Laserfiche WebLink
<br />(1) Not use or further disclose the information other than as permitted <br />or required by the Plan documents or as required by law; <br /> <br />(2) Ensure that any agent or subcontractor, to whom it provides <br />Protected Health Information received from the Plan, agrees to the same <br />restrictions and conditions that apply to the Employer with respect to such <br />information; <br /> <br />(3) Not use or disclose Protected Health Information for employment- <br />related actions and decisions or in connection with any other benefit or <br />employee benefit plan of the Employer; <br /> <br />(4) Report to the Plan any use or disclosure of the Protected Health <br />Infomnation of which it becomes aware that is inconsistent with the uses <br />or disclosures permitted by this Section, or required by law; <br /> <br />(5) Make available Protected Health Information to individual Plan <br />members in accordance with Section 164.524 of the Privacy Standards; <br /> <br />(6) Make available Protected Health Information for amendment by <br />individual Plan members and incorporate any amendments to Protected <br />Health Information in accordance with Section 164.526 ofthe Privacy <br />Standards; <br /> <br />(7) Make available the Protected Health Infomnation required to <br />provide an accounting of disclosures to individual Plan members in <br />accordance with Section 164.528 of the Privacy Standards; <br /> <br />(8) Make its internal practices, books and records relating to the use <br />and disclosure of Protected Health Information received from the Plan <br />available to the Department of Health and Human Services for purposes <br />of detemnining compliance by the Plan with the Privacy Standards; <br /> <br />(9) If feasible, return or destroy all Protected Health Information <br />received from the Plan that the Employer still maintains in any form, and <br />retain no copies of such information when no longer needed for the <br />purpose for which disclosure was made, except that, if such return or <br />destruction is not feasibie, limit further uses and disclosures to those <br />purposes that make the return or destruction of the information infeasible; <br />and <br /> <br />(10) Ensure the adequate separation between the Plan and members <br />of the Employer's workforce, as required by Section 164.504(1)(2)(ili) of <br />the Privacy Standards and set out in (d) above. <br /> <br />11.17 COMPLIANCE WITH HIPAA ELECTRONIC SECURITY STANDARDS <br /> <br />Under the Security Standards for the Protection of Electronic Protected Health <br />Information (45 CFR Part 164.300 et. seq., the "Security Standards"): <br /> <br />(a) The Employer agrees to implement reasonable and appropriate <br />administrative, physical and technical safeguards to protect the confidentiality, <br />integrity and availability of Electronic Protected Health Information that the <br />Employer creates, maintains or transmits on behalf of the Plan. "Electronic <br />Protected Health Information" shall have the same definition as set out in the <br /> <br />27 <br />