Laserfiche WebLink
maintain an accounting. Business Associate shall include in the accounting: (a) the date of the <br /> disclosure; (b)the name, and address if known, of the entity or person who received the PHI; (c) <br /> a brief description of the PHI disclosed; and(d)a brief statement of the purpose of the disclosure. <br /> For each disclosure that requires an accounting under this Section, Business Associate shall <br /> document the information specified in (a) through (d), above, and shall securely retain this <br /> documentation for six(6)years from the date of the disclosure. <br /> c) If an individual requests an accounting of Disclosures directly from <br /> Business Associate, Business Associate will forward the request to Providence within two (2) <br /> business days of Business Associate's receipt of the request, and will make its records of <br /> disclosures available to Providence as otherwise provided in this Section. Providence will be <br /> responsible to prepare and deliver the records of disclosure to the individual. Business Associate <br /> will not provide an accounting of its Disclosure directly to the individual. <br /> d) The provisions of this Section shall survive the termination of this <br /> Agreement. <br /> 6. Disclosures to Third Parties <br /> a) Business Associate shall require each director, officer, subcontractor, <br /> workforce member, affiliate, agent, and representative that has or will have access to PHI,which <br /> is received from, created or received, maintained or transmitted by,Business Associate on behalf <br /> of Providence, to be bound by substantially similar restrictions, terms, and conditions that apply <br /> to Business Associate pursuant to the Agreement with respect to such PHI. Business Associate <br /> shall incorporate this requirement in writing into any agreement between Business Associate and <br /> any of its subcontractors in the form of a business associate agreement. Providence reserves the <br /> right to review documentation and other evidence of compliance with this requirement. <br /> b) Business Associate shall also (i) obtain reasonable assurances from the <br /> person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed <br /> only as required by law or for the purpose for which it was disclosed and(ii) obligate such person <br /> to notify Business Associate of any instances of which it is aware in which the confidentiality of <br /> the PHI has been Breached. <br /> 7. Breaches <br /> a) Unless state law requires otherwise, in the event of a Breach, a security <br /> incident, or any unauthorized or improper use or disclosure of any unsecured PHI that Business <br /> Associate accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds or <br /> uses on behalf of Providence, Business Associate shall report such Breach to Providence without <br /> unreasonable delay, but in no event more than thirty(30) days after discovering the Breach to the <br /> Business Associate Breach Reporting.Hotline at 877-512-7119. The parties acknowledge and <br /> agree that this Section 7(a) constitutes notice by Business Associate to Providence of the ongoing <br /> existence and occurrence or attempts of unsuccessful security incidents for which no additional <br /> notice to Providence shall be required. "Unsuccessful security incidents" means, without <br /> limitation, pings and other broadcast attacks on Business Associate's firewall, port scans, <br /> 4 <br />