Agmt21 Animal Control Agreement Between San Mateo County and Cities

Browse Search

50 Attachment H Health Insurance Portability and Accountability Act (HIPAA) Business Associate Requirements I. DEFINITIONS Terms used, but not otherwise defined, in this Schedule shall have the same meaning as those terms are defined in 45 Code of Federal Regulations (CFR) sections 160.103, 164.304, and 164.501. All regulatory references in this Schedule are to Title 45 of the Code of Federal Regulations unless otherwise specified. a. Business Associate. “Business Associate" shall generally have the same meaning as the term "business associate" at 45 CFR 160.103, and in reference to the parties to this agreement shall mean Contractor. b. Covered Entity. "Covered entity" shall generally have the same meaning as the term “covered entity” at 45 CFR 160.103, and in reference to the party to this agreem ent shall mean County. c. HIPAA Rules. "HIPAA rules" shall mean the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR part 160 and part 164, as amended and supplemented by Subtitle D of the Health Information Technology for Economic and Clinical Health Act provisions of the American Recovery and Reinvestment Act of 2009. d. Designated Record Set. "Designated Record Set" shall have the same meaning as the term "designated record set" in Section 164.501. e. Electronic Protected Health Information. "Electronic Protected Health Information" (EPHI) means individually identifiable health information that is transmitted or maintained in electronic media; it is limited to the information created, received, maintained or transmitted by Business Associate from or on behalf of Covered Entity. f. Individual. "Individual" shall have the same meaning as the term "individual" in Section 164.501 and shall include a person who qualifies as a personal representative in accordance with Section 164.502(g). g. Privacy Rule. "Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR Part 160 and Part 164, Subparts A and E. h. Protected Health Information. "Protected Health Information" (PHI) shall have the same meaning as the term "protected health information" in Section 164.503 and is limited to the information created or received by Business Associate from or on behalf of County. i. Required By Law. "Required by law" shall have the same meaning as the term "required by law" in Section 164.501. j. Secretary. "Secretary" shall mean the Secretary of the United States Department of Health and Human Services or his or her designee. k. Breach. The acquisition, access, use, or disclosure of PHI in violation of the Privacy Rule that compromises the security or privacy of the PHI and subject to the exclusions set forth in Section 164.402. Unless an exception applies, an impermissible use or disclosure of PHI is presumed to be a breach, unless it can be demonstrated there is a low probability that the PHI has been compromised based upon, at minimum, a four-part risk assessment: 1. Nature and extent of PHI included, identifiers and likelihood of re-identification; 2. Identity of the unauthorized person or to whom impermissible disclosure was made; 3. Whether PHI was actually viewed or only the opportunity to do so existed; 4. The extent to which the risk has been mitigated. l. Security Rule. "Security Rule" shall mean the Security Standards for the Protection of Electronic Protected Health Information at 45 CFR Part 160 and Part 164, Subparts A and C. DocuSign Envelope ID: 6C491BB9-BC86-4B49-A708-70DFC750A9BD