2023/11/29 Council Agenda Packet

4 b) Business Associate and its Representatives will provide adequate training to their respective workforces to ensure compliance with this Agreement and applicable law. c) Subject to the restrictions stated in Section 2(B)(1)(a) above and throughout this Agreement, Business Associate may use the information received from Covered Entity if necessary for (i) the proper management and administration of Business Associate; or (ii) to carry out the legal responsibilities of Business Associate. d) As between Business Associate and Covered Entity, all Plan confidential information, Confidential Personal Information and PHI will be and remain the sole property of Covered Entity or the Individual to whom the Confidential Personal Information or PHI relates, including any and all forms and copies of any such PHI developed or maintained by Business Associate or its Representatives. Neither Business Associate nor any of its Representatives will compile or distribute analyses to or for third parties using any PHI without Covered Entity’s express written consent. (2) Availability of Books and Records. Business Associate will permit Covered Entity and Secretary and other regulatory and accreditation authorities to audit Business Associate’s internal practices, books and records at reasonable times as they pertain to the use and disclosure of PHI received from, or created, maintained or received by Business Associate on behalf of, Covered Entity in order to ensure that Covered Entity and Business Associate are in compliance with the requirements of this Agreement and the HIPAA Rules or other applicable laws and regulations. Business Associate will cooperate in such audits and will provide copies of any documents reasonably requested by Covered Entity at no charge. (3) Access of Individuals to Information. a) Business Associate will, within five (5) days of a written request by Covered Entity or a request for information consistent with applicable law, make PHI about an Individual contained in a DRS available to the Covered Entity to enable Covered Entity to respond to a request by the Individual for access pursuant to 45 CFR § 164.524 or to the requesting Individual if the Business Associate receives the request directly. Business Associate will make available to Covered Entity such PHI for so long as such information is maintained in the DRS. b) If Business Associate maintains a DRS for Covered Entity that is not maintained by Covered Entity, it will permit an Individual to inspect or copy PHI about the Individual in that set as directed by Covered Entity to meet the requirements of 45 CFR § 164.524. If the PHI is in electronic format, the Individual will have a right to obtain a copy of such information in electronic format and, if the Individual chooses, to direct that an electronic copy be transmitted directly to an entity or person designated by the Individual in accordance with HITECH section 13405 (c). Under the HIPAA Rules the Covered Entity is required to take action on such requests as soon as possible, but not later than 30 days following receipt of the request. Business Associate will make reasonable efforts to assist Covered Entity in meeting this deadline. The information will be provided in the form or format requested if it is readily producible in such form or format; or in summary, if the Individual has agreed in advance to accept the information in summary form. A reasonable, cost-based fee for copying health information may be charged. If Covered Entity maintains the requested records, Covered Entity, rather than Business Associate will permit access according to its policies and procedures implementing the Privacy Rule.