BMI Audit Services LLC 2/22/2019

ar BIM Audit Services 3.6 Delegation of Covered Entity's Duties. To the extent Business Associate is to carry out Covered Entity's obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule in performance of such obligations. 3.7 Access to Networks. Business Associate agrees that while present at any Covered Entity facility and/or when accessing the Covered Entity's computer network(s), it and all of its employees, agents, representatives and subcontractors shall at all times comply with any network access and other security practices, procedures and/or policies established by the Covered Entity including,without limitation,those established pursuant to HIPAA's Security Rules. 3.8 Reporting. Business Associate shall provide Covered Entity with information regarding all unauthorized uses and disclosures of PHI by Business Associate, its employees or subcontractors not permitted by this Agreement and of which it becomes aware, including Breaches of Unsecured PHI as required by the Breach Notification Rule, and the remedial action taken or proposed to be taken with respect to such prohibited use or disclosure. 3.9 Mitigation. Business Associate shall mitigate,to the extent practicable,any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Agreement. 3.10 Access to PHI. Business Associate shall, at the request of Covered Entity, provide PHI in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an individual in order to meet the requirements of an individual's right of access and requests for access to his or her PHI. If the PHI is maintained electronically and the individual requests an electronic copy,the Business Associate must provide the PHI in the form and format requested if readily producible, or, if not, in a readable electronic form and format as agreed to by the Business Associate and individual. 3.11 Accounting of Disclosures. Business Associate shall document such disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an individual for an accounting of disclosures of PHI; and provide to Covered Entity or an individual, information collected in accordance with this Agreement, to permit Covered Entity to respond to a request by an individual for an accounting of disclosures of PHI by providing the requested documentation of disclosures promptly to Covered Entity. If it is determined that the Business Associate maintains an electronic health record as defined by the HITECH Act,the Business Associate will,in addition to documenting disclosures for purposes other than for treatment,payment,or health care operations,document disclosures for the purposes of treatment,payment,or health care operations in accordance with the provisions of the HITECH Act. 3.12 Amendment to PHI. Business Associate shall make any amendment(s) to PHI in a Designated Record Set that Covered Entity directs or agrees to at the request of Covered Entity or an individual,and in the time and manner designated by Covered Entity. 3.13 Unauthorized Uses and Disclosures. In the event Business Associate becomes aware of a Security Incident involving EPHI, by itself or any of its agents or subcontractors, Business Associate shall promptly notify Covered Entity, in writing, of such Security Incident. For any Business Associate Agreement 4