Business Associate Obligations Business Associate agrees to comply with applicable federal confidentiality and security laws, specifically the provisions of the HIPAA Rules and the HITECH Act applicable to business associates, including:
2.1 Use and Disclosure of PHI. Except as otherwise permitted by this Agreement, the HIPAA Rules, or applicable law, Business Associate shall not make any uses or disclosures of PHI except as necessary to provide services to, or on behalf of, Covered Entity as described in the Underlying Agreement, and shall not use or disclose PHI that would violate the HIPAA Rules or HITECH Act if used or disclosed by Covered Entity; provided, however, Business Associate may use and disclose PHI as necessary for the proper management and administration of Business Associate, or to carry out its legal responsibilities, consistent with Covered Entity’s minimum necessary policies and procedures. Business Associate may not use or disclose PHI which it creates, receives, maintains or transmits for or on behalf of the Covered Entity for any purpose except as otherwise provided by the Agreement and this BAA. Business Associate agrees to review and understand any state privacy and security laws to the extent that such laws are not preempted by HIPAA, as may be amended from time to time. Business Associate acknowledges that it shall comply specifically with the HIPAA Security Rule, and, to the extent that Business Associate is to carry out one or more of Covered Entity’s obligations under the Privacy Rule, it shall comply with the requirements of the Privacy Rule which apply to Covered Entity in the performance of such obligation(s). Business Associate shall in such cases:
2.1.1 provide information to members of its workforce using or disclosing PHI regarding the confidentiality requirements in the HIPAA Rules and this Agreement;
2.1.2 obtain reasonable assurances, in writing from the person or entity to whom the PHI is disclosed that: (i) the PHI will be held in confidence and further used and disclosed only as required by law or for the purpose for which it was disclosed to the person or entity; and (ii) the person or entity will notify Business Associate of any instances of which it is aware in which confidentiality of the PHI has been breached; and
2.1.3 agree to notify the Privacy Officer of Covered Entity of any instances of which it is aware in which the PHI is used or disclosed for a purpose that is not otherwise provided for in this Agreement or for a purpose not expressly permitted by the HIPAA Rules or HITECH Act.
2.2 Marketing; Sale of PHI. Business Associate may not use or disclose PHI for marketing purposes. Marketing includes any communication which would encourage the recipient to use or purchase a product or service. Business Associate may not use or disclose PHI where it has directly or indirectly received remuneration, financial or otherwise, from or on behalf of the recipient of the PHI in exchange for the PHI. “Sale” is not limited to circumstances where a transfer of ownership occurs, and would include access, license or lease agreements.
OBLIGATIONS AND ACTIVITIES OF CONTRACTOR AS BUSINESS ASSOCIATE 1. CONTRACTOR agrees not to use or further disclose PHI COUNTY discloses to CONTRACTOR other than as permitted or required by this Business Associate Contract or as required by law.
2. XXXXXXXXXX agrees to use appropriate safeguards, as provided for in this Business Associate Contract and the Agreement, to prevent use or disclosure of PHI COUNTY discloses to CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY other than as provided for by this Business Associate Contract.
3. XXXXXXXXXX agrees to comply with the HIPAA Security Rule at Subpart C of 45 CFR Part 164 with respect to electronic PHI COUNTY discloses to CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY.
4. CONTRACTOR agrees to mitigate, to the extent practicable, any harmful effect that is known to CONTRACTOR of a Use or Disclosure of PHI by CONTRACTOR in violation of the requirements of this Business Associate Contract.
5. XXXXXXXXXX agrees to report to COUNTY immediately any Use or Disclosure of PHI not provided for by this Business Associate Contract of which CONTRACTOR becomes aware. CONTRACTOR must report Breaches of Unsecured PHI in accordance with Paragraph E below and as required by 45 CFR § 164.410.
6. CONTRACTOR agrees to ensure that any Subcontractors that create, receive, maintain, or transmit PHI on behalf of CONTRACTOR agree to the same restrictions and conditions that apply through this Business Associate Contract to CONTRACTOR with respect to such information.
7. CONTRACTOR agrees to provide access, within fifteen (15) calendar days of receipt of a written request by COUNTY, to PHI in a Designated Record Set, to COUNTY or, as directed by COUNTY, to an Individual in order to meet the requirements under 45 CFR § 164.524. If CONTRACTOR maintains an Electronic Health Record with PHI, and an individual requests a copy of such information in an electronic format, CONTRACTOR shall provide such information in an electronic format.
8. CONTRACTOR agrees to make any amendment(s) to PHI in a Designated Record Set that COUNTY directs or agrees to pursuant to 45 CFR § 164.526 at the request of COUNTY or an Individual, within thirty (30) calendar days of receipt of said request by COUNTY. XXXXXXXXXX agrees to notify COUNTY in writing no later than ten (10) calendar days after said amendment is completed.
9. CONTRACTOR agrees to make internal practices, books, and records, including policies and procedures, relating to the use and disclosure of PHI received from, or created or received by CONTRACTOR on behalf of, COUNTY available to COUNTY and the Secretary in a time and manner as determined by COUNTY or as designated by the Secretary for purposes of the Secretary determining COUNTY’S compliance with the HIPAA Privacy Rule.
10. CONTRACTOR agrees to document any Disclosures of PHI COUNTY discloses to CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY, and to make information related to such Disclosures available as would be required for COUNTY to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
11. CONTRACTOR agrees to provide COUNTY or an Individual, as directed by COUNTY, in a time and manner to be determined by COUNTY, that information collected in accordance with the Agreement, in order to permit COUNTY to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
12. XXXXXXXXXX agrees that to the extent CONTRACTOR carries out COUNTY’s obligation under the HIPAA Privacy and/or Security rules CONTRACTOR will comply with the requirements of 45 CFR Part 164 that apply to COUNTY in the performance of such obligation.
13. If CONTRACTOR receives Social Security data from COUNTY provided to COUNTY by a state agency, upon request by COUNTY, CONTRACTOR shall provide COUNTY with a list of all employees, subcontractors and agents who have access to the Social Security data, including employees, agents, subcontractors and agents of its subcontractors.
14. CONTRACTOR will notify COUNTY if CONTRACTOR is named as a defendant in a criminal proceeding for a violation of HIPAA. COUNTY may terminate the Agreement, if CONTRACTOR is found guilty of a criminal violation in connection with HIPAA. COUNTY may terminate the Agreement, if a finding or stipulation that CONTRACTOR has violated any standard or requirement of the privacy or security provisions of HIPAA, or other security or privacy laws are made in any administrative or civil proceeding in which CONTRACTOR is a party or has been joined. COUNTY will consider the nature and seriousness of the violation in deciding whether or not to terminate the Agreement.
Confidential Information and Restricted Activities Employee has entered into the Company’s Employee Proprietary Information Agreement (“EPIA”) and acknowledges his or her obligations thereunder. The EPIA is specifically incorporated into this Agreement.
Acknowledgement and Consent to Bail-In of EEAAffected Financial Institutions Notwithstanding anything to the contrary in any Loan Document or in any other agreement, arrangement or understanding among any such parties, each party hereto acknowledges that any liability of any EEAAffected Financial Institution arising under any Loan Document, to the extent such liability is unsecured, may be subject to the write-down and conversion powers of an EEAthe applicable Resolution Authority and agrees and consents to, and acknowledges and agrees to be bound by:
(a) the application of any Write-Down and Conversion Powers by an EEAthe applicable Resolution Authority to any such liabilities arising hereunder which may be payable to it by any party hereto that is an EEAAffected Financial Institution; and
(b) the effects of any Bail-in Action on any such liability, including, if applicable:
(i) a reduction in full or in part or cancellation of any such liability;
(ii) a conversion of all, or a portion of, such liability into shares or other instruments of ownership in such EEAAffected Financial Institution, its parent undertaking, or a bridge institution that may be issued to it or otherwise conferred on it, and that such shares or other instruments of ownership will be accepted by it in lieu of any rights with respect to any such liability under this Agreement or any other Loan Document; or
(iii) the variation of the terms of such liability in connection with the exercise of the write-down and conversion powers of any EEAthe applicable Resolution Authority.
Security Agreement under Uniform Commercial Code It is the intention of the parties hereto that this Mortgage shall constitute a Security Agreement within the meaning of Article 9 of the Uniform Commercial Code of the State of New York. Notwithstanding the filing of a financing statement covering any of the Mortgaged Property in the records normally pertaining to personal property, all of the Mortgaged Property, for all purposes and in all proceedings, legal or equitable, shall be regarded, at Mortgagees' option (to the extent permitted by law) as part of the Real Estate whether or not any such item is physically attached to the Real Estate or serial numbers are used for the better identification of certain items. The mention in any such financing statement of any of the Mortgaged Property shall never be construed as in any way derogating from or impairing this declaration and it is the hereby stated intention of the parties that such mention in protection of Mortgagee in the event any court shall at any time hold that notice of Mortgagee's priority of interest, to be effective against any third party, including the federal government and any authority or agency thereof, must be filed in the Uniform Commercial Code records. Mortgagor and Borrower hereby agree that each shall execute and hereby authorizes Mortgagee to file any financing and continuation statements which Mortgagee shall determine in its sole discretion are necessary or advisable in order to perfect it security interest in the Equipment and Personalty covered by this Mortgage, and Borrower shall pay any expenses incurred by Mortgagee in connection with the preparation, execution and filing of such statements that may be filed by Mortgagee, or, if paid by Mortgagee, such amounts, together with interest at the Default Rate, shall be added to the Indebtedness, payable on demand, and shall be secured by this Mortgage.
Data Access and Proprietary Information 6.1 The Fund acknowledges that the databases, computer programs, screen formats, report formats, interactive design techniques, and documentation manuals furnished to the Fund by the Transfer Agent as part of the Fund’s ability to access certain Fund Confidential Information maintained by the Transfer Agent on databases under the control and ownership of the Transfer Agent or other third party (“Data Access Services”) constitute copyrighted, trade secret, or other proprietary information of substantial value to the Transfer Agent or other third party (collectively, “Transfer Agent Proprietary Information”). In no event shall Transfer Agent Proprietary Information be deemed Fund Confidential Information. The Fund agrees to treat all Transfer Agent Proprietary Information as proprietary to the Transfer Agent and further agrees that it shall not divulge any Transfer Agent Proprietary Information to any person or organization except as may be provided hereunder. Without limiting the foregoing, the Fund agrees for itself and its employees and agents to:
(a) Use such programs and databases (i) solely on the Fund’s computers or on computers of Federated Services Company or its affiliates (collectively, “Fund Computers”), or (ii) solely from equipment at the location agreed to between the Fund and the Transfer Agent and (iii) solely in accordance with the Transfer Agent’s applicable user documentation;
(b) Refrain from copying or duplicating in any way (other than in the normal course of performing processing on the Fund Computers), the Transfer Agent Proprietary Information;
(c) Refrain from obtaining unauthorized access to any portion of the Transfer Agent Proprietary Information, and if such access is inadvertently obtained, to inform Transfer Agent in a timely manner of such fact and dispose of such information in accordance with the Transfer Agent’s instructions;
(d) Refrain from causing or allowing information transmitted from the Transfer Agent’s computer to the Fund’s terminal to be retransmitted to any other computer terminal or other device except as expressly permitted by the Transfer Agent (such permission not to be unreasonably withheld);
(e) Allow the Fund to have access only to those authorized transactions as agreed to between the Fund and the Transfer Agent; and
(f) Honor all reasonable written requests made by the Transfer Agent to protect at the Transfer Agent’s expense the rights of the Transfer Agent in the Transfer Agent Proprietary Information at common law, under federal copyright law and under other federal or state law.
6.2 The Fund shall take reasonable efforts to advise its employees of their obligations pursuant to this Section 6. The obligations of this Section shall survive any earlier termination of this Agreement.
6.3 If the Fund notifies the Transfer Agent that any of the Data Access Services do not operate in material compliance with the most recently issued user documentation for such services, the Transfer Agent shall use its best efforts in a timely manner to correct such failure. Organizations from which the Transfer Agent may obtain certain data included in the Data Access Services are solely responsible for the contents of such data and the Fund agrees to make no claim against the Transfer Agent arising out of the contents of such third-party data, including, but not limited to, the accuracy thereof; provided, however, that the Fund shall be entitled to insist that the Transfer Agent, and the Transfer Agent for the benefit of the Fund shall, enforce any and all rights under applicable contracts for the Data Access Services. SUBJECT TO THE FOREGOING OBLIGATIONS OF THE TRANSFER AGENT, DATA ACCESS SERVICES AND ALL COMPUTER PROGRAMS AND SOFTWARE SPECIFICATIONS USED IN CONNECTION THEREWITH ARE PROVIDED ON AN AS IS, AS AVAILABLE BASIS. EXCEPT AS OTHERWISE PROVIDED HEREIN TO THE CONTRARY, THE TRANSFER AGENT EXPRESSLY DISCLAIMS ALL WARRANTIES INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
6.4 If the transactions available to the Fund include the ability to originate Proper Instructions through electronic instructions to the Transfer Agent in order to: (i) effect the transfer or movement of cash or Shares; or (ii) transmit Shareholder information or other information, then in such event the Transfer Agent shall be entitled to rely on the validity and authenticity of such Proper Instructions without undertaking any further inquiry as long as such Proper Instruction is undertaken in conformity with applicable security procedures.
Obligations and Activities of Business Associates (1) Business Associate agrees not to use or disclose PHI other than as permitted or required by this Section of the Contract or as Required by Law.
(2) Business Associate agrees to use and maintain appropriate safeguards and comply with applicable HIPAA Standards with respect to all PHI and to prevent use or disclosure of PHI other than as provided for in this Section of the Contract and in accordance with HIPAA Standards.
(3) Business Associate agrees to use administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic Protected Health Information that it creates, receives, maintains, or transmits on behalf of the Covered Entity.
(4) Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to the Business Associate of a use or disclosure of PHI by Business Associate in violation of this Section of the Contract.
(5) Business Associate agrees to report to Covered Entity any use or disclosure of PHI not provided for by this Section of the Contract or any Security Incident of which it becomes aware.
(6) Business Associate agrees, in accordance with 45 C.F.R. 502(e)(1)(ii) and 164.308(d)(2), if applicable, to ensure that any subcontractors that create, receive, maintain or transmit PHI on behalf of the Business Associate, agree to the same restrictions, conditions, and requirements that apply to the business associate with respect to such information.
(7) Business Associate agrees to provide access (including inspection, obtaining a copy or both), at the request of the Covered Entity, and in the time and manner designated by the Covered Entity, to PHI in a Designated Record Set, to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 C.F.R. § 164.524. Business Associate shall not charge any fees greater than the lesser of the amount charged by the Covered Entity to an Individual for such records; the amount permitted by state law; or the Business Associate’s actual cost of postage, labor and supplies for complying with the request.
(8) Business Associate agrees to make any amendments to PHI in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 C.F.R. § 164.526 at the request of the Covered Entity, and in the time and manner designated by the Covered Entity.
(9) Business Associate agrees to make internal practices, books, and records, including policies and procedures and PHI, relating to the use and disclosure of PHI received from, or created, maintained, transmitted or received by, Business Associate on behalf of Covered Entity, available to Covered Entity or to the Secretary in a time and manner agreed to by the parties or designated by the Secretary, for purposes of the Secretary investigating or determining Covered Entity’s compliance with the HIPAA Standards.
(10) Business Associate agrees to document such disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528 and section 13405 of the HITECH Act (42 U.S.C. § 17935) and any regulations promulgated thereunder.
(11) Business Associate agrees to provide to Covered Entity, in a time and manner designated by the Covered Entity, information collected in accordance with subsection (g)(10) of this Section of the Contract, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528 and section 13405 of the HITECH Act (42 U.S.C. § 17935) and any regulations promulgated thereunder. Business Associate agrees at the Covered Entity’s direction to provide an accounting of disclosures of PHI directly to an individual in accordance with 45 C.F.R. § 164.528 and section 13405 of the HITECH Act (42 U.S.C. § 17935) and any regulations promulgated thereunder.
(12) Business Associate agrees to comply with any State or federal law that is more stringent than the Privacy Rule.
(13) Business Associate agrees to comply with the requirements of the HITECH Act relating to privacy and security that are applicable to the Covered Entity and with the requirements of 45 C.F.R. §§ 164.504(e), 164.308, 164.310, 164.312, and 164.316.
(14) In the event that an Individual requests that the Business Associate
(A) restrict disclosures of PHI;
(B) provide an accounting of disclosures of the Individual’s PHI;
(C) provide a copy of the Individual’s PHI in an Electronic Health Record; or
(D) amend PHI in the Individual’s Designated Record Set the Business Associate agrees to notify the Covered Entity, in writing, within five Days of the request.
(15) Business Associate agrees that it shall not, and shall ensure that its subcontractors do not, directly or indirectly, receive any remuneration in exchange for PHI of an Individual without
(A) the written approval of the Covered Entity, unless receipt of remuneration in exchange for PHI is expressly authorized by this Contract and
(B) the valid authorization of the Individual, except for the purposes provided under section 13405(d)(2) of the HITECH Act, (42 U.S.C. § 17935(d)(2)) and in any accompanying regulations.
(16) Obligations in the Event of a Breach.
(A) The Business Associate agrees that, following the discovery by the Business Associate or by a subcontractor of the Business Associate of any use or disclosure not provided for by this section of the Contract, any breach of Unsecured protected health information, or any Security Incident, it shall notify the Covered Entity of such Breach in accordance with Subpart D of Part 164 of Title 45 of the Code of Federal Regulations and this Section of the Contract.
(B) Such notification shall be provided by the Business Associate to the Covered Entity without unreasonable delay, and in no case later than 30 days after the Breach is discovered by the Business Associate, or a subcontractor of the Business Associate, except as otherwise instructed in writing by a law enforcement official pursuant to 45 C.F.R. 164.412. A Breach is considered discovered as of the first day on which it is, or reasonably should have been, known to the Business Associate or its subcontractor. The notification shall include the identification and last known address, phone number and email address of each Individual (or the next of kin of the individual if the Individual is deceased) whose Unsecured protected health information has been, or is reasonably believed by the Business Associate to have been, accessed, acquired, or disclosed during such Breach.
(C) The Business Associate agrees to include in the notification to the Covered Entity at least the following information:
1. A description of what happened, including the date of the Breach; the date of the discovery of the Breach; the unauthorized person, if known, who used the PHI or to whom it was disclosed; and whether the PHI was actually acquired or viewed.
2. A description of the types of Unsecured protected health information that were involved in the Breach (such as full name, Social Security number, date of birth, home address, account number, or disability code).
3. The steps the Business Associate recommends that Individual(s) take to protect themselves from potential harm resulting from the Breach.
4. A detailed description of what the Business Associate is doing or has done to investigate the Breach, to mitigate losses, and to protect against any further Breaches.
5. Whether a law enforcement official has advised the Business Associate, either verbally or in writing, that he or she has determined that notification or notice to Individuals or the posting required under 45 C.F.R.
Parent Right to Access and Challenge Student Data The LEA shall establish reasonable procedures pursuant to which a parent, as that term is defined in 105 ILCS 10/2(g), may inspect and/or copy Student Data and/or challenge the accuracy, relevance or propriety of Student Data, pursuant to Sections 5 and 7 of ISSRA (105 ILCS 10/5; 105 ILCS 10/7) and Section 33 of SOPPA (105 ILCS 85/33). The Provider shall respond to any request by the LEA for Student Data in the possession of the Provider when Provider cooperation is required to afford a parent an opportunity to inspect and/or copy the Student Data, no later than 5 business days from the date of the request. In the event that a parent contacts the Provider directly to inspect and/or copy Student Data, the Provider shall refer the parent to the LEA, which shall follow the necessary and proper procedures regarding the requested Student Data.
Dissemination of Research Findings and Acknowledgement of Controlled-Access Datasets Subject to the NIH GDS Policy
Acknowledgement and Consent to Bail-In of Affected Financial Institutions Notwithstanding anything to the contrary in any Loan Document or in any other agreement, arrangement or understanding among any such parties, each party hereto acknowledges that any liability of any Affected Financial Institution arising under any Loan Document, to the extent such liability is unsecured, may be subject to the Write-Down and Conversion Powers of the applicable Resolution Authority and agrees and consents to, and acknowledges and agrees to be bound by:
(a) the application of any Write-Down and Conversion Powers by the applicable Resolution Authority to any such liabilities arising hereunder which may be payable to it by any party hereto that is an Affected Financial Institution; and
(b) the effects of any Bail-In Action on any such liability, including, if applicable:
(i) a reduction in full or in part or cancellation of any such liability;
(ii) a conversion of all, or a portion of, such liability into shares or other instruments of ownership in such Affected Financial Institution, its parent undertaking, or a bridge institution that may be issued to it or otherwise conferred on it, and that such shares or other instruments of ownership will be accepted by it in lieu of any rights with respect to any such liability under this Agreement or any other Loan Document; or
(iii) the variation of the terms of such liability in connection with the exercise of the Write-Down and Conversion Powers of the applicable Resolution Authority.
