i. Contract approval - Laserfiche WebLink

11.17 COMPLIANCE WITH HIPAA PRIVACY STANDARDS (a) If the Health Care Reimbursement Plan under this Cafeteria Plan is subject to the Standards for Privacy of Individually Identifiable Health Information (45 CFR Part 164, the "Privacy Standards"), then this Section shall apply. (b) The Plan shall not disclose Protected Health Information to any member of the Employer's workforce unless each of the conditions set out in this Section are met. "Protected Health Information" shall have the same definition as set forth in the Privacy Standards but generally shall mean individually identifiable information about the past, present or future physical or mental health or condition of an individual, including information about treatment or payment for treatment. (c) Protected Health Information disclosed to members of the Employer's workforce shall be used or disclosed by them only for purposes of Plan administrative functions. The Plan's administrative functions shall include all Plan payment functions and health care operations. The terms "payment" and "health care operations" shall have the same definitions as set out in the Privacy Standards, but the term "payment" generally shall mean activities taken to determine or fulfill Plan responsibilities with respect to eligibility, coverage, provision of benefits, or reimbursement for health care. (d) The Plan shall disclose Protected Health Information only to members of the Employer's workforce who are authorized to receive such Protected Health Information, and only to the extent and in the minimum amount necessary for that person to perform his or her duties with respect to the Plan. "Members of the Employer's workforce" shall refer to all employees and other persons under the control of the Employer. The Employer shall keep an updated list of those authorized to receive Protected Health Information. (1) An authorized member of the Employer's workforce who receives Protected Health Information shall use or disclose the Protected Health Information only to the extent necessary to perform his or her duties with respect to the Plan. (2) In the event that any member of the Employer's workforce uses or discloses Protected Health Information other than as permitted by this Section and the Privacy Standards, the incident shall be reported to the Plan's privacy officer. The privacy officer shall take appropriate action, including: (i) investigation of the incident to determine whether the breach occurred inadvertently, through negligence or deliberately; whether there is a pattern of breaches; and the degree of harm caused by the breach; (ii) appropriate sanctions against the persons causing the breach which, depending upon the nature of the breach, may include oral or written reprimand, additional training, or termination of employment; (iii) mitigation of any harm caused by the breach, to the extent practicable; and 26