Software Agreement - MHIN, Inc. - Management for Mobile Integrated Community Health Outreach Program

Home Browse Search

XM mhin e. Data Subject to Applicable Law. As to Data that is subject to protections and restrictions under Applicable law, MHIN shall provide access to the EHR via a secured methodology, consistent with industry standards, which shall incorporate end user authentication by Practice Users for access. MHIN is responsible to ensure EHR security and shall operate the EHR System in a manner that protects the confidentiality, integrity, availability and/or security of Data. MHIN shall be responsible for correcting any data related errors caused by MHIN. MHIN will ensure encryption of Data through the use of generally accepted industry standards and methods, in no case less than is required under the Business Associate Agreement (Exhibit F) and under other Applicable Laws. MHIN shall be responsible for the security of Practice's Data that it receives while under the control of MHIN or under any Third Party Services. In furtherance of the foregoing, MHIN shall limit the number of MHIN personnel, subcontractors and agents who will have Access to Practice's Data to that which is necessary and appropriate to the work function of individual personnel, subcontractors and agents. Additionally, MHIN shall take all reasonable steps necessary to prevent MHIN personnel subcontractors and agents from accessing the Data after having their access privileges revoked or suspended. MHIN shall be responsible for ensuring the performance of routine and frequent backups of Practice's Data stored on the MHIN System. f. Audits. MHIN will provide a list of current users for auditing purposes on an annual basis. Additionally, MHIN will provide the ability for the security officer to perform individual user based and individual chart based audits on demand. User based audits will return every chart that a specific user has accessed. Chart based audits will return all users who have accessed that chart. 4. Practice Obligations a. Practice represents, warrants and covenants, that Practice (i) will use the MHIN Service solely in accordance with this Agreement and any attachments or exhibits hereto, (ii) will provide and maintain all computer and network equipment necessary to access and use the MHIN Service, (iii) will be solely responsible for inputting and retrieving data from the MHIN Service (with the exception of any reports to be generated by MHIN pursuant to Exhibit C), and for the accuracy and adequacy of information and data furnished for processing, (iv) will be solely responsible for and take full responsibility for (1) any decision with regard to the appropriateness of patient treatment, (2) the use of information provided by the MHIN Service in patient care, (3) the care and well-being of Practice's patients, and (4) the validity or reliability of information retrieved from the MHIN Service, (v) will comply with all applicable laws, (vi) will promptly provide MHIN with all necessary access to records, and will make available to MHIN all necessary Practice personnel, to enable MHIN to perform the Services in a timely manner, and (vii) does not possess and has not obtained items or services equivalent to those provided under this Agreement. b. Practice may be responsible for purchasing interface services, software licensing, or other professional services from the Practice management system vendor for purposes of building the Practice system interface to populate the EHR with Data. C. Practice is required to evaluate the System Recommendations set forth in Exhibit E and inform MHIN if the System Recommendations cannot be met by Practice. d. Practice will designate an individual as a security officer. Name and number of the security officer will be provided to MHIN. Security officer will be responsible for issuing Authorized User accounts; reviewing audits generated by MHIN; notifying MHIN of employee terminations, separations, and/or changes in individual employment status. Security officer will also be responsible for providing a current list of Authorized End Users to MHIN on an annual basis. 5. Data Security MHIN will develop, implement, maintain and monitor commercially reasonable physical, technical and administrative safeguards to protect the Data in its possession or under its control against accidental loss or unauthorized access, use, disclosure, alteration, or destruction. MHIN Form ##3013 Revised. 0810812014 Page 8 of 19