|
(c) Provide Business Associate with the Notice of Privacy Practices that
<br />Covered Entity produces in accordance with the Privacy Rule, and any changes or
<br />limitations to such notice under 45 C.F.R. § 164.520, to the extent that such changes or
<br />limitations may affect Business Associate's use or disclosure of PHI.
<br />4.2 Covered Entity shall not request Business Associate to use or disclose PHI in
<br />any manner that would not be permissible under the Privacy and Security Rule if done by
<br />Covered Entity, except as provided under Section 3 of this BAA.
<br />5. 'Compliance with Security -Rule.
<br />5.1 Business Associate shall comply with the HIPAA Security Rule, which shall
<br />mean the Standards for Security of Electronic Protected Health Information at 45 C.F.R. Part
<br />160 and Subparts A and C of Part 164, as amended by ARRA and the HITECH Act. The term
<br />"Electronic Health Record" or "EHR" as used in this BAA shall mean an electronic record of
<br />health -related information on an individual that is created, gathered, managed, and consulted
<br />by authorized health care clinicians and staff.
<br />5.2 In accordance with the Security Rule, Business Associate agrees to:
<br />(a) Implement the administrative safeguards set forth at 45 C.F.R. §
<br />164.308, the physical safeguards set forth at 45 C.F.R. § 164.310, the technical
<br />safeguards set forth at 45 C.F.R. § 164.312, and the policies and procedures set forth at
<br />45 C.F.R. § 164.316, to reasonably and appropriately protect the confidentiality,
<br />integrity, and availability of the ePHI that it creates, receives, maintains, or transmits on
<br />behalf of Covered Entity as required by the Security Rule. Business Associate
<br />acknowledges that, effective on the Effective Date of this BAA, (a) the foregoing
<br />safeguards, policies, and procedures requirements shall apply to Business Associate in
<br />the same manner that such requirements apply to Covered Entity, and (b) Business
<br />Associate shall be liable under the civil and criminal enforcement provisions set forth
<br />at 42 U.S.C. § 1320d-5 and 1320d-6, as amended from time to time, for failure to comply
<br />with the safeguards, policies, and procedures requirements and any guidance issued by
<br />the Secretary from time to time with respect to such requirements;
<br />(b) Require that any agent, including a Subcontractor, to whom it provides
<br />such PHI agrees to implement reasonable and appropriate safeguards to protect the PHI;
<br />and
<br />(c) Report to the Covered Entity any Security Incident of which it becomes
<br />aware.
<br />6. Indenmificatiom Exce tions and Limitations. Each Party (the "Indemnifying Party")
<br />shall indemnify, defend, and hold harmless the other Party and its officers, directors,
<br />employees, agents, and affiliates (collectively, the "Indemnified Party") against any and all
<br />losses, damages, liabilities, deficiencies, claims, actions, judgments, settlements, interest,
<br />awards, penalties, fines, costs, or expenses of whatever kind, including reasonable attorneys'
<br />5
<br />
|