Snohomish Health District 7/12/2021

extent that Business Associate will use or disclose PHI for Data Aggregation or management and administrative activities and legal responsibilities of Business Associate. 5, Security Restrictions on Business Associate. 5.1. General.Business Associate shall implement administrative,physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the EPHI that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity as required by the HIPAA Security Regulations. 5.2. Agents; Subcontractors. Business Associate will ensure that any agent, including a subcontractor, to whom Business Associate provides EPHI, agrees to implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity,and availability of such EPHI. 5.3. Reporting of Security Incidents. Business Associate shall report to Covered Entity in writing without unreasonable delay, but not later than five (5) business days, any Security Incident affecting EPHI created, received, maintained, accessed or transmitted by Business Associate on behalf of Covered Entity, of which Business Associate becomes aware. 5.4. HIPAA Security Regulations Compliance.Business Associate agrees to comply with Sections 164.306, 164.308, 164.310, 164.312, and 164.316 of Title 45, Code of Federal Regulations with respect to all EPHI. 6. Term and Termination. 6.1. Term. This Agreement shall take effect on Effective Date, and shall terminate when all of the PHI disclosed to Business Associate by Covered Entity or created or received by Business Associate on behalf of Covered Entity, is destroyed according to applicable records retention guidelines or returned to Covered Entity, or, if it is infeasible to return or destroy PHI in accordance with applicable records retention guidelines, protections are extended to such information, in accordance with the termination provisions in this Section 6. 6.2. Termination for Cause. If Covered Entity determines that Business Associate has breached a material term of this Agreement, Covered Entity will provide written notice to Business Associate that sets forth Covered Entity's determination that Business Associate breached a material terms of this Agreement,and Covered Entity may: 6.2.1. Provide written notice to Business Associate that provides an opportunity for Business Associate to cure the breach or end the violation, as applicable. If Business Associate does not cure the breach or end the violation within the time specified by Covered Entity, then Covered Entity may immediately thereafter terminate this Agreement; or 6.2.2. Immediately terminate this Agreement if Business Associate has breached a material term of this Agreement and cure is not possible 6.2.3. If neither termination nor cure is feasible as provided in Section 6,2.1 and 6,2.2 of this Agreement,Covered Entity will report the violation to the Secretary. Page 6 of 9