Laserfiche WebLink
=APOJ�6= S E M M A <br />P. "Protected Health Information" or "PHI" shall have the meaning given to such term under the Privacy and <br />Security Rules at 45 C.F.R. § 160.103, limited to the information created or received by Business <br />Associate from or on behalf of Covered Entity. <br />G. "Security Rule" shall mean the Security Standards for the Protection of Electronic Protected Health <br />Information, codified at 45 C.F.R. Parts 160 and 164, Subparts A and C means the HIPAA regulation that <br />is codified at 45 C.F.R. Part 164. <br />H. All capitalized and other terms used in this Agreement and not otherwise defined herein will have the <br />meaning ascribed in the Privacy, Security and Breach Notification Rules. <br />yl R � *.-. <br />A. �errrtittsd Uses and.l isclosures Use of PHI. Except as provided in Sections II(A)(1)-(6) below, Business <br />Associate may only use or disclose PHI to perform functions, activities or services for, or on behalf of <br />Covered Entity. <br />1. Use for Management and Administration. Except as otherwise limited in this Agreement, <br />Business Associate may, consistent with 45 C.F.R. § i 64.504(e)(4), use PHI if necessary (i) for the <br />proper management and administration of Business Associate, or (ii) to carry out the legal <br />responsibilities of Business Associate. <br />2. Disclosure for Management and Administration. Except as otherwise limited in this Agreement, <br />Business Associate may, consistent with 45 C.F.R. § 164.504(e)(4), disclose PHI for the proper <br />management and administration of Business Associate or to carry out the legal responsibilities of <br />Business Associate, provided (i) the disclosure Is Required by Low, or (ii) Business Associate obtains. <br />reasonable assurances from the person to whom the PHI is disclosed ("Pe ") that it will be held <br />confidentially and will be used or further disclosed only as Required by Law or for the purpose <br />for which it was disclosed to the Person, and that the Person agrees to immediately notify Business <br />Associate in writing of any instances of which it becomes aware in which the confidentiality of the <br />information has been breached or is suspected to have been breached. <br />3. Data Actareciation. Except as otherwise limited in this Agreement, Business Associate may use PHI <br />to provide Dbta Aggregation services to Covered Entity as permitted by 45 C.F.R. § <br />i 64.504(e)(2)(1)(B)_ <br />4. fie-ldentification. Business Associate may de -identify PHI in accordance with 45 C.F.R. § <br />164.514(b). <br />5. Reaorting Violations. Business Associate may use PHI to report violations of law to appropriate <br />Federal and State authorities, consistent with 45 C.F.R. § 164.502(j)(1). <br />B. Limitations on Disclosure of PHI. Business Associate shall not use or disclose PHI other than as permitted <br />or required by this Agreement or as Required by Law. Business Associate shall not use or disclose PHI in <br />a manner that would violate the Privacy Rule if done by Covered Entity, unless expressly permitted to do <br />so pursuant to the Privacy Rule and this Agreement. <br />Page 2 1 14 <br />