Sample Business Associate Agreement - Agreement With Business Associate (Page 2 of 5) in pdf

comply with the same privacy, security, and other obligations as Business Associate with respect to

such PHI.

5. Compliance with Standard Transactions. If Business Associate conducts Standard Transactions

(45 C.F.R. Parts 160 and 162) with or on behalf of Group Health Plan, Business Associate will comply

will require any subcontractor or agent involved with the conduct of such Standard Transactions to

comply, with each applicable requirement of 45 C.F.R. Part 162. Business Associate agrees to

demonstrate compliance with the Transactions by allowing Group Health Plan to test the

Transactions and content requirements upon a mutually agreeable date. Business Associate will not

enter into, or permit its subcontractors or agents to enter into, any trading partner agreement in

connection with the conduct of Standard Transactions for or on behalf of Group Health Plan that:

a) Changes the definition, data condition, or use of a data element or segment in a Standard

Transaction;

b) Adds any data elements or segments to the maximum defined data set;

c) Uses any code or data element that is marked “not used” in the Standard Transaction’s

implementation specification or is not in the Standard Transaction’s implementation specification;

d) Changes the meaning or intent of the Standard Transaction’s implementation specification.

6. Security of Electronic Protected Health Information: If Business Associate receives or maintains

Electronic Protected Health Information, Business Associate will comply (and will require any

subcontractor or agent that receives or maintains such Electronic Protected Health Information to

comply) with the following in addition to all other provisions of this Addendum:

a) Business Associate shall require its agents and subcontractors to provide data security for all

Electronic Protected Health Information.

b) Business Associate shall implement and maintain, and shall require its agents and subcontractors

to implement and maintain, reasonable administrative, technical and physical safeguards to

protect the security, integrity and confidentiality of Electronic Protected Health Information.

7. Protected Health Information Access, Amendment and Disclosure Accounting.

a) Access. Business Associate (and any subcontractor or agent) will promptly, upon Group Health

Plan’s request, make available to Group Health Plan or, at Group Health Plan’s direction, to the

individual (or the individual’s personal representative) for inspection and obtaining copies of any

PHI about the individual which Business Associate created for or received from Group Health

Plan and that is in Business Associate’s custody or control, so that Group Health Plan may meet

its access obligations under 45 C.F.R. § 164.524.

b) Amendment. Business Associate will accept requests for access to or copies of PHI forwarded

from Group Health Plan or received from an individual (or the individual’s personal

representative) directly. Business Associate (and any subcontractor or agent) will, upon receipt of

notice from Group Health Plan, promptly amend or permit Group Health Plan access to amend

any portion of the PHI which Business Associate created for or received from Group Health Plan,

so that Group Health Plan may meet its amendment obligations under 45 C.F.R. § 164.526.

c) Disclosure Accounting.

So that Group Health Plan may meet its disclosure accounting

obligations under 45 C.F.R. § 164.528:

(i)

Disclosure Tracking. Business Associate (and any subcontractor or agent) will record for

each disclosure of PHI that Business Associate creates for or receives from Group Health

Plan that is not excepted from disclosure accounting under Addendum section 7.c)(ii) below

(“Exceptions from Disclosure Tracking”), that Business Associate makes to Group Health

Plan or a third party: (i) the disclosure date, (ii) the name and (if known) address of the

person or entity to whom Business Associate made the disclosure, (iii) a brief description of

the PHI disclosed, and (iv) a brief statement of the purpose of the disclosure (items i-iv,

Sample Business Associate Agreement - Agreement With Business Associate Page 2

Related Articles

Related forms

Related Categories