5.3. ERMUSR 02-09-2010 - Laserfiche WebLink

Home Browse Search

conditions. The Employer agrees to the following conditions, thereby allowing the plan to disclose PHI to the Employer. The Employer agrees to: (a) not use or further disclose PHI other than as permitted or required by the plan document or as required by law; (b) ensure that any agents, including a subcontractor, to whom the plan provides PHI received from the plan agree to the same restrictions and conditions that apply to the Employer with respect to such PHI; (c) not use or disclose PHI for employment related actions and decision unless authorized by an individual; (d) not use or disclose PHI in connection with any other benefit or employee benefit plan of the Employer unless authorized by an individual; (e) report to the plan any PHI use or disclosure, that is inconsistent with the uses or disclosures provided for, of which it becomes aware; (f) make PHI available for amendment and incorporate any amendments to PHI in accordance with HIPAA; (g) make available the information required to provide an accounting of disclosures; (h) make internal practices, books and records relating to the use and disclosure of PHI received from the plan available to the HHS Secretary for the purposes of determining the plan's compliance with HIPAA; and (i) if feasible, return or destroy all PHI received for the plan that the Employer still maintains in any form, and retain no copies of such PHI when no longer needed for the purpose for which disclosure was made (or if return or destruction is not feasible, limit further uses and disclosures to those purposes that make the return or destruction infeasible). 13.3 Employer's Obligations under Security Rules. If the Employer creates, receives, maintains, or transmits ePHI (other than enrollment and disenrollment information and Summary Health Information, which are not subject to these restrictions), the Employer will: (a) implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI; (b) ensure that any agents, including subcontractors, who create, receive, maintain, or transmit ePHI on behalf of the plan implement reasonable and appropriate security measures to protect the ePHI; (c) report to the plan any Security Incident of which it becomes aware;- and (d) implement reasonable and appropriate security measures to ensure that only those persons identified below have access to ePHI and that such access is limited to the purposes identified below. 41