Business Associate Agreement & Data Services Agreement - SEMMA Health, Inc.

Home Browse Search

F. "Protected Health Information" or "PHI" shall have the meaning given to such term under the Privacy and Security Rules at 45 C.F.R. § 160.103, limited to the information created or received by Business Associate from or on behalf of Covered Entity. G. "Security Rule" shall mean the Security Standards for the Protection of Electronic Protected Health Information, codified at 45 C.F.R. Parts 160 and 164, Subparts A and C means the HIPAA regulation that is codified at 45 C.F.R. Part 164. H. All capitalized and other terms used in this Agreement and not otherwise defined herein will have the meaning ascribed in the Privacy, Security and Breach Notification Rules.. II. OBLIGATIONS OF BUSINESS ASSOCIATE A. Permitted Uses and Disclosures Use of PHI: Except as provided in Sections II(A)(I)-(6) below, Business Associate may only use or disclose PHI to perform functions, activities or services for, or on behalf of Covered Entity. Use for Management and Administration. Except as otherwise limited in this Agreement, Business Associate may, consistent with 45 C.F.R. § 164.504(e)(4), use PHI if necessary (i) for the proper management and administration of Business Associate, or (ii) to carry out the Iegal responsibilities of Business Associate. 2. Disclosure for Management and Administration. Except as otherwise limited in this Agreement, Business Associate may, consistent with 45 C.F.R. § 164.504(e)(4), disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided (i) the disclosure is Required by Law, or (ii) Business Associate obtains reasonable assurances from the person to whom the PHI is disclosed ("Person") that it will be held confidentially and will be used or further disclosed only as Required by Law or for the purpose for which it was disclosed to the Person, and that the Person agrees to immediately notify Business Associate in writing of any instances of which it becomes aware in which the confidentiality of the information has been breached or is suspected to have been breached. 3. Data Aggregation. Except as otherwise limited in this Agreement, Business Associate may use PHI to provide Data Aggregation services to Covered Entity as permitted by 42 C.F.R. § 164.504(e)(2)(i)(B). 4. De -Identification. Business Associate may de -identify PHI in accordance with 45 C.F.R. § I64.514(b). 5. Reporting Violations. Business Associate may use PHI to report violations of law to appropriate Federal and State authorities, consistent with 45 C.F.R. § 164.5020)(1).