Security Rule Requirements. 9.1 Business Associate agrees, to the extent any Protected Health Information created, received, maintained or transmitted by or in electronic media, also referred to as electronic protected health care information, as defined by 45 CFR § 160.103, that it will only create, maintain or transmit such information with appropriate safeguards in place. Business Associate shall therefore: implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the electronic protected health care information; ensure that any agent, including Subcontractors, to whom it provides such information shall agree to also implement reasonable and appropriate safeguards to protect the information; and report to the Covered Entity any Security Incident, as that term is defined by 45 CFR § 164.304, of which it becomes aware.
Security Rule Requirements. Business Associate shall implement Administrative, Physical, and Technical Safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic PHI that it creates, receives, maintains, or transmits on behalf of the Covered Entity as required by the Security Rule. Additionally, Business Associate shall comply with the Security & Privacy Requirements described in the attached Security & Privacy Addendum. Not more than once per calendar year, Business Associate shall within ten (10) days after request from Covered Entity truthfully complete and duly execute the Annual Attestation that is attached hereto or, alternatively, notify Covered Entity in writing of any facts or events that would render untrue any statement within the Annual Attestation. Business Associate shall document policies and procedures that implement the foregoing requirements and shall, upon request, provide them to Covered Entity, who may further disclose them to any governmental entity with regulatory oversight over Covered Entity. Business Associate agrees to report to Covered Entity any use or disclosure of PHI not provided for by this Agreement or the HIPAA Authorities of which it becomes aware, including any Incident. Accordingly, as also provided in Section 3.4, Business Associate agrees to report any Incident of which it becomes aware to Covered Entity immediately, but not later than the same day of discovery of the Incident. All reports required of the Business Associate pursuant to this Section shall be provided as specified in Section 3.4 of this Agreement, including the actions and the mitigation steps, if any, taken by Business Associate in response to the Incident(s).
Security Rule Requirements. Practice Sense agrees to:
Security Rule Requirements. To the extent that Business Associate creates, receives, maintains, or transmits electronic PHI, Business Associate shall also implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of any electronic Protected Information that may be transmitted in conformity with the requirements of the Security Rule.
Security Rule Requirements. BUSINESS ASSOCIATE shall implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the ePHI that it creates, receives, maintains or transmits on behalf of COVERED ENTITY in accordance with the Security Rule; and (ii) make its policies and procedures, and documentation required by the Security Rule relating to such safeguards available to the Secretary for purposes of determining COVERED ENTITY’s compliance with the Security Rule. In addition, BUSINESS ASSOCIATE shall report to COVERED ENTITY within ten (10) business days any “security incident” of which it becomes aware, as such term is defined in the Security Rule. The report to COVERED ENTITY shall identify: the date of the security incident, the scope of the security incident and the BUSINESS ASSOCIATE’s response. BUSINESS ASSOCIATE will ensure that any agent or subcontractor to whom it provides ePHI that was created, received, maintained or transmitted on behalf of COVERED ENTITY agrees to implement reasonable and appropriate safeguards to protect the ePHI.
