrity of such information; prevent uses or disclosures of such information other than as provided for by this Agreement or as Required by Law; and ensure compliance with the HIPAA Rules by BUSINESS ASSOCIATE’s Workforce. 7 These safeguards include, but are not limited to:
Business Associates Obligations. Both parties agree that Business Associate shall:
1. not use or further disclose the PHI other than as permitted by this Agreement;
2. use administrative, physical and technical safeguards to prevent use or disclosure of PHI and/or EPHI other than as permitted or required by this Agreement;
3. report to Covered Entity any use or disclosure of any PHI and/or EPHI, or a Security Incident of which Business Associate becomes aware that is not permitted by this Agreement;
4. ensure that any subcontractor or agent of Business Associate to whom Business Associate provides any PHI and/or EPHI agrees to the same restrictions and conditions that apply to Business Associate with regard to the use and/or disclosure of PHI pursuant to this section;
5. upon request by Covered Entity, make available to Covered Entity, or as directed by Covered Entity, to the Individual, such PHI contained in a Designated Record Set maintained by Business Associate as necessary to allow Covered Entity to respond to a request for access to PHI as required by HIPAA;
6. incorporate any amendments or corrections to the PHI in its possession that constitutes a Designated Record Set maintained by Business Associate as required by HIPAA; 6. document disclosures of PHI in the same manner as would be required of Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI as required by HIPAA;
7. make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary of U.S. Department of Health and Human Services (“DHHS”) for purposes of determining Covered Entity’s compliance with HIPAA; and
8. except as provided for herein, or as required by law, upon termination of this Agreement and/or the Service Agreement, return to Covered Entity or destroy the PHI and retain no copies in any form, if feasible. If Business Associate determines that returning or destroying the PHI is infeasible, Business Associate agrees to extend the protections, limitations and restrictions of this section to such PHI and to limit any further uses and/or disclosures of such PHI retained to the purposes that make the return or destruction of the PHI infeasible, for as long as Business Associate maintains such PHI.
Business Associates Obligations. BUSINESS ASSOCIATE agrees to:
a. Not use or disclose PHI other than as permitted or required by this Agreement or as Required By Law. In no event may BUSINESS ASSOCIATE use or further disclose PHI in a manner that would violate the Privacy Rule if done by COVERED ENTITY, except as expressly provided in this Agreement.12
b. Implement appropriate safeguards, and comply, where applicable, with the Security Rule to ensure the confidentiality, integrity, and availability of all EPHI BUSINESS ASSOCIATE creates, receives, maintains, or transmits on behalf of COVERED ENTITY; protect against any reasonably anticipated threats or hazards to the security or integrity of EPHI; prevent use or disclosure of EPHI other than as provided for by this Agreement or as Required By Law; and ensure compliance with the HIPAA Rules by BUSINESS ASSOCIATE’s Workforce.13 These safeguards include, but are not limited to:
Business Associates Obligations. 5 Electronic Protected Health Information: 45 CFR §160.103 6 Protected Health Information: 45 CFR §160.103 7 45 CFR §164.402. BUSINESS ASSOCIATE agrees to:
a. Not use or disclose PHI other than as permitted or required by this Agreement or as Required by Law. In no event may BUSINESS ASSOCIATE use or further disclose PHI in a manner that would violate the Privacy Rule if done by the STATE, except as expressly provided in this Agreement and as required by 45 CFR §§ 164.502(a)(3), 164.502(a)(4) and 164.504(e)(2(ii)(A).
b. Implement appropriate safeguards, and comply, where applicable, with the Security Rule to ensure the confidentiality, integrity, and availability of all EPHI the BUSINESS ASSOCIATE creates, receives, maintains, or transmits on behalf of the STATE; protect against any reasonably anticipated threats or hazards to the security or integrity of such information; prevent uses or disclosures of such information other than as provided for by this Agreement or as Required by Law; and ensure compliance with the HIPAA Rules by BUSINESS ASSOCIATE’s Workforce. 8 These safeguards include, but are not limited to:
Business Associates Obligations. 5.1 Handling of the PHI and Safeguards. Business Associate agrees to prevent access, use and/or disclosure of PHI other than as permitted or required by this BAA and/or applicable Privacy Laws, and will implement and use, at all times, appropriate administrative, physical and technical safeguards to (i) prevent access, use or disclosure of PHI other than as permitted by this BAA and/or Privacy Laws; and (ii) reasonably and appropriately protect the confidentiality, integrity, security, and availability of PHI.
Business Associates Obligations. Business Associate will:
(a) Not Use or Disclose PHI except as permitted or required by this Agreement or as required by law;
(b) Use appropriate safeguards and comply, where applicable, with 45 C.F.R. Subpart C with respect to EPHI, to prevent the Use or Disclosure of PHI, except as set forth in this Agreement;
(c) Implement Administrative, Physical and Technical Safeguards that reasonably and appropriately protect the Confidentiality, Integrity and Availability of EPHI;
(d) Promptly report to Practice: (i) any Use or Disclosure of PHI by Business Associate or a third party to which Business Associate Disclosed PHI that is not contemplated by this Agreement, including any Breach of Unsecured PHI; and (ii) any Security Incident, of which Business Associate becomes aware;
(e) Ensure that any subcontractors who create, receive, maintain or transmit PHI on behalf of Business Associate agree to the same restrictions and conditions in the Services Agreement and this Agreement;
(f) In accordance with Practice’s reasonable request, provide Practice, in accordance with 45 C.F.R. § 164.524, access to PHI in a Designated Record Set;
(g) Make any amendment to PHI in a Designated Record Set that Practice has agreed to pursuant to 45 C.F.R. § 164.526;
(h) Document any Disclosures of PHI necessary to provide an accounting of Disclosures in accordance with 45 C.F.R. § 164.528;
(i) To the extent Business Associate carries out any obligations of Practice under the Requirements, Business Associate will comply with the Requirements that apply to Practice in the performance of such obligation;
(i) Make its internal practices, books and records, relating to the Use and Disclosure of PHI available to the Secretary for purposes of determining Practice’s compliance with the Requirements; and
(j) Mitigate, to the extent practicable, any harmful effects (known to Business Associate) from any Use or Disclosure of PHI by Business Associate not permitted by this Agreement.
Business Associates Obligations. 2.1. Business Associate Subject to Same Standards and Same Penalties as Provider. Business Associate will comply with the use and disclosure provisions of the Privacy Rule and the security standards regarding administrative, physical and technical safeguards of the Security Rule. As set forth in the HITECH Act, Business Associate will be subject to civil and criminal penalties for violation of the Privacy Rule or the Security Rule.
Business Associates Obligations. 3.1 Business Associate agrees that it is required under the amended HIPAA regulations to comply with, and shall comply with, the HIPAA Security Rule, including the Security Rule's Administrative, Physical, and Technical safeguard requirements.
Business Associates Obligations. Business Associate will:
(a) Not Use or Disclose PHI except as permitted or required by this Agreement or as required by law;
(b) Use appropriate safeguards and comply, where applicable, with 45 C.F.R. Subpart C with respect to EPHI, to prevent the Use or Disclosure of PHI, except as set forth in this Agreement;
(c) Implement Administrative, Physical and Technical Safeguards that reasonably and appropriately protect the Confidentiality, Integrity and Availability of EPHI;
Business Associates Obligations. BUSINESS ASSOCIATE agrees to:
a. Not use or disclose PHI other than as permitted or required by the Agreement or as Required By Law. In no event may BUSINESS ASSOCIATE use or further disclose PHI in a manner that would violate HIPAA if done by HHSC.
b. Not use PHI to create de-identified information for purposes unrelated to the Contract without HHSC’s advance written approval. BUSINESS ASSOCIATE will use and request only the minimum PHI necessary to accomplish the permissible purpose of the use or request and shall comply with the minimum necessary standard under 45 C.F.R. § 164.502(b), as amended from time to time.
c. Implement appropriate safeguards, and comply, where applicable, with the Security Rule to ensure the confidentiality, integrity, and availability of all PHI BUSINESS ASSOCIATE creates, receives, maintains, or transmits on behalf of HHSC; protect against any reasonably anticipated threats or hazards to the security or integrity of PHI; prevent use or disclosure of PHI other than as provided for by this Agreement or as Required by Law; and ensure compliance with the HIPAA Rules by BUSINESS ASSOCIATE’s Workforce. These safeguards include, but are not limited to:
(i) Administrative Safeguards. BUSINESS ASSOCIATE shall implement policies and procedures to prevent, detect, contain, and correct security violations, and reasonably preserve and protect the confidentiality, integrity, and availability of PHI (which includes EPHI), as required by 45 C.F.R. § 164.308, and enforcing those policies and procedures, including sanctions for anyone not found in compliance;
(ii) Technical and Physical Safeguards. BUSINESS ASSOCIATE shall implement appropriate technical safeguards, as required by 45 C.F.R. §§ 164.310 and 164.312, to protect PHI, including access controls, authentication, and transmission security, as well as implement appropriate physical safeguards to protect PHI, including workstation security and device and media controls; and