Offshore Entities. Business Associates shall not transmit or make PHI accessible to any Offshore Entity without Covered Entity’s prior written consent. Business Associate requests for permission to send PHI to an Offshore Entity must be submitted in writing to the Chief Compliance and Privacy Officer of St. Xxxxxx Health. The request must include details sufficient to identify the Offshore Entity, the specific PHI to be transmitted or accessed by the Offshore Entity, and the purpose for which that PHI will be used or accessed by the Offshore Entity. Covered Entity reserves the right to request and, upon that request Business Associate shall provide, additional documentation and evidence of the Offshore Entity’s compliance with the terms of this Addendum and privacy and data protection laws including HIPAA and applicable state laws. Business Associate shall ensure that any Offshore Entity expressly granted written access to PHI by Covered Entity has first completed privacy and security training compliant with the Privacy Rule and Security Rule. Furthermore, Business Associate shall ensure that representatives of Covered Entity and of Medicare plans in which Covered Entity participates shall have the right to audit any Offshore Entity receiving PHI from Covered Entity; provided, however, that such audits shall be limited to the use and disclosure of PHI by the Offshore Entity and audits of administrative, physical, technical, and organizational privacy and security safeguards, and policies, procedures, and documentation addressing the privacy and security of PHI.
