Vera Whole Health 6/7/2019 - Laserfiche WebLink

Business Associate agrees not to Use or further Disclose PHI other than as permitted or required by this Agreement, or as required by law. 2.2 Adequate Safeguards for PHI. Business Associate warrants that it shall implement and maintain appropriate safeguards to prevent the Use or Disclosure of PHI in any manner other than as permitted by this Agreement. 2.3 Adequate Safeguards for EPHI. Business Associate warrants that it shall implement and maintain administrative,physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of any electronic protected health information("EPHI")that it creates, receives, maintains, or transmits on behalf of the Covered Entity. 2.4 Reporting Non-Permitted Use or Disclosure. Business Associate shall within five business days in writing notify Covered Entity's Privacy Official or Director of Human Resources of each Use or Disclosure of PHI, of which Business Associate becomes aware (other than Security Incidents, covered under the terms set forth below),that is made by Business Associate, its employees,representatives, agents or subcontractors that is not specifically permitted by this Agreement or by law. In addition, Business Associate shall report to the Covered Entity any Security Incident of which it becomes aware as follows: a)reports of successful unauthorized access shall be made within five business days; and b)reports of attempted unauthorized access shall be made in a reasonable time and manner considering the nature of the information to be reported and subject to mutual agreement of the parties. 2.5 Availability of Internal Practices, Books and Records to Government Agencies. Business Associate agrees to make its internal practices, books and records relating to the Use and Disclosure of PHI available to the Secretary of the federal Department of Health and Human Services for purposes of determining Covered Entity's compliance with the Privacy Regulations and Security Regulations. Business Associate shall immediately notify Covered Entity of any requests made by the Secretary and provide Covered Entity with copies of any documents produced in response to such request, if allowed by law to do so. 2.6 Access to and Amendment of PHI and Accounting of Disclosures. Business Associate agrees to make available PHI (a) as required by 45 CFR Section 164.524; (b) for amendment and incorporate any amendments to PHI as required by 45 CFR Section 164.526; and(c)to provide an accounting of disclosures as required by 45 CFR Section 164.528, and to the extent applicable Section 13405(c)of Title XII, Subtitle D of the Health Information Technology for Economic and Clinical Health("HITECH")Act, codified at 42 U.S.C. §17932. 2.7 Privacy-Related Services Regarding Requests by Individuals. Upon receipt, Covered Entity shall, no later than five(5) business days following receipt of a request,provide notice to and forward any and all individual requests received pursuant to 45 CFR Sections 164.522, 164.524, 164.526 or 164.528 (collectively referred to as the "Requests") to Business Associate at its last known address. Schedule 4, Page 2