Common use of Obligations and Activities of the Business Associate Clause in Contracts

Obligations and Activities of the Business Associate. Use and Disclosure of PHI 3.1 The Business Associate shall not use or disclose PHI other than as permitted or required by this BAA or as required by law. Business Associate may: a. Use and disclose PHI only as necessary to perform its obligations under the Agreement, provided that such use or disclosure would not violate HIPAA Laws if done by the County; b. Use the PHI received in its capacity as a Business Associate of the County for its proper management and administration and to fulfill any legal responsibilities of Business Associate; c. Disclose PHI in its possession to a third party for the proper management and administration of Business Associate, or to fulfill any legal responsibilities of Business Associate, provided that the disclosure would not violate HIPAA Laws if made by the County, or is required by law, and Business Associate has received from the third party written assurances that (i) the information will be kept confidential and used or further disclosed only for the purposes for which it was disclosed to the third party or as required by law; (ii) the third party will notify Business Associate of any instances of which it becomes aware in which the confidentiality of the information may have been breached; and (iii) the third party has agreed to implement reasonable and appropriate steps to safeguard the information; d. Use PHI to provide data aggregation activities relating to the operations of the County; and e. De-identify any and all PHI created or received by Business Associate under the Agreement, provided that the de-identification conforms to the requirements of the HIPAA Laws. 3.2 Business Associate shall limit its use and disclosure of, and request for PHI when practical or as required by law, to the information making up a Limited Data Set, as defined by HIPAA, and in all other cases subject to the requirements of 45 CFR 164.502(b), to the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure, or request. 3.3 Business Associate is prohibited from selling PHI, using PHI for marketing purposes, or attempting to re-identify any PHI information in violation of HIPAA Laws. 3.4 Business Associate shall implement administrative, physical, and technical safeguards that protect the confidentiality, integrity and availability of PHI that it creates, receives, maintains, or transmits on behalf of the County. The safeguards shall include written policies, procedures, a security risk assessment, training of Business Associate employees, and sanctions that are in compliance with HIPAA Laws. 3.5 Business Associate shall require all of its subcontractors, agents, and other third parties that receive, use, transmit, maintain, store, or have access to PHI to agree, in writing, to the same restrictions and conditions that apply to Business Associate pursuant to this BAA, including implementation of administrative, physical, and technical safeguards.

Obligations and Activities of the Business Associate. Use and Disclosure of PHI 3.1 The Business Associate shall not use or disclose PHI other than as permitted or required by this BAA or as required by law. Business Associate may: a. Use and disclose PHI only as necessary to perform its obligations under the Agreement, provided that such use or disclosure would not violate HIPAA Laws if done by the County; b. Use the PHI received in its capacity as a Business Associate of the County for its proper management and administration and to fulfill any legal responsibilities of Business Associate; c. Disclose PHI in its possession to a third party for the proper management and administration of Business Associate, or to fulfill any legal responsibilities of Business Associate, provided that the disclosure would not violate HIPAA Laws if made by the County, or is required by law, and Business Associate has received from the third party written assurances that (i) the information will be kept confidential and used or further disclosed only for the purposes for which it was disclosed to the third party or as required by law; (ii) the third party will notify Business Associate of any instances of which it becomes aware in which the confidentiality of the information may have been breached; and (iii) the third party has agreed to implement reasonable and appropriate steps to safeguard the information; d. Use PHI to provide data aggregation activities relating to the operations of the County; and e. De-identify any and all PHI created or received by Business Associate under the Agreement, provided that the de-identification conforms to the requirements of the HIPAA Laws. 3.2 Business Associate shall limit its use and disclosure of, and request for PHI when practical or as required by law, to the information making up a Limited Data Set, as defined by HIPAA, and in all other cases subject to the requirements of 45 CFR 164.502(b), to the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure, or request. 3.3 Business Associate is prohibited from selling PHI, using PHI for marketing purposes, or attempting to re-identify any PHI information in violation of HIPAA Laws.. Administrative, Physical, and Technical Safeguards 3.4 Business Associate shall implement administrative, physical, and technical safeguards that protect the confidentiality, integrity and availability of PHI that it creates, receives, maintains, or transmits on behalf of the County. The safeguards shall include written policies, procedures, a security risk assessment, training of Business Associate employees, and sanctions that are in compliance with HIPAA Laws. 3.5 Business Associate shall require all of its subcontractors, agents, and other third parties that receive, use, transmit, maintain, store, or have access to PHI to agree, in writing, to the same restrictions and conditions that apply to Business Associate pursuant to this BAA, including implementation of administrative, physical, and technical safeguards.