Health Insurance Portability and Accountability Act Grantee certifies that it is in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law Xx. 000-000, 00 XXX Parts 160, 162 and 164, and the Social Security Act, 42 USC 1320d-2 through 1320d-7, in that it may not use or disclose protected health information other than as permitted or required by law and agrees to use appropriate safeguards to prevent use or disclosure of the protected health information. Grantee shall maintain, for a minimum of six (6) years, all protected health information.
Health Insurance Portability and Accountability Act of 1996 This paragraph was intentionally left blank.
Health Insurance The Couple agrees that: (check one)
HIPAA To the extent (if any) that DXC discloses “Protected Health Information” or “PHI” as defined in the HIPAA Privacy and Security Rules (45 CFR, Part 160-164) issued pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) to Supplier or Supplier accesses, maintains, uses, or discloses PHI in connection with the performance of Services or functions under this Agreement, Supplier will: (a) not use or further disclose PHI other than as permitted or required by this Agreement or as required by law; (b) use appropriate safeguards to prevent use or disclosure of PHI other than as provided for by this Agreement, including implementing requirements of the HIPAA Security Rule with regard to electronic PHI; (c) report to DXC any use or disclosure of PHI not provided for under this Agreement of which Supplier becomes aware, including breaches of unsecured protected health information as required by 45 CFR §164.410, (d) in accordance with 45 CFR §164.502(e)(1)(ii), ensure that any subcontractors or agents of Supplier that create, receive, maintain, or transmit PHI created, received, maintained or transmitted by Supplier on DXC’s behalf, agree to the same restrictions and conditions that apply to Supplier with respect of such PHI; (e) make available PHI in a Designated Record Set (if any is maintained by Supplier) in accordance with 45 CFR section 164.524;
Privacy Act If performance involves design, development or operation of a system of records on individuals, this Agreement incorporates by reference FAR 52.224-1 Privacy Act Notification (Apr 1984) and FAR 52.224-2 Privacy Act (Apr 1984).