Laserfiche WebLink
12 <br />(vii)Right to Request Restrictions on the Disclosure of PHI and Confidential <br />Communications. If an individual submits a Request for Restriction or Request for <br />Confidential Communications to the Business Associate, Business Associate and <br />Covered Entity agree that Business Associate, on behalf of Covered Entity, shall <br />evaluate and respond to these requests according to Business Associate’s own <br />procedures for such requests. <br />(viii)Return or Destruction of PHI. Upon the termination or expiration of the <br />Agreement or this BAA, Business Associate agrees to return the PHI to Covered <br />Entity, destroy the PHI (and retain no copies), or if Business Associate determines <br />that return or destruction of the PHI is not feasible, (a) continue to extend the <br />protections of this BAA and of the HIPAA Requirements to the PHI, and (b) limit any <br />further uses and disclosures of the PHI to the purpose making return or destruction <br />infeasible. <br />(ix)Availability of Books and Records. Business Associate shall make <br />available to HHS or its agents the Business Associate’s internal practices, books, and <br />records relating to the use and disclosure of PHI in connection with this BAA. <br />(x)Termination for Breach. <br />a.Business Associate agrees that Covered Entity shall have the right <br />to terminate this BAA or seek other remedies if Business Associate violates a <br />material term of this Agreement. <br />b.Covered Entity agrees that Business Associate shall have the right <br />to terminate this BAA or seek other remedies if Covered Entity violates a <br />material term of this BAA. <br />(c)Security Incident and Breach Reporting. <br />(i)Business Associate shall Report to Covered Entity any unauthorized <br />access, use, disclosure, modification, or destruction of PHI (including Electronic PHI) <br />not permitted by this BAA, applicable law, or permitted by Covered Entity in writing <br />(“Successful Security Incidents” or “Breaches”) of which Business Associate <br />becomes aware. Business Associate shall report such Successful Security Incidents <br />or Breaches to Covered Entity as specified in this Agreement. <br />(ii)For Security Incidents that do not result in unauthorized access, use, <br />disclosure, modification, or destruction of PHI (including, for purposes of example <br />and not for purposes of limitation, pings on Business Associate’s firewall, port <br />scans, attempts to log onto a system or enter a database with an invalid password <br />or username, denial-of-service attacks that do not result in the system being taken <br />off-line, or malware such as worms or viruses) (hereinafter “Unsuccessful Security