2021/06/30 Council Agenda Packet

accordance with 45 C.F.R. § 164.524. Business Associate will provide such PHI in an electronic format upon request by Covered Entity unless it is not readily producible in such format in which case Business Associate will provide Covered Entity a readable electronic format as agreed to by Covered entity and Individual. 3.7. Compliance with Requirements. To the extent Business Associate is to carry out Covered Entity's obligation under HIPAA, Business Associate will comply with the requirement applicable to such obligation. 3.8. Amendment of PHI. Where PHI held by Business Associate is contained in a Designated Record Set, within fifteen (15) days of receiving a written request from Covered Entity or an Individual, Business Associate will make any requested amendment(s) or correction(s) to PHI in accordance with 45 C.F.R. § 164.526. 3.9. Disclosure Documentation. Business Associate will document its disclosure of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with C.F.R. § 164.528. 3.10. Accounting of Disclosures. Within thirty (30) days of receiving a request from Covered Entity, Business Associate will provide to Covered Entity information collected in accordance with Section 3.8 of this Agreement, as necessary to permit Covered Entity to make an accounting of disclosures of PHI about an Individual in accordance with 45 C.F.R. § 164.528. 3.11. Access to Business Associate's Internal Practices. Business Associate will make its internal practices, books, and records, including policies and procedures and PHI, relating to the use and disclosure of PHI, including EPHI, created, used, disclosed, received, maintained, accessed, or transmitted by Business Associate on behalf of Covered Entity, available to the Secretary or to Covered Entity, in a time and manner designated by the Secretary or reasonably specified by Covered Entity, for purposes of the Secretary determining Business Associate or Covered Entity's compliance with the HIPAA Privacy Regulations and HIPAA Security Regulations. 3.12. Breach Notification. Business Associate, following the discovery of a Breach of Unsecured Protected Health Information, shall notify Covered Entity of such Breach. Except as otherwise required by law, Business Associate shall provide such notice in writing without unreasonable delay, and in no case later than ten (10) calendar days after discovery of the Breach. 3.12.1. Notice to Covered Entity required by this Section 3.12 shall include (i) to the extent possible, the names of the individual(s) whose Unsecured Protected Health Information has been, or is reasonably believed by Business Associate to have been accessed, acquired, used or disclosed during the Breach; (ii) a brief description of what happened including the date of the Breach and the date of the discovery of the Breach, if known; (iii) a description of the types of Unsecured Protected Health Information that were involved in the Breach; (iv) a brief description of what Business Associate is doing or will be doing to investigate the Breach to mitigate harm to the individual(s) and to protect against further Breaches; and (v) any other information that Covered Page 4 of 9