HIPAA and BAAs — Individual rights

Access. To the extent Business Associate holds PHI in a Designated Record Set, it will make that PHI available to Covered Entity within fifteen (15) business days of a written request, so that Covered Entity can meet its obligations under 45 C.F.R. § 164.524. The Services also provide self-service export, which Covered Entity may use directly at any time. Amendment. Business Associate will make PHI in a Designated Record Set available for amendment, and incorporate amendments Covered Entity directs, in accordance with 45 C.F.R. § 164.526. The Services allow Covered Entity to make such corrections directly. Accounting of disclosures. Business Associate will document disclosures of PHI, and make that documentation available to Covered Entity within fifteen (15) business days of a written request, as required for Covered Entity to respond to an accounting request under 45 C.F.R. § 164.528. Restrictions and confidential communications. Business Associate will comply with any restriction on use or disclosure, or any confidential-communication requirement, that Covered Entity has agreed to under 45 C.F.R. § 164.522 and notified to Business Associate in writing.