98point6 10/2/19 - Laserfiche WebLink

transmitted by Business Associate for or on behalf of Covered Entity pursuant to the Service Agreement. "Security Rule" means final regulatory provisions set forth at 45 CFR Parts 160 and 164, Subparts A and C. 2. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE 2.1. Use of PHI. Business Associate agrees not to use or disclose PHi other than as necessary to perform the Services, as permitted or required by this Agreement, or as Required by Law. 2.2. Safeguards; Compliance with the Security Rule. Business Associate agrees (a) to use appropriate safeguards to (1) prevent use or disclosure of PHI other than as permitted by this Agreement and (ii) appropriately protect the confidentiality, integrity, and availability of PHI; and (b) to comply, where applicable, with the Security Rule with respect to ePHI. 2.3. Reporting Unauthorized Use or Disclosure. Business Associate agrees to report to Covered Entity any use or disclosure of PHI that is not permitted by this Agreement, including any successful Security Incident and any Breach of Unsecured PHi. Any such report shall be made without unreasonable delay, but in no event beyond 5 calendar days after Business Associate discovers such use or disclosure, unless taw enforcement requests a delay in such notice as permitted under 45 CFR§ 164.412. Following notice to Covered Entity of any Breach of Unsecured PHI, Business Associate will provide information required by 45 CFR S 164.404(c), if available, that would permit Covered Entity to comply with its notice obligations. Business Associate is under no other obligation to make any report of a Breach of Unsecured PHI, including to any individual, state, federal, or other government agency or attorney general, or the media on behalf of Covered Entity. 2.4. Unsuccessful Security Incidents. Covered Entity and Business Associate acknowledge and agree that unsuccessful Security Incidents include but are not limited to: (a) unsuccessful attempts to penetrate computer networks or assets maintained by Business Associate; (b) immaterial incidents such as "pinging" or "denial of services" attacks, port scans, and unsuccessful log-on attempts; and (c) any combination of the foregoing, as long as no such incident results in unauthorized access, use, or disclosure of PHI. This Section 2.4 hereby constitutes notice to Covered Entity, and no further notification is required regarding unsuccessful Security Incidents. 2.5. Compliance by Subcontractors. Business Associate agrees to ensure that any of its Subcontractors that create, receive, maintain or transmit PHi for or on behalf of Business Associate agree in writing to comply with the Security Rule and substantially similar restrictions and conditions to those that apply through this Agreement to Business Associate with respect to such PHI or ePHI. 2.6. Requests by the Secretary. Upon request by the Secretary, Business Associate agrees to make available to the Secretary Business Associate's Internal Material for use by the Secretary in determining whether Covered Entity or Business Associate is in compliance with the HIPAA Rules. Exhibit B to Subscription Agreement 21 20190227.v10.1