2025/04/09 Council Agenda Packet

12 (vii) Right to Request Restrictions on the Disclosure of PHI and Confidential Communications. If an individual submits a Request for Restriction or Request for Confidential Communications to the Business Associate, Business Associate and Covered Entity agree that Business Associate, on behalf of Covered Entity, shall evaluate and respond to these requests according to Business Associate’s own procedures for such requests. (viii) Return or Destruction of PHI. Upon the termination or expiration of the Agreement or this BAA, Business Associate agrees to return the PHI to Covered Entity, destroy the PHI (and retain no copies), or if Business Associate determines that return or destruction of the PHI is not feasible, (a) continue to extend the protections of this BAA and of the HIPAA Requirements to the PHI, and (b) limit any further uses and disclosures of the PHI to the purpose making return or destruction infeasible. (ix) Availability of Books and Records. Business Associate shall make available to HHS or its agents the Business Associate’s internal practices, books, and records relating to the use and disclosure of PHI in connection with this BAA. (x) Termination for Breach. a. Business Associate agrees that Covered Entity shall have the right to terminate this BAA or seek other remedies if Business Associate violates a material term of this Agreement. b. Covered Entity agrees that Business Associate shall have the right to terminate this BAA or seek other remedies if Covered Entity violates a material term of this BAA. (c) Security Incident and Breach Reporting. (i) Business Associate shall Report to Covered Entity any unauthorized access, use, disclosure, modification, or destruction of PHI (including Electronic PHI) not permitted by this BAA, applicable law, or permitted by Covered Entity in writing (“Successful Security Incidents” or “Breaches”) of which Business Associate becomes aware. Business Associate shall report such Successful Security Incidents or Breaches to Covered Entity as specified in this Agreement. (ii) For Security Incidents that do not result in unauthorized access, use, disclosure, modification, or destruction of PHI (including, for purposes of example and not for purposes of limitation, pings on Business Associate’s firewall, port scans, attempts to log onto a system or enter a database with an invalid password or username, denial-of-service attacks that do not result in the system being taken off-line, or malware such as worms or viruses) (hereinafter “Unsuccessful Security