Fillable Business Associate Agreement (Page 5 of 8) in pdf

f. CE’s Rights of Access and Inspection. From time to time upon reasonable notice, or

upon a reasonable determination by CE that BA has breached this Agreement, CE may

inspect the facilities, systems, books and records of BA to monitor compliance with this

Agreement. The fact that CE inspects, or fails to inspect, or has the right to inspect, BA’s

facilities, systems and procedures does not relieve BA of its responsibility to comply with

this Agreement, nor does CE’s (1) failure to detect or (2) detection of, but failure to

notify BA or require BA’s remediation of, any unsatisfactory practices constitute

acceptance of such practice or a waiver of CE’s enforcement or termination rights under

this Agreement. The parties’ respective rights and obligations under this Section 5.f.

shall survive termination of the Agreement.

g. United States Department of Health and Human Services. BA shall make its internal

practices, books and records relating to the use and disclosure of PHI available to the

Secretary of the United States Department of Health and Human Services (“HHS”) for

purposes of determining CE’s compliance with HIPAA and the HIPAA Regulations;

provided, however, that BA shall immediately notify CE upon receipt by BA of any such

request for access by the Secretary of HHS, and shall provide CE with a copy thereof as

well as a copy of all materials disclosed pursuant thereto. The parties’ respective rights

and obligations under this Section 5.g. shall survive termination of the Agreement.

Obligation to Provide Access, Amendment and Accounting of PHI.

a. Access to PHI. BA shall make available to CE such information as CE may require

to fulfill CE’s obligations to provide access to, and copies of, PHI in accordance with

HIPAA and the HIPAA Regulations.

b. Amendment of PHI. BA shall make available to CE such information as CE may

require to fulfill CE’s obligations to amend PHI in accordance with HIPAA and the

HIPAA Regulations.

In addition, BA shall, as directed by CE, incorporate any

amendments to CE’s PHI into copies of such information maintained by BA.

c. Accounting of Disclosures of PHI. BA shall make available to CE such information

as CE may require to fulfill CE’s obligations to provide an accounting of disclosures with

respect to PHI in accordance with HIPAA and the HIPAA Regulations. In addition, BA

shall maintain a record of all disclosures of PHI, including the date of the disclosure, the

name and, if known, the address of the recipient of the PHI, a brief description of the PHI

disclosed, and the purpose of the disclosure which includes an explanation of the basis

for such disclosure. BA shall make this record available to CE upon CE’s request.

d. Forwarding Requests From Individual. In the event that any individual requests

access to, amendment of, or accounting of PHI directly from BA, BA shall within two (2)

days forward such request to CE. CE shall have the responsibility of responding to

forwarded requests. However, if forwarding the individual’s request to CE would cause

CE or BA to violate HIPAA or the HIPAA Regulations, BA shall instead respond to the

individual’s request as required by such law and notify CE of such response as soon as

practicable.

-5-

9100767.3

Business Associate Agreement Page 5