l. Contract approval - Laserfiche WebLink

perform his or her duties with respect to the Plan. "Members of the Employer's workforce" shall refer to all employees and other persons under the control of the Employer. The Employer shall keep an updated list of those authorized to receive Protected Health Information. (1) An authorized member of the Employer's workforce who receives Protected Health Information shall use or disclose the Protected Health Information only to the extent necessary to perform his or her duties with respect to the Plan. (2) In the event that any member of the Employer's workforce uses or discloses Protected Health Information other than as permitted by this Section and the Privacy Standards, the incident shall be reported to the Plan's privacy officer. The privacy officer shall take appropriate action, including: (i) investigation of the incident to determine whether the breach occurred inadvertently, through negligence or deliberately; whether there is a pattern of breaches; and the degree of harm caused by the breach; (ii) appropriate sanctions against the persons causing the breach which, depending upon the nature of the breach, may include oral or written reprimand, additional training, or termination of employment; (iii) mitigation of any harm caused by the breach, to the extent practicable; and (iv) documentation of the incident and all actions taken to resolve the issue and mitigate any damages. (e) Certification. The Employer must provide certification to the Plan that it agrees to: (1) Not use or further disclose the information other than as permitted or required by the Plan documents or as required by law; (2) Ensure that any agent or subcontractor, to whom it provides Protected Health Information received from the Plan, agrees to the same restrictions and conditions that apply to the Employer with respect to such information; (3) Not use or disclose Protected Health Information for employment- related actions and decisions or in connection with any other benefit or employee benefit plan of the Employer; (4) Report to the Plan any use or disclosure of the Protected Health Information of which it becomes aware that is inconsistent with the uses or disclosures permitted by this Section, or required by law; (5) Make available Protected Health Information to individual Plan members in accordance with Section 164.524 of the Privacy Standards; 28