Records Audit and Disclosure 5.01 Access to records, books, and documents 5.02 Response/compliance with audit or inspection findings A. At Local Government's sole expense, Local Government must take action to ensure its or a Subcontractor’s compliance with a correction of any finding of noncompliance with any law, regulation, audit requirement, or generally accepted accounting principle relating to the Services and Deliverables or any other deficiency contained in any audit, review, or inspection conducted under the Contract. Whether Local Government's action corrects the noncompliance shall be solely the decision of the System Agency. B. As part of the Services, Local Government must provide to HHSC upon request a copy of those portions of Local Government's and its Subcontractors' internal audit reports relating to the Services and Deliverables provided to the State under the Contract.
Permitted Uses and Disclosures i. Business Associate shall use and disclose PHI only to accomplish Business Associate’s obligations under the Contract. i. To the extent Business Associate carries out one or more of Covered Entity’s obligations under Subpart E of 45 C.F.R. Part 164, Business Associate shall comply with any and all requirements of Subpart E that apply to Covered Entity in the performance of such obligation. ii. Business Associate may disclose PHI to carry out the legal responsibilities of Business Associate, provided, that the disclosure is Required by Law or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that: A. the information will remain confidential and will be used or disclosed only as Required by Law or for the purpose for which Business Associate originally disclosed the information to that person, and; B. the person notifies Business Associate of any Breach involving PHI of which it is aware. iii. Business Associate may provide Data Aggregation services relating to the Health Care Operations of Covered Entity. Business Associate may de-identify any or all PHI created or received by Business Associate under this Agreement, provided the de-identification conforms to the requirements of the HIPAA Rules.