2010-06-07_(2).pdf - 19318.8K - BridgeportCT.gov

Customer Name Bridgeport City BOE
Administrative Services Only Agreement
A Implement administrative physical andtechnical safeguards that reasonably and appropriately
protect the confidentiality integrity and availability of the Electronic Protected Health
Information that ConnecticutGeneral creates receives maintains or transmits onbehalfofthe
Plan as required by the Security Standards
B Ensure that any agent including asubcontractor to whom COllilecticut General provides such
information agrees to
implement reasonable and appropriate sllfeguards to protect it and
C
Report to the Plan any Security Incident of which it becomes aware
Section 6 Reporting of Violations Connecticut General shall r port to the Plan any use or
disclosure of PHI not provided for by this Addendum of which it becomes aware Connecticut
General agrees to
mitigate to the extent practicable any harmful effe ct from a use or disclosure of
PHI in violation ofthis Addendum ofwhich it is aware
Section 7 Security Breach Notification Connecticut General will notify the Plan ofa Breach
without unreasonable delay
This notification will include to the extent known
i the names of the individuals whose PHI was involved in the Breach
ii the circumstances surrounding the Breach
Hi the date ofthe Breach and the date of its discovery
iv
the information Breached
v
any steps the impacted individuals should take to protect themselves
vi the steps Connecticut General is taking to investigate the Breac h mitigate losses and protect
against future Breaches and
vii a contact person
who can
provide additional information about the Breach
Connecticut General will perform a fact based risk assessment as required by the HITECH Act to
determine whetherthere is a
significant risk offinancial or
reputational
other harm to the individual
whose PHI was
impacted
Connecticut General will provide the Plan with the results of its risk
assessment and will make a recommendation to the Plan regarding whether notification is required
pursuant to 45 CFR 9164 404 408 With the Plan s
prior approval Connecticut General will issue
such notices to individuals to the Department of Health and Human Services and to the media as
the Plan is required to issue pursuant to and in accordance with the requirements of 45 CFR
S 164
404 408 Connecticut General will pay the costs of issuing notiees required by
law and other
remediation and mitigation which in Business Associate s discretion are appropriate and necessary
to address the Breach Connecticut General will not be
required to issue notifications that are not
mandated by applicable law Connecticut General will maintain a log
ofBreaches and will provide
such log to the Plan annually to support the Plan s regulatory reporting obligations
Section 8 Disclosures to and Agreements by Third Parties Connectiicut General shall ensure that
each agent and subcontractor to whom it provides PHI agrees to the same restrictions and conditions
with respect to such PHI that apply to Connecticut General pursuant to this Addendum
OS 212010
38