Common use of Auditing Clause in Contracts

Auditing. Business Associate represents and warrants that it maintains adequate internal audit functions to annually assess internal controls in its environment, and to protect the security and confidentiality of PHI. Business Associate agrees to provide documentation regarding its internal controls to Covered Entity upon request. Business Associate agrees that it has undertaken, or will undertake, at its sole cost and expense, an independent SSAE 16 Type II audit or comparable independent attestation to confirm Business Associate’s controls over its processes. Business Associate will provide to Covered Entity all internal or external audit reports, certifications, information, documentation, electronic records and data regarding Business Associate’s internal controls, and if requested by Covered Entity, Business Associate will grant Covered Entity and its agents or subcontractors, the right to audit Business Associate’s operations, systems and software to confirm internal controls are present and operating. If the information presented to Covered Entity regarding Business Associate’s internal controls is not acceptable to Covered Entity in its reasonable discretion, Business Associate shall present an action plan acceptable to Covered Entity, to correct any and all portions of the systems, software, products, documentation, or internal controls. Business Associate shall undertake all activities relating to its preparation of the action plan and to its correction of any inadequate controls or mitigation of risks revealed by deficiencies in its internal controls at Business Associate’s sole cost and expense and within a reasonable time period as agreed upon by Covered Entity. Should Business Associate fail to provide adequate internal controls as described in this Section 5, or to present an action plan acceptable to Covered Entity within the mutually agreed upon time frame, Covered Entity shall be entitled, in its sole discretion, to terminate this Agreement and the Underlying Agreement with no liability whatsoever to Business Associate upon written notice to the Business Associate.