|
1.ME.20 |
Disclosures to Business Associates (BA)
|
Type: Policy
Category: General
Level: Community Care
Parties: Community Care employees and contractees
Printer Friendly Version: http://apps.comcareme.org/policymanual/default.aspx?code=1.ME.20&nonav=yes
Supporting References: HIPAA Privacy Rule Standard 164:504(2)
|
Parent |
Effective Date |
Approval Level |
Revision Dates |
Last Reviewed |
|
N/A |
4-13-2003
|
Board
|
|
4-13-2003 |
|
Related Document Code |
Related Document Name |
Type |
Policy: Community Care may disclose protected health information to business associates and may allow business associates to create or receive protected information on its behalf provided that the Community Care obtains satisfactory assurance that the business associate will appropriately safeguard the information. The assurance must be in the form of a written contract and meet the following criteria: The contract must clearly establish the permitted and required uses and disclosures of information by the BA and stipulate that: the BA will not use or further disclose information other than that as provided in the contract; the BA will use appropriate safeguards to prevent use or disclosure of information other than that as provided in the contract; the BA will report to Community Care any use or disclosure that occurred that is NOT provided for in the contract; any agents, such as sub-contractors, the BA provides information to must abide by the conditions and restrictions set forth in the contract between the BA and Community Care; the BA will make information available to the individual and make the information available for amendment by the individual; the BA will make available a listing of the disclosures it has made; the BA will make available practices, books, and record, relating to the use and disclosure of protected information to the Secretary of HHS for purposes of determining Community Care’s compliance in an investigation; the BA will, upon termination of the contract with Community Care, return or destroy all protected health information that the BA maintains in any form and stipulate that the BA will not keep copies of information; if it is not feasible for the BA to return or destroy all the information, then the BA agrees to extend the terms and coverage of this contract after termination to the information; the contract will be terminated by Community Care if the BA is found to be in violation of a material term of the contract.