Business Associate Agreement & Data Services Agreement - SEMMA Health, Inc.

Home Browse Search

B. Limitations on Disclosure of PHI: Business Associate shall not use or disclose PHI other than as permitted or required by this Agreement or as Required by Law. Business Associate shall not use or disclose PHI in a manner that would violate the Privacy Rule if done by Covered Entity, unless expressly permitted to do so pursuant to the Privacy Rule and this Agreement. C. Obligations on Behalf of Covered Entity. To the extent Business Associate carries out an obligation for which Covered Entity is responsible under the Privacy Rule, Business Associate must comply with the requirements of the Privacy Rule that apply to Covered Entity in the performance of such obligation. D. HIPAA Safeguards: 1. Business Associate shall use appropriate safeguards to prevent use or disclosure of PHI other than as permitted by this Agreement or as Required by Law. 2. Business Associate shall comply with the Security Rule and implement reasonable and appropriate Administrative, Physical, and Technical Safeguards to protect the Confidentiality, Integrity, and Availability of EPHI and to prevent the use or disclosure of EPHI other than as permitted by the Agreement and this BAA or as Required by Law. E. Reporting of Disclosures of Protected Health Information in Violation of HIPAA. Business Associate shall report to Covered Entity in writing any use or disclosure of PHI not permitted by this Agreement promptly after becoming aware of such use or disclosure. F. Reporting of Security Incidents.Business Associate shall report to Covered Entity any successful Security Incident promptly upon becoming aware of such incident. For purposes of this Agreement, an "unsuccessful" Security Incident is an unsuccessful attempt to breach the security of Business Associate's systems that Business Associate determines was targeted at Business Associate's systems storing Covered Entity's EPHI, and includes general "pinging" or "denial of service" attacks that are not determined to have been directed at such EPHI, and such unsuccessful Security Incidents shall be deemed as having been reported. G. Reporting of Breaches of Unsecured PHI Notification Re uirement. To the extent Business Associate accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses or discloses Unsecured PHI, it will, following the discovery of a Breach of such information, notify Covered Entity of such Breach without unreasonable delay and in no case later than 60 days after discovery of the Breach. 2. Discovery of Breach. For purposes of reporting a Breach to Covered Entity, the discovery of a Breach shall occur on the first day on which such Breach is known to Business Associate or, by exercising reasonable diligence, would have been known to or suspected by the Business Associate. Business Associate will be