2023/11/29 Council Agenda Packet

5 c) Any denial of access to PHI determined by Covered Entity pursuant to 45 CFR § 164.524, and conveyed to Business Associate by Covered Entity, will be the responsibility of Covered Entity, including resolution or reporting of all appeals or complaints arising from denials. d) Business Associate will support Covered Entity in a manner that enables Covered Entity to meet its obligations under 45 CFR § 164.524. (4) Amendment of Information. If Business Associate maintains PHI in a Designated Record Set, Business Associate will make amendments to PHI at the request and direction of Covered Entity pursuant to 45 CFR 164.526. If Business Associate maintains a record in a Designated Record Set that is not also maintained by Covered Entity, Business Associate will accommodate an Individual’s request to amend PHI only in conjunction with a determination by Covered Entity that the amendment is appropriate according to 45 CFR § 164.526. (5) Accounting of Permitted Disclosures. a) Disclosure Accounting. To allow Covered Entity to meet its disclosure accounting obligations under 45 CFR § 164.528: (i) Disclosures Subject to Accounting. Business Associate will record the information specified below (“Disclosure Information”) for each disclosure of PHI, not exempt from disclosure accounting as specified below, that Business Associate makes to Covered Entity or to a third party. (ii) Disclosures Not Subject to Accounting. Business Associate will not be obligated to record Disclosure Information or otherwise account for disclosures of PHI if the Covered Entity is not Required By Law to account for such disclosures. b) Disclosure Information. With respect to any disclosure by Business Associate of PHI that is not exempt from disclosure accounting, Business Associate will record the following Disclosure Information as applicable to the type of accountable disclosure made: (i) Disclosure Information Generally. Except for repetitive disclosures of PHI as specified below, the Disclosure Information that Business Associate must record for each accountable disclosure is (i) the disclosure date, (ii) the name and (if known) address of the entity or Individual to which Business Associate made the disclosure, (iii) a brief description of the PHI disclosed, and (iv) a brief statement of the purpose of the disclosure. (ii) Disclosure Information for Repetitive Disclosures. For repetitive disclosures of PHI that Business Associate makes for a single purpose to the same person or entity (including Covered Entity), the Disclosure Information that Business Associate must record is either the Disclosure Information specified above for each accountable disclosure, or (i) the Disclosure Information specified above for the first of the repetitive accountable disclosures; (ii) the frequency, interval, or number of the repetitive accountable disclosures; and (iii) the date of the last of the repetitive accountable disclosures.