Benefit Plans Administrative Services 12/26/2018

17IPa `ge with the provisions of the Privacy Rule, as amended by Section 13405(b) of the HITECH Act. Business Associate shall not use or disclose Protected Health Information that is genetic information for underwriting purposes, as set forth in the regulations issued pursuant to Section 105 of the Genetic Nondiscrimination Act of 2008. Business Associate will comply with all provisions of GINA as are applicable to Covered Entity. b. Safeguards. Business Associate agrees to use administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of Protected Health Information, in electronic or any other form, that it creates, receives, maintains or transmits under this Agreement, in accordance with the Privacy Rule and the Security Rule to prevent the use or disclosure of Protected Health Information other than as provided for by this Agreement. Business Associate shall fully comply with the Security Rule with regard to electronic Protected Health Information. c. Reporting of Improper Use or Disclosure. Business Associate agrees to report to Covered Entity of the discovery of any use or disclosure of Protected Health Information not provided for by this Agreement of which it becomes aware, including a Breach of Unsecured Protected Health Information as required by 45 CFR 164.410. Business Associate shall also report any Security Incident of which it becomes aware to Covered Entity. The term "Security Incident" shall not include inconsequential incidents that occur on a daily basis, such as scans, "pings" or other unsuccessful attempts to penetrate computer networks or servers containing electronic Protected Health Information. d. Mitigation. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. e. Agents and Subcontractors. Business Associate agrees to require that any agents or subcontractors that create, receive, maintain or transmit Protected Health Information on behalf of Business Associate in relation to Covered Entity agree in writing (in the form of a business associate contract) to at least as restrictive conditions and requirements that apply through this Agreement to Business Associate with respect to such information, including the implementation of reasonable and appropriate measures for safeguarding Protected Health Information. f. Access to Individuals. Business Associate agrees to provide access to Protected Health Information in a Designated Record Set, to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR Section 164.524. Further, if an Individual requests a copy of Protected Health Information in a specific electronic format, Business Associate shall comply with such request, if readily producible, in accordance with the requirements of 45 CFR Section 164.524. g. Amendments to Protected Health Information. Business Associate agrees to make any reasonable amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR Section 164.526 at the request of Covered Entity or an Individual. h. Access by Covered Entity. Business Associate agrees to make internal practices, books and records including policies and procedures and Protected Health Information, relating to the use and disclosure of Protected Health Information received from, or created or received by Business VEBA Administrative Service Agreement (405512)