2023/11/29 Council Agenda Packet

6 c) Availability of Disclosure Information. Business Associate will maintain the Disclosure Information for at least six (6) years following the date of the accountable disclosure to which the Disclosure Information relates (three (3) years for disclosures related to an Electronic Health Record, starting with the date specified by the Department of Health and Human Services (HHS)). Business Associate will make the Disclosure Information available to Covered Entity within fifteen (15) calendar days following Covered Entity’s request for such Disclosure Information to comply with an Individual’s request for disclosure accounting. Effective as of the date specified by HHS with respect to disclosures related to an Electronic Health Record, Business Associate will provide the accounting directly to an Individual making such a disclosure request, if a direct response is requested by the Individual. d) Business Associate will support Covered Entity in a manner that enables Covered Entity to meet its obligations under 45 CFR § 164.528 as soon as practicable, but not later than sixty (60) days. (6) Compliance with Electronic Transactions Rule. a) If Business Associate conducts in whole or in part electronic transactions on behalf of Covered Entity for which HHS has established standards, Business Associate will comply, and will require any Representatives it involves with the conduct of such transactions to comply, with each applicable requirement of the Electronic Transactions Rule. Business Associate will also comply with the National Provider Identifier requirements, if and to the extent applicable. (7) De-identified Information. Business Associate may use and disclose de-identified health information only with the prior written approval from the Covered Entity, and only if the PHI is de-identified in compliance with the HIPAA Rules. Moreover, Business Associate will review and comply with the requirements of this Agreement. (8) Notice of Privacy Practices. Business Associate will abide by the limitations of Covered Entity’s Notice of Privacy Practices, of which it has knowledge. Any use or disclosure permitted by this Agreement may be amended by changes to Covered Entity’s Notice of Privacy Practices; provided, however, that the amended Notice of Privacy Practice will not affect permitted uses and disclosures on which Business Associate relied prior to receiving notice of such amended Notice of Privacy Practice. (9) Withdrawal of Authorization. If the use or disclosure of PHI under this Agreement is based upon an Individual’s specific authorization for the use or disclosure of his or her PHI, and the Individual revokes such authorization, the effective date of such authorization has expired, or such authorization is found to be defective in any manner that renders it invalid, Business Associate will, if it has notice of such revocation, expiration, or invalidity, cease the use and disclosure of the Individual’s PHI except to the extent it has relied on such use or disclosure, or if an exception under the HIPAA Rules expressly applies. (10) Knowledge of HIPAA Rules. Business Associate will review and understand the HIPAA Rules as it applies to Business Associate, and to comply with the applicable requirements of the HIPAA Rules, as well as any applicable amendments.