SECURITY STANDARDS FOR ELECTRONIC PROTECTED HEALTH INFORMATION

1. The Board of Trustees will implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits on behalf of the Plan.
2. Adequate separation required by 45 CFR Section 164.405(f)(2)(iii) will be supported by reasonable and appropriate security measures.
3. The Board of Trustees will ensure than any agent, including a subcontractor, to whom it provides Electronic Protected Health Information agrees to implement reasonable and appropriate security measures to protect the information.
4. The Board of Trustees will report to the Plan any security incident of which it becomes aware promptly upon learning of such security incident.

Electronic Protected Health Information shall have the same meaning as the term “electronic protected health information” in 45 CFR Section 160.103.