l. Contract approval - Laserfiche WebLink

(6) Make available Protected Health Information for amendment by individual Plan members and incorporate any amendments to Protected Health Information in accordance with Section 164.526 of the Privacy Standards; (7) Make available the Protected Health Information required to provide an accounting of disclosures to individual Plan members in accordance with Section 164.528 of the Privacy Standards; (8) Make its internal practices, books and records relating to the use and disclosure of Protected Health Information received from the Plan available to the Department of Health and Human Services for purposes of determining compliance by the Plan with the Privacy Standards; (9) If feasible, return or destroy all Protected Health Information received from the Plan that the Employer still maintains in any form, and retain no copies of such information when no longer needed for the purpose for which disclosure was made, except that, if such return or destruction is not feasible, limit further uses and disclosures to those purposes that make the return or destruction of the information infeasible; and (10) Ensure the adequate separation between the Plan and members of the Employer's workforce, as required by Section 164.504(f)(2)(iii) of the Privacy Standards and set out in (d) above. 11.18 COMPLIANCE WITH HIPAA ELECTRONIC SECURITY STANDARDS Under the Security Standards for the Protection of Electronic Protected Health Information (45 CFR Part 164.300 et. seq., the "Security Standards"): (a) Implementation. The Employer agrees to implement reasonable and appropriate administrative, physical and technical safeguards to protect the confidentiality, integrity and availability of Electronic Protected Health Information that the Employer creates, maintains or transmits on behalf of the Plan. "Electronic Protected Health Information" shall have the same definition as set out in the Security Standards, but generally shall mean Protected Health Information that is transmitted by or maintained in electronic media. (b) Agents or subcontractors shall meet security standards. The Employer shall ensure that any agent or subcontractor to whom it provides Electronic Protected Health Information shall agree, in writing, to implement reasonable and appropriate security measures to protect the Electronic Protected Health Information. (c) Employer shall ensure security standards. The Employer shall ensure that reasonable and appropriate security measures are implemented to comply with the conditions and requirements set forth in Section 11.17. 29