Common use of Activities of Business Associate Clause in Contracts

Activities of Business Associate. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By Law. Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement. Business Associate agrees to implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of any electronic Protected Health Information that Business Associate creates, receives, maintains or transmits on behalf of Covered Entity, as provided for in the Security Rule. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware. Business Associate also agrees to report to Covered Entity any security incident, including all data breaches whether internal or external, related to Protected Health Information of which Business Associate becomes aware. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity, agrees to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. Business Associate agrees to provide access, at the request of Covered Entity and during normal business hours, to Protected Health Information in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR §164.524, provided that Covered Entity delivers to Business Associate a written notice at least five (5) business days in advance of requesting such access. This provision does not apply if Business Associate and its employees, subcontractors and agents have no Protected Health Information in a Designated Record Set of Covered Entity. Business Associate agrees to make any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR §164.526, at the request of Covered Entity or an Individual. This provision does not apply if Business Associate and its employees, subcontractors and agents have no Protected Health Information from a Designated Record Set of Covered Entity. Unless otherwise protected or prohibited from discovery or disclosure by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures, relating to the use or disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity, available to the Covered Entity or to the Secretary for purposes of the Secretary determining Covered Entity's compliance with the Privacy Rule or Security Rule. Business Associate shall have a reasonable time within which to comply with requests for such access and in no case shall access be required in less than five (5) business days after Business Associate’s receipt of such request, unless otherwise designated by the Secretary. Business Associate agrees to maintain necessary and sufficient documentation of disclosures of Protected Health Information as would be required for Covered Entity to respond to a request by an Individual for an accounting of such disclosures, in accordance with 45 CFR §164.528. On request of Covered Entity, Business Associate agrees to provide to Covered Entity documentation made in accordance with this Agreement to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 C.F.R.§164.528. Business Associate shall have a reasonable time within which to comply with such a request from Covered Entity and in no case shall Business Associate be required to provide such documentation in less than five (5) business days after Business Associate's receipt of such request. Except as provided for in this Agreement, in the event Business Associate receives an access, amendment, accounting of disclosure, or other similar request directly from an Individual, Business Associate will redirect the Individual to the Covered Entity. Business Associate shall ship and package all ordered products patient specific.

Activities of Business Associate. Business Associate agrees to not the following: • Not use or disclose Protected Health Information protected health information other than as permitted or required by this the Agreement or as Required By Law. Business Associate agrees required by law; • Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to use appropriate safeguards electronic protected health information, to prevent use or disclosure of the Protected Health Information protected health information other than as provided for by this the Agreement. Business Associate agrees ; • Report to implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability Covered Entity any use or disclosure of any electronic Protected Health Information that Business Associate creates, receives, maintains or transmits on behalf of Covered Entity, as protected health information not provided for in by the Security Rule. Business Associate agrees Agreement of which it becomes aware, including breaches of unsecured protected health information as required at 45 CFR 164.410, and any security incident of which it becomes aware; and to mitigate, to the extent practicable, mitigate any harmful effect that is known to the Business Associate of a use or disclosure of Protected Health Information by Business Associate (or its subcontracting entities) in violation of the requirements of this Agreement. Business Associate agrees to report to Covered Entity ; if reasonable; • To implement adequate administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality and integrity of any use Protected Health Information it receives, maintains or transmits (electronic or otherwise) on behalf of Pacific Clinics; • Notify Pacific Clinics of any breach or potential breach or disclosure of the Protected Health Information not provided for by this Agreement within 24 hours of which it becomes becoming aware. Business Associate also agrees to report to Covered Entity ; including any security incidentincidents, including and incidents of all internal and external data breaches whether internal or externalbreaches; • In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), related to Protected Health Information of which Business Associate becomes aware. Business Associate agrees to if applicable, ensure that any agentsubcontractors that create, including a subcontractorreceive, to whom it provides Protected Health Information received frommaintain, or created or received by transmit protected health information on behalf of the Business Associate on behalf of, Covered Entity, agrees agree to the same restrictions restrictions, conditions, and conditions requirements that apply through this Agreement to the Business Associate with respect to such information. Business Associate agrees ; • Make available protected health information in a designated record set to provide accessthe Pacific Clinics as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.524, at to the extent applicable; • On the request of Covered Entity and during normal business hours, to Protected Health Information in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR §164.524, provided that Covered Entity delivers to Business Associate a written notice at least five (5) business days in advance of requesting such access. This provision does not apply if Business Associate and its employees, subcontractors and agents have no Protected Health Information in a Designated Record Set of Covered Entity. Business Associate agrees to make any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR §164.526, at the request of Covered Entity or an Individual. This provision does not apply if Business Associate and its employees, subcontractors and agents have no Protected Health Information from a Designated Record Set of Covered Entity. Unless otherwise protected or prohibited from discovery or disclosure by lawPacific Clinics, Business Associate agrees to make internal practices, books, and records, including policies and procedures, relating to the use or disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity, available to the Covered Entity or to the Secretary for purposes of the Secretary determining Covered Entity's compliance with the Privacy Rule or Security Rule. Business Associate shall have a reasonable time within which to comply with requests for such access and in no case shall access be required in less than five (5) business days after Business Associate’s receipt of such request, unless otherwise designated by the Secretary. Business Associate agrees to maintain necessary and sufficient documentation of disclosures of Protected Health Information as would be required for Covered Entity to respond to a request by an Individual for an accounting of such disclosures, in accordance with 45 CFR §164.528. On request of Covered Entity, Business Associate agrees to provide to Covered Entity documentation made in accordance with this Agreement to permit Covered Entity Pacific Clinics to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 C.F.R.§164.528CFR 164.528. Business Associate shall have respond to such request with seventy-two (72) business hours of receipt of request; • Make any amendment(s) to protected health information in a reasonable time within which designated record set as directed or agreed to comply with such a request from by the Covered Entity and in no case shall Business Associate be required pursuant to provide such documentation in less than five (5) business days after Business Associate's receipt of such request. 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526; • Except as provided for in this Agreementherein, in the event if Business Associate receives an access, amendment, accounting of disclosure, or other similar request directly from an Individualindividual, Business Associate will redirect the Individual to Pacific Clinics. • Maintain and make available the information required to provide an accounting of disclosures to the Pacific Clinics as necessary to satisfy Covered Entity. Business Associate shall ship ’s obligations under 45 CFR 164.528; and package all ordered products patient specific• Make its internal practices, books, and records available to for purposes of determining compliance with the HIPAA Rules.