HIPAA and BAAs — Safeguards

Business Associate will use appropriate administrative, physical and technical safeguards to prevent use or disclosure of PHI other than as provided for by this Agreement, and will comply with Subpart C of 45 C.F.R. Part 164 (the Security Rule) with respect to electronic PHI. Without limiting that obligation, Business Associate maintains the controls described on its security page, including encryption of data in transit and at rest, role- and field-level access controls, optional two-factor authentication and single sign-on for workforce and customer access, and an audit trail of changes to customer content. The security page is a self-reported description of implemented controls and is incorporated by reference for description only; the obligations of this section are those of the Security Rule.