HIPAA Business Associate Requirements. CONTRACTOR hereby agrees to adhere to the terms and conditions set forth in Exhibit D – County of Humboldt HIPAA Business Associate Agreement, which is attached hereto and incorporated herein by reference as if set forth in full. [REMOVE IF NOT APPLICABLE]
HIPAA Business Associate Requirements. Each party hereby agrees to adhere to the terms and conditions set forth in Exhibit A – County of Humboldt HIPAA Business Associate Agreement, which is attached hereto and incorporated herein by reference as if set forth in full.
HIPAA Business Associate Requirements. If Contractor's performance under this Agreement involves or requires the disclosure to or use by Contractor of OHSU's "Individually Identifiable Health Information" or “Electronic PHI” (as those terms are defined by the Health Insurance Portability and Accountability Act and regulations promulgated pursuant thereto (“HIPAA”)), then the following provisions apply:
35.1. Contractor will use and disclose Individually Identifiable Health Information, Electronic PHI and PHI that has been de-identified as described in 45 CFR 164.514(a)-(b) received from, or created or received by Contractor on behalf of, OHSU in the course of its performance under this Agreement (collectively, “PHI”) only as required for such performance or as required by law. Contractor will use all appropriate safeguards to prevent any use or disclosure of PHI other than as allowed in this Agreement. All PHI (in whatever form) is the exclusive property of OHSU.
35.2. Contractor shall not, and shall ensure that its directors, officers, employees, contractors, agents and subcontractors (collectively, “Contractor Representatives”) do not, use or disclose PHI in any manner constituting a violation of 45 CFR §160 and 164 (“Privacy Standards”) if done by OHSU.
35.3. Contractor agrees that any request to OHSU for disclosure of PHI shall be limited to the minimum necessary to accomplish Contractor’s purpose under this Agreement. This provision shall automatically incorporate any guidance the Secretary issues pursuant to HIPAA regarding what constitutes “minimum necessary.”
35.4. Contractor shall immediately notify OHSU in writing of any use or disclosure of PHI other than as allowed by this Agreement, including braches of Unsecured PHI as required by 45 CFR 164.410. Contractor agrees to mitigate, to the extent practicable, any harmful effect of such use or disclosure of PHI by Contractor or any Contractor Representative in violation of the requirements of this Agreement.
35.5. Contractor agrees to require Contractor Representatives that create, receive, maintain or transmit PHI on behalf of Contractor to agree to the same restrictions, conditions and requirements that apply through these terms and conditions.
35.6. If Contractor maintains Records for OHSU that are a part of OHSU’s Designated Record Set (“DRS”), Contractor will: (a) within 10 days of a request from OHSU for access to an individual’s PHI contained in the DRS, provide copies of such PHI to OHSU; (b) within 10 days of a request from OHSU...
HIPAA Business Associate Requirements. If Contractor's performance under this Agreement involves or requires the disclosure to or use by Contractor of VGTI's "Individually Identifiable Health Information" (as that term is defined by the Health Insurance Portability and Accountability Act and regulations promulgated pursuant thereto (“HIPAA”), then the following provisions apply:
(i) Contractor will use and disclose Individually Identifiable Health Information received from, or created or received by Contractor on behalf of, VGTI in the course of its performance under this Agreement (“PHI”) only as required for such performance, as permitted herein or as required by law, and Contractor will use all appropriate safeguards to prevent any use or disclosure of PHI other than as allowed in this Agreement. All PHI (in whatever form) is the exclusive property of VGTI.
(ii) Contractor shall not, and shall ensure that its directors, officers, employees, contractors and agents (collectively, “Contractor Representatives”) do not, use or disclose PHI in any manner constituting a violation of 45 CFR §160 and 164 (“Privacy Standards”) if done by VGTI.
(iii) Contractor agrees that any request to VGTI for disclosure of PHI shall be limited to the minimum necessary to accomplish Contractor’s purpose under this Agreement.
(iv) Contractor shall immediately notify VGTI in writing of any use or disclosure of PHI other than as allowed by this Agreement, and, to the extent practicable, shall mitigate any harmful effect of such use/or disclosure.
(v) Contractor shall ensure that each of the Contractor Representatives having access to PHI, agree to comply with these restrictions and conditions.
(vi) If Contractor maintains Records for VGTI that are a part of VGTI’s Designated Record Set (“DRS”), Contractor will: (i) within 10 days of a request from VGTI for access to an individual’s PHI contained in the DRS, provide copies of such PHI to VGTI; (ii) within 10 days of a request from VGTI for an amendment of an identified individual’s PHI in a DRS, make available the PHI for amendment and incorporate such amendment into PHI maintained by Contractor as required by the Privacy Standards; and (iii) within 5 days of Contractor’s receipt from an individual of a request for access to PHI or for an amendment of PHI, forward that request to VGTI in writing.
(vii) Within 10 days of notice from VGTI that VGTI has received a request for an accounting of disclosures of an individual’s PHI, Contractor shall make available to VGTI such ...
