24-15 emsCharts Agreement.pdf

j. Requests for Accountings. Business Associate agrees to provide to Covered Entity or an Individual, in the time and manner designated by the Covered Entity, information collected in accordance with Section 2). of this Addendum, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with HIPAA, HIPAA Regulations and the HITECH Act. If an Individual makes a request for an accounting directly 1o Business Associate, Business Associate shall notify Covered Entity of the request within three business (3) days of such request and will cooperate with Covered Entity and allow Covered Entity to send the response to the Individual. 3. Permitted Uses and Disclosures by Business Associate. a. Services Agreement. Except as otherwise limited in this Addendum, Business Associate may use or disclose Protected Health Information to perform functions, activities, or services for, or on behalf of, Covered Entity as specified in the Services Agreement, provided that such use or disclosure would not violate the HIPAA, HIPAA Regulations or the HITECH Act if done by Covered Entity or the minimum necessary policies and procedures of the Covered Entity. b. Use for Administration of Business Associate. Except as otherwise limited in this Addendum, Business Associate may use Protected Health Information for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. ©. Disclosure for Administration of Business Associate. Except as otherwise limited in this Addendum, Business Associate may disclose Protected Health Information for the proper management and administration of the Business Associate, provided that disclosures are Required by Law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as Required by Law or for the purpose for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached. da Reporting Violations of Law. Business Associate may use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent

rmation has been breached. da Reporting Violations of Law. Business Associate may use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent with § 164.502(j)(1); provided, however, that Business Associate gives Covered Entity at least thirty (30) days prior written notice of its intention to report any such violation of law and the facts or circumstances related thereto. 4, Permissible Requests by Covered Entity a. Except as set forth in Section 3 of this Addendum, Covered Entity shall not request Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under the Privacy Rule if done by Covered Entity. 5. Term and Termination a Term. The term of this Addendum shall be co-terminus with the Services Agreement. However, the provisions of this Addendum shall continue until all of the Protected Health Information provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or, if it is infeasible to return or destroy Protected Health Information, protections are extended to such information, in accordance with the termination provisions in this Section. emsCharts Service Agreement, v12.3 Page 17 of 19