Sherman Harris Agency Information Security Officer 404-656-9653 At Contractor: ________________ ________________ ________________ Contractor agrees that it will: Not request, create, receive, use or disclose PHI other than as permitted or required by this Agreement, the Contract, or as required by law. Establish, maintain and use appropriate administrative, physical and technical safeguards to prevent use or disclosure of the PHI than as provided for by this Agreement or the Contract. Implement and use administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the electronic protected health information that it creates, receives, maintains, or transmits on behalf of DCH. In addition to the safeguards described above, Contractor shall include access controls that restrict access to PHI to the individuals described or identified on E-1 and E-2, as amended from time to time, shall implement encryption of all electronic PHI during transmission and shall encrypt all electronic PHI during storage on portable media devices (such as backup storage tapes). Upon DCH’s reasonable request, but no more frequently than annually, provide the results of privacy and security assessments to DCH, and ensure that corrective actions identified during the assessments are implemented. Mitigate, to the extent practicable, any harmful effect that may be to Contractor from a use or disclosure of PHI by Contractor in violation of the requirements of this Agreement, the Contract or applicable regulations. Contractor shall bear the costs of mitigation, which shall include the reasonable costs of credit monitoring or credit restoration when the use or disclosure results in exposure of information commonly used in identity theft.
Sherman Harris Agency Information Security Officer 404-656-9653 At Contractor: ________________ ________________ ________________ Contractor agrees that it will: Not request, create, receive, use or disclose PHI other than as permitted or required by this Agreement, the Contract, or as required by law. Establish, maintain and use appropriate administrative, physical and technical safeguards to prevent use or disclosure of the PHI than as provided for by this Agreement or the Contract. Implement and use administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the electronic protected health information that it creates, receives, maintains, or transmits on behalf of DCH. In addition to the safeguards described above, Contractor shall include access controls that restrict access to PHI to the individuals described or identified on E-1 and E-2, as amended from time to time, shall implement encryption of all electronic PHI during transmission and shall encrypt all electronic PHI during storage on portable media devices (such as backup storage tapes). Upon DCH’s reasonable request, but no more frequently than annually, provide the results of privacy and security assessments to DCH, and ensure that corrective actions identified during the assessments are implemented. Mitigate, to the extent practicable, any harmful effect that may be to Contractor from a use or disclosure of PHI by Contractor in violation of the requirements of this Agreement, the Contract or applicable regulations. Contractor shall bear the costs of mitigation, which shall include the reasonable costs of credit monitoring or credit restoration when the use or disclosure results in exposure of information commonly used in identity theft.