Professional Services Agreement - SEMMA Health Inc - 2020 City Benefit Plan

Home Browse Search

C. Ci61i atiasrSs on a:half of hovered Emit . To the extent Business Associate carries out on obligation for which Covered Entity is responsible under the Privacy Rule, Business Associate must comply with the requirements of the Privacy Rule that apply to Covered Entity in the performance of such obligation. D. HiP kA Safeguards 1. Business Associate shall use appropriate safeguards to prevent use or disclosure of PHI other than as permitted by this Agreement. 2. Business Associate shall comply with the Security Rule and implement reasonable and appropriate Administrative, Physical, and Technical Safeguards to protect the Confidentiality, Integrity, and Availability of EPHI and to prevent the use or disclosure of EPHI other than as permitted by the Agreement. 3. Business Associate shall not disclose or maintain PHI outside of the United States and shall not allow anyone outside the United States to have access to PHI without the express, prior written consent of Covered Entity. E. ffp-gd nca of Disclosures of Protected Health Information in Violation of HIP A. Business Associate shall report to Covered Entity in writing any use or disclosure of PHI not permitted by this Agreement promptly after becoming aware of such use or disclosure. F. Reoortina of Securitv Incidents. Business Associate shall report to Covered Entity any successful Security Incident promptly, but no later than ten (10) days, upon becoming aware of such incident. For purposes of this Agreement, an "unsuccessful" Security Incident is an unsuccessful attempt to breach the security of Business Associate's systems that Business Associate determines was targeted at Business Associate's systems storing Covered Entity's EPHI, and includes general "pinging" or "denial of service" attacks that are not determined to have been directed at such EPHI, and such unsuccessful Security Incidents shall be deemed as having been reported. G. Reporting of Breaches of Unsecured PHI. i. Notification Requirement. Business Associate shall report any Breach of Unsecured PHI known or suspected by Business Associate to Covered Entity without unreasonable delay and in no case later than ten (10) days after discovery of the Breach. 2. Discovery of Breach. For purposes of reporting a Breach to Covered Entity, the discovery of a Breach shall occur on the first day on which such Breach is known to Business Associate or, by exercising reasonable diligence, would have been known to or suspected by the Business Associate. Business Associate will be considered to have had knowledge of a Breach if the Breach is known, or by exercising reasonable diligence would have been known to any person (other than the person committing the Breach) who is an employee, officer or agent of the Business Associate. 3. Contents of Notification. Any notice referenced above in Section II(C)(1) of this Agreement will include, to the extent known to the Business Associate, the identification of each individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been accessed, acquired, used, or disclosed during such Breach. Business Associate will also provide to Covered Entity other available information that the Covered Entity is required to include in its notification to the individual pursuant to the Breach Notification Rule. Page 3 1 14