ESO Solutions, Inc. 12/8/2016 - Laserfiche WebLink

3.1 Subject to any limitations in this Agreement, Vendor may disclose PHI to any third party as necessary to perform its obligations under the Business Arrangements and as permitted or required by applicable law. Vendor agrees not to disclose PHI in a manner that would violate the Confidentiality Requirements if the PHI was disclosed by the Covered Entity in the same manner. Further, Vendor may disclose PHI for the proper management and administration of Vendor; provided that:(i)such disclosures are required by law; or(ii)Vendor:(a)obtains reasonable assurances from any third • party to whom the PHI is disclosed that the PHI will be held confidential and used and disclosed only as required by law or for the purpose for which it was disclosed to third party,and(b)requires the third party to agree to immediately notify Vendor of any instances of which it is aware that PHI is being used or disclosed for a purpose that is not otherwise • provided for in this Agreement or for a purpose not expressly permitted by the Confidentiality Requirements. Vendor shall report to Covered Entity any use or disclosure of PHI not permitted by this Agreement of which it becomes aware. Such report shall be made within five(5)business days of Vendor becoming aware of such use or disclosure. 3.2 If Vendor uses or contracts with any agent,including a subcontractor(collectively"Subcontractors")that uses,discloses, accesses, creates, receives, maintains or transmits PHI on behalf of Vendor, Vendor shall require all Subcontractors to agree in writing to the same restrictions and conditions that apply to Vendor under this Agreement. In addition to Vendor's obligations under Section 9, Vendor agrees to mitigate, to the extent practical and unless otherwise requested by the Covered Entity, any harmful effect that is known to Vendor and is the result of a use or disclosure of PHI by Vendor or any Subcontractor in violation of this Agreement. Additionally, Vendor shall ensure that all disclosures of PHI by Vendor and its Subcontractors comply with the principle of"minimum necessary use and disclosure,"(i.e., in accordance with 45 C.F.R.§164.502(b),only the minimum PHI that is necessary to accomplish the intended purpose may be disclosed). 4. Individual Rights Regarding Designated Record Sets. If Vendor maintains a Designated Record Set on behalf of Covered Entity,Vendor shall:(i)provide access to and permit inspection and copying of PHI by Covered Entity under conditions and limitations required under 45 C.F.R. §I64.524,as it may be amended from time to time;and(ii)amend PHI maintained by Vendor as required by Covered Entity. Vendor shall respond to any request from Covered Entity for access by an individual within ten(10)business days of such request and shall make any amendment requested by Covered Entity within twenty(20)business days of such request. Any information requested under this Section 4 shall be provided in a form or format requested.if it is readily producible in such form or format. Vendor may charge a reasonable fee based upon Vendor's labor costs in responding to a request.for electronic information(or a cost-based fee for the production of non-electronic media copies). Vendor shall notify Covered Entity within ten(10)business days of receipt of any request for access or amendment by an individual. 5. Accounting of Disclosures. Vendor shall make available to Covered Entity within ten (10) business days of a request by Covered Entity the information required for an accounting of disclosures of PHI in accordance with 45 C.F.R. §164.528(or such shorter time as may be required by state or federal law). Such accounting must be provided without cost if it is the first accounting requested within any twelve(12)month period. For subsequent accountings within the same twelve(12)month period,Vendor may charge a reasonable fee based upon Vendor's labor costs in responding to a request for electronic information(or a cost-based fee for the production of non-electronic media copies)only after Vendor informs Covered Entity and Covered Entity informs the individual in advance of the fee, and the individual is afforded an opportunity to withdraw or modify the request. Such accounting obligations shall survive termination or expiration of this Agreement and with respect to any disclosure,whether on or before the termination of this Agreement,shall continue for a minimum of seven(7)years following the date of such disclosure. 6. Withdrawal of Authorization. If the use or disclosure of PHI under this Agreement is based upon an individual's specific authorization regarding the use of his or her PHI, and: (i) the individual revokes such authorization in writing; (ii)the effective date of such authorization has expired; or(iii) the authorization is found to be defective in any manner that renders it invalid for whatever reason,then Vendor agrees, if it has received notice from Covered Entity of such revocation or invalidity, to cease the use and disclosure of any such individual's PHI except to the extent Vendor has relied on such use or disclosure,or where an exception under the Confidentiality Requirements expressly applies. 7. Records and Audit. Vendor shall make available to HHS or its agents its internal practices,books,and records relating to the compliance of Vendor and Covered:Entity with the Confidentiality Requirements, such internal practices, books and records to be provided in the time and manner designated by HHS or its agents. 8. Implementation of Security Standards;Notice of Security Incidents. Vendor will comply with the Security Standards and, by way of example and not limitation,use appropriate safeguards to prevent the use or disclosure of PHI other than as expressly permitted under this Agreement. In accordance with the Security Standards,Vendor will implement administrative,physical,and technical safeguards that protect the confidentiality, integrity and availability of the PHI that it uses, ESO Solutions,Inc. Subscription Agreement 092214 Page 10 of 13