98point6 10/2/19 - Laserfiche WebLink

2.7. Documentation of Disclosures. Business Associate agrees to document any disclosures of PHI as required under 45 CFR S 164.528 and to provide to Covered Entity, within 30 calendar days after receipt of a written request from Covered Entity, information related to such disclosures as is necessary for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR S 164.528. 2.8. Requests for Access by Individuals. Business Associate agrees to provide to Covered Entity, within 15 calendar days after receipt of a written request, all PHI that is part of a Designated Record Set as necessary for Covered Entity to respond to an Individual's request for access to PHI pursuant to 45 CFR S 164.524. If PHI subject to this Section 2.8 is maintained electronically, Business Associate will provide the PHI in the electronic form and format requested by Covered Entity, if it is readily producible in such form and format. If the PHI is not readily producible by Business Associate in the requested form and format, Business Associate wilt provide the PHI to Covered Entity in a readable electronic form as agreed by Covered Entity and Business Associate. 2.9. Incorporation of Amendments to PHI. Within 30 calendar days after receipt of written instructions from Covered Entity, Business Associate agrees to incorporate any amendment to PHI that is part of a Designated Record Set agreed to by Covered Entity pursuant to 45 CFR S 164.526. 2.10. Compliance with the Privacy Rule. To the extent that Business Associate has agreed to carry out any of Covered Entity's obligations under the Privacy Rule in the Service Agreement, Business Associate will comply with the requirements of the Privacy Rule that would apply to Covered Entity in the performance of such obligations. 3. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE 3.1. Performance of Services. Except as otherwise permitted or limited by this Agreement, Business Associate may use or disclose PHI to perform Services to or on behalf of Covered Entity, provided that such use or disclosure would not violate the HIPAA Rules if made by Covered Entity. 3.2. Use for Management and Administration; Legal Responsibilities. Business Associate may use PHI for the proper management and administration of Business Associate and to carry out the legal responsibilities of Business Associate. 3.3. Disclosure for Management and Administration: Legal Responsibilities. Business Associate may disclose PHI for the proper management and administration of Business Associate or to carry out Business Associate's legal responsibilities, provided that (a) such disclosures are Required by Law, or (b) Business Associate obtains reasonable assurances from the recipient of the PHI (I) that the PHI will remain confidential and will be used or further disclosed only as Required by Law or for the purpose for which it was disclosed to the recipient; and (ii) that the recipient will notify Business Associate of any instances of which the recipient is aware in which the confidentiality of the PHI has been breached. Any disclosure of PHI by Business Associate under this provision will not create a Subcontractor relationship with the entity to which the disclosure is made and Business Associate will not be required to obtain a business associate agreement with such entity. Exhibit B to Subscription Agreement 22 20190227.v10.1