Agmt23 Navia Benefit Solutions - Laserfiche WebLink

Browse Search

REV:01-20-23 MI 1.12. Secretary. “Secretary” shall mean the U.S. Secretary of the Department of Health and Human Services or his or her designee. 1.13. Security Incident. “Security Incident” shall have the same meaning as the term “security incident” in 45 CFR 164.304. 1.14. Security Rule. “Security Rule” shall mean the Security Standards and Implementation Specifications at 45 CFR Part 160 and Part 164, subparts A and C. 1.15. Standards for Electronic Transactions Rule. “Standards for Electronic Transactions Rule” means the final regulations issued by HHS concerning standard transactions and code sets under the Administration Simplification provisions of HIPAA, 45 CFR Part 160 and Part 162. 1.16. Subcontractor. “Subcontractor” shall have the same meaning as the term “subcontractor” in 45 CFR 160.103. 1.17. Unsecured Protected Health Information. “Unsecured Protected Health Information” shall have the same meaning given the term “unsecured protected health information” in 45 CFR 164.402. 2. Obligations and Activities of Business Associate 2.1. Business Associate agrees to not use or disclose PHI other than as permitted or required by this Agreement or as Required by Law. 2.2. Business Associate agrees to take reasonable efforts to limit its use and disclosure of, and requests for, PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request. The foregoing minimum necessary standard does not apply to: 1) disclosures or requests by a health care provider for treatment purposes; (2) disclosures to the Individual who is the subject of the information; (3) uses or disclosures made pursuant to an Individual’s authorization; (4) uses or disclosures required for compliance with HIPAA; (5) disclosures to HHS when disclosure of information is required under the Privacy Rule for enforcement purposes; (6) uses or disclosures that are required by other law. 2.3. Business Associate agrees to develop, implement, maintain, and use appropriate administrative, technical, and physical safeguards to protect the privacy of PHI and comply with applicable requirements under the Security Rule. 2.4. Business Associate shall notify Covered Entity of any Breach of Unsecured PHI of which it becomes aware. Such notice shall include, to the extent possible, the information listed in Section 2.6. A Breach shall be treated as discovered as of the first day on which such Breach is known, or by exercising reasonable diligence would have been known, to any person, other than the individual committing the Breach, who is an employee, officer, or other agent of Business Associate. 2.5. Notice shall be made without unreasonable delay and in no case later than sixty (60) calendar days after the discovery of a Breach by Business Associate. 2.6. Notice of a Breach shall include, to the extent possible the following: 2.6.1. Identification of each individual whose Unsecured PHI has been or is reasonably believed to have been accessed, acquired, used, or disclosed as a result of the breach. 2.6.2. A brief description of what happened, including the date of the Breach and the date of the discovery of the Breach, if known. 2.6.3. A description of the types of Unsecured PHI that were involved in the Breach (such as full name, Social Security number, date of birth, home address, or account number). 2.6.4. The steps Individuals should take to protect themselves from potential harm resulting from the Breach. ATTY/AGR.2023.010/Navia Benefit Solutions (Navia Services (Dental HRA) 2023) (Page 37 of 42)