Oregon Administrative Rules › Chapter 125 - DEPARTMENT OF ADMINISTRATIVE SERVICES › Division 55 - STATE PURCHASING › Section 125-055-0115 - Business Associate Contract Provisions

Current through Register Vol. 63, No. 7, July 1, 2024
(1) A Contractor that is a Business Associate
			 of an Agency must:
(a) Not use or disclose
			 Protected Health Information or Electronic Protected Health Information other
			 than as permitted or required by this Rule and the Contract, or as Required By
			 Law.
(b) Use appropriate
			 safeguards to prevent use or disclosure of the Protected Health Information and
			 Electronic Protected Health Information other than as provided for by this Rule
			 and the Contract.
(c) Mitigate, to
			 the extent practicable, any harmful effect that is known to Business Associate
			 of a use or disclosure of Protected Health Information or Electronic Protected
			 Health Information by Business Associate in violation of the requirements of
			 this Rule and the Contract.
(d)
			 Report to Agency, as promptly as possible, any use or disclosure of the
			 Protected Health Information or Electronic Protected Health Information not
			 provided for by this Rule and the Contract of which it becomes aware.
(e) Ensure that any agent,
			 including a subcontractor, to whom it provides Protected Health Information or
			 Electronic Protected Health Information created, received, maintained or
			 transmitted by it on behalf of Agency agrees to the same restrictions and
			 conditions that apply through this Rule and the Contract to Business Associate
			 with respect to such information.
(f) Provide access, at the request of Agency,
			 and in the time and manner designated by Agency, to Protected Health
			 Information or Electronic Protected Health Information in a Designated Record
			 Set, to Agency or, as directed by Agency, to an Individual in order to meet the
			 requirements under
			 45 CFR
			 164.524.
(g) Make any amendment(s) to Protected Health
			 Information or Electronic Protected Health Information in a Designated Record
			 Set that the Agency directs or agrees to pursuant to
			 45 CFR
			 164.526 at the request of Agency or an
			 Individual, and in the time and manner designated by Agency.
(h) Make internal practices, books, and
			 records, including policies and procedures relating to the use and disclosure
			 of Protected Health Information and Electronic Protected Health Information
			 created, received, maintained or transmitted by Business Associate on behalf
			 of, Agency available to Agency and to the Secretary, in a time and manner
			 designated by Agency or the Secretary, for purposes of the Secretary
			 determining Agency's compliance with the Privacy Rule or Security Rule.
(i) Document disclosures of
			 Protected Health Information and Electronic Protected Health Information and
			 information related to such disclosures as would be required for Agency to
			 respond to a request by an Individual for an accounting of disclosures of
			 Protected Health Information and Electronic Protected Health Information in
			 accordance with
			 45 CFR
			 164.528.
(j) Provide to Agency or an Individual, in a
			 time and manner to be designated by Agency, information collected in accordance
			 with subsection (i) of this section to permit Agency to respond to a request by
			 an Individual for an accounting of disclosures of Protected Health Information
			 and Electronic Protected Health Information in accordance with
			 45 CFR
			 164.528.