Common use of Obligations of Business Associate Clause in Contracts

Obligations of Business Associate. a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By Law. b. Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement. c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. d. Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware. e. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity, agrees to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. f. Business Associate agrees to provide access, at the request of Covered Entity, to Protected Health Information in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR 164.524. g. Business Associate agrees, at the request of the Covered Entity, to make any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526. h. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Davidson County Department of Social Services, in a time and manner designated by the Secretary, for purposes of the Davidson County Department of Social Services determining Covered Entity's compliance with the Privacy Rule. i. Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528, and to provide this information to Covered Entity or an Individual to permit such a response.

Obligations of Business Associate. a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By Law. b. Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement. c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. d. Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware. e. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity, Entity agrees to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. f. Business Associate agrees to provide access, at the request of Covered Entity, to Protected Health Information in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR 164.524. g. Business Associate agrees, at the request of the Covered Entity, to make any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526. h. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf ofof Covered Entity, Covered Entity available to the Covered Entity, or to the Davidson County Department of Social Services, in a time and manner designated by the Secretary, for purposes of the Davidson County Department of Social Services determining Covered Entity's compliance with the Privacy Rule. i. Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528, and to provide this information to Covered Entity or an Individual to permit such a response.

Obligations of Business Associate. a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By Law. b. Business Associate agrees to use appropriate safeguards and comply, where applicable, with subpart C of 45 C.F.R. Part 164 with respect to electronic protected health information, to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement. c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. d. Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware, including breaches of unsecured protected health information as required by 45 C.F.R. § 164.410. e. Business Associate agrees agrees, in accordance with 45 C.F.R. § 164.502(e)(1) and § 164.308(b)(2), to ensure that any agentsubcontractors that create, including a subcontractorreceive, to whom it provides Protected Health Information received frommaintain, or created or received by Business Associate transmit protected health information on behalf of Covered Entity, agrees Business Associate agree to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. f. Business Associate agrees to provide access, at the request of make available protected health information as necessary to satisfy Covered Entity, to Protected Health Information ’s obligations in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under accordance with 45 CFR C.F.R. § 164.524. g. Business Associate agrees, at the request of the Covered Entity, agrees to make available Protected Health Information for amendment and incorporate any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to accordance with 45 CFR C.F.R. § 164.526. h. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, records relating to the use and disclosure of Protected Health Information received from, from or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Davidson County Department of Social Services, in a time and manner designated by the Secretary, Secretary for purposes of the Davidson County Department of Social Services Secretary determining Covered Entity's ’s compliance with the Privacy Rule. i. Business Associate agrees to document such disclosures of Protected Health Information and make available the information related required to such disclosures as would be required for Covered Entity to respond to a request by an Individual for provide an accounting of disclosures of Protected Health Information in accordance with 45 CFR C.F.R. § 164.528, and to provide this information to Covered Entity or an Individual to permit such a response.

Obligations of Business Associate. a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By Law. b. Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement. c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. d. Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware. e. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity, agrees to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. f. Business Associate agrees to provide access, at the request of Covered Entity, to Protected Health Information in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR 164.524. g. Business Associate agrees, at the request of the Covered Entity, to make any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526. h. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Davidson (name) County Department of Social Services, in a time and manner designated by the Secretary, for purposes of the Davidson County Department of Social Services determining Covered Entity's compliance with the Privacy Rule.the i. Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528, and to provide this information to Covered Entity or an Individual to permit such a response.

Obligations of Business Associate. a. Business Associate agrees to not use or disclose Protected Health Information electronic protected health information or other protected health information other than as permitted or required by this Agreement or as Required By Lawrequired by law. b. Business Associate agrees to use appropriate implement administrative, physical, and technical safeguards to prevent use or disclosure that reasonably and appropriately protect the confidentiality, integrity, and availability of the Protected Health Information electronic protected health information and other than protected health information that it creates, receives, maintains, or transmits on behalf of Covered Entity, as provided for required by this Agreementthe Privacy and Security Rules. c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information electronic protected health information or other protected health information by Business Associate in violation of the requirements of this Agreement. d. Business Associate agrees to report to Covered Entity (i) any use or disclosure of the Protected Health Information electronic protected health information or other protected health information not provided for by this Agreement of which it becomes aware and (ii) any security incident of which it becomes aware. e. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information electronic protected health information and/or other protected health information received from, or created or received by Business Associate on behalf of Covered Entity, Entity (i) agrees to be bound by the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information, and (ii) agrees to implement reasonable and appropriate safeguards to protect such information. f. Business Associate agrees to provide access, at the request of Covered Entity, to Protected Health Information electronic protected health information and other protected health information in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual individual in order to meet the requirements under 45 CFR 164.524. g. Business Associate agrees, at the request of the Covered Entity, to make any amendment(s) to Protected Health Information electronic protected health information and other protected health information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526. h. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures concerning electronic protected health information and Protected Health Informationother protected health information, relating to the use and disclosure of Protected Health Information electronic protected health information and other protected health information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Davidson County Department of Social ServicesSecretary, in a time and manner designated by the Secretary, for purposes of the Davidson County Department of Social Services Secretary determining Covered Entity's compliance with the Privacy Ruleand Security Rules. i. Business Associate agrees to document such disclosures of Protected Health Information electronic protected health information and other protected health information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual individual for an accounting of disclosures of Protected Health Information electronic protected health information and other protected health information in accordance with 45 CFR 164.528, and to provide this information to Covered Entity or an Individual individual to permit such a response.

Obligations of Business Associate. a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By Law. b. Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement. c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. d. Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware. e. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity, agrees to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. f. Business Associate agrees to provide access, at the request of Covered Entity, to Protected Health Information in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR 164.524. g. Business Associate agrees, at the request of the Covered Entity, to make any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526. h. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Davidson (name) County Department of Social Services, in a time and manner designated by the Secretary, for purposes of the Davidson (name) County Department of Social Services determining Covered Entity's compliance with the Privacy Rule. i. Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528, and to provide this information to Covered Entity or an Individual to permit such a response.

Obligations of Business Associate. a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By Law. b. Business Associate agrees to use appropriate safeguards and comply, where applicable, with subpart C of 45 C.F.R. Part 164 with respect to electronic protected health information, to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement. c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. d. Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware, including breaches of unsecured protected health information as required by 45 C.F.R. § 164.410. e. Business Associate agrees agrees, in accordance with 45 C.F.R. § 164.502(e)(1) and § 164.308(b)(2), to ensure that any agentsubcontractors that create, including a subcontractorreceive, to whom it provides Protected Health Information received frommaintain, or created or received by Business Associate transmit protected health information on behalf of Covered Entity, agrees Business Associate agree to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. f. Business Associate agrees to provide access, at the request of make available protected health information as necessary to satisfy Covered Entity, to Protected Health Information ’s obligations in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under accordance with 45 CFR C.F.R. § 164.524. g. Business Associate agrees, at the request of the Covered Entity, agrees to make available Protected Health Information for amendment and incorporate any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to accordance with 45 CFR C.F.R. § 164.526. h. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, records relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Davidson County Department of Social Services, in a time and manner designated by the Secretary, Secretary for purposes of the Davidson County Department of Social Services Secretary determining Covered Entity's compliance with the Privacy Rule. i. Business Associate agrees to document such disclosures of Protected Health Information and make available the information related required to such disclosures as would be required for Covered Entity to respond to a request by an Individual for provide an accounting of disclosures of Protected Health Information in accordance with 45 CFR C.F.R. § 164.528, and to provide this information to Covered Entity or an Individual to permit such a response.

Obligations of Business Associate. a. Business Associate agrees to not use or disclose Protected Health Information electronic protected health information or other protected health information other than as permitted or required by this Agreement or as Required By Lawrequired by law. b. Business Associate agrees to use appropriate implement administrative, physical, and technical safeguards to prevent use or disclosure that reasonably and appropriately protect the confidentiality, integrity, and availability of the Protected Health Information electronic protected health information and other than protected health information that it creates, receives, maintains, or transmits on behalf of Covered Entity, as provided for required by this Agreementthe Privacy and Security Rules. c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information electronic protected health information or other protected health information by Business Associate in violation of the requirements of this Agreement. d. Business Associate agrees to report to Covered Entity (i) any use or disclosure of the Protected Health Information electronic protected health information or other protected health information not provided for by this Agreement of which it becomes aware and (ii) any security incident of which it becomes aware. e. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information electronic protected health information and/or other protected health information received from, or created or received by Business Associate on behalf of Covered Entity, Entity (i) agrees to be bound by the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information, and (ii) agrees to implement reasonable and appropriate safeguards to protect such information. f. Business Associate agrees to provide access, at the request of Covered Entity, to Protected Health Information electronic protected health information and other protected health information in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual individual in order to meet the requirements under 45 CFR 164.524. g. Business Associate agrees, at the request of the Covered Entity, to make any amendment(s) to Protected Health Information electronic protected health information and other protected health information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526. h. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures concerning electronic protected health information and Protected Health Informationother protected health information, relating to the use and disclosure of Protected Health Information electronic protected health information and other protected health information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Davidson County Department of Social ServicesSecretary, in a time and manner designated by the Secretary, for purposes of the Davidson County Department of Social Services Secretary determining Covered Entity's compliance with the Privacy Ruleand Security Rules. i. Business Associate agrees to document such disclosures of Protected Health Information electronic protected health information and other protected health information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual individual for an accounting of disclosures of Protected Health Information electronic protected health information and other protected health information in accordance with 45 CFR 164.528, and to provide this information to Covered Entity or an Individual individual to permit such a response.

Obligations of Business Associate. a. 1. Business Associate agrees to not use Use or disclose Protected Health Information Disclose PHI other than as permitted or required by this Agreement or as Required By by Law. b. 2. Business Associate agrees to use appropriate safeguards to prevent use inappropriate Use or disclosure Disclosure of the Protected Health Information PHI, other than as provided for by this Agreement. c. 3. As required by 45 CFR § 164.530(f), Business Associate agrees to mitigate, to the extent practicablepractical, any harmful effect that is known to Business Associate of a use Use or disclosure Disclosure of Protected Health Information PHI by Business Associate in violation of the requirements of this AgreementHIPAA. d. 4. Business Associate agrees to report to Covered Entity in writing any use Use or disclosure Disclosure of the Protected Health Information PHI not provided for by this Agreement and/or in violation of which it becomes awareHIPAA within time frames specified in Section 13402(d) of the HITECH Act. e. 5. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information PHI received from, or created by or received by Business Associate on behalf of Covered Entity agrees to the same restrictions and conditions that apply to Business Associate with respect to such information. 6. If Business Associate receives PHI from Covered Entity in a Designated Record Set, Business Associate agrees to provide access, at the request of Covered Entity, and in the time and manner reasonably designated by Covered Entity, to PHI in a Designated Record Set, to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements of 45 CFR § 164.524. 7. If Business Associate receives PHI from Covered Entity in a Designated Record Set, Business Associate agrees to make any amendments to PHI in a Designated Record Set that the Covered Entity reasonably directs or agrees to pursuant to 45 CFR § 164.526 at the request of Covered Entity or an Individual, and in the time and manner reasonably designated by Covered Entity. 8. Business Associate agrees to make its PHI and internal practices, books, and records, including policies and procedures, relating to the Use and Disclosure of PHI received from, created by or received by Business Associate on behalf of Covered Entity available to the Covered Entity, or to the Secretary, in the manner lawfully designated by the Secretary, for purposes of the Secretary determining Covered Entity's compliance with HIPAA. Business Associate shall provide to Covered Entity a copy of any PHI that Business Associate provides to the Secretary concurrently with providing such PHI to the Secretary. 9. Business Associate agrees to document its Disclosures of PHI and information related to such Disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. 10. Business Associate agrees to provide to Covered Entity in a time and manner reasonably designated by Covered Entity, information collected in accordance with this Agreement, to permit Covered Entity to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. 11. Business Associate (and its agents or subcontractors) shall only request, Use and Disclose the minimum amount of PHI necessary to accomplish the purpose of the request, Use or Disclosure. 12. Business Associate agrees to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the Electronic PHI that it creates, receives, maintains, or transmits on behalf of Covered Entity as required by 45 CFR § 164.314. 13. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Electronic PHI, agrees to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. f. 14. Business Associate agrees to provide access, at the request of Covered Entity, report within one (1) to Protected Health Information in a Designated Record Set five (5) days to Covered Entity or, as directed by Covered Entity, any Security Incidents to an Individual in order which Business Associate becomes aware and assumes liability related to meet the requirements under 45 CFR 164.524PHI security breaches attributable to Business Associate. g. 15. Business Associate agrees, at the request of the Covered Entity, to make any amendment(s) to Protected Health Information in a Designated Record Set acknowledges that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526. h. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, relating has no ownership rights with respect to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Davidson County Department of Social Services, in a time and manner designated by the Secretary, for purposes of the Davidson County Department of Social Services determining Covered Entity's compliance with the Privacy RulePHI. i. Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528, and to provide this information to Covered Entity or an Individual to permit such a response.

Obligations of Business Associate. a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By Law. b. Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement. c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. d. Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware. e. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity, agrees to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. f. Business Associate agrees to provide access, at the request of Covered Entity, to Protected Health Information in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR 164.524. g. Business Associate agrees, at the request of the Covered Entity, to make any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526. h. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf ofof Covered Entity, Covered Entity available to the Covered Entity, Entity or to the Davidson County Department of Social ServicesGUILFORD COUNTY DEPARTMENT OF HEALTH AND HUMAN SERVICES, in a time and manner designated by the Secretary, for purposes of the Davidson County Department of Social Services GUILFORD COUNTY DEPARTMENT OF HEALTH AND HUMAN SERVICES determining Covered Entity's compliance with the Privacy Rule. i. Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528, and to provide this information to Covered Entity or an Individual to permit such a response.

Obligations of Business Associate. a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By Law. b. Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement. c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. d. Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware. e. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity, agrees to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. f. Business Associate agrees to provide access, at the request of Covered Entity, to Protected Health Information in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR 164.524. g. Business Associate agrees, at the request of the Covered Entity, to make any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526. h. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Davidson Guilford County Department of Social Health and Human Services, in a time and manner designated by the Secretary, for purposes of the Davidson Guilford County Department of Social Health and Human Services determining Covered Entity's compliance with the Privacy Rule. i. Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528, and to provide this information to Covered Entity or an Individual to permit such a response.

Obligations of Business Associate. a. Business Associate agrees to not use or disclose Protected Health Information electronic protected health information or other protected health information other than as permitted or required by this Agreement or as Required By Lawrequired by law. b. Business Associate agrees to use appropriate implement administrative, physical, and technical safeguards to prevent use or disclosure that reasonably and appropriately protect the confidentiality, integrity, and availability of the Protected Health Information electronic protected health information and other than protected health information that it creates, receives, maintains, or transmits on behalf of Covered Entity, as provided for required by this Agreementthe Privacy and Security Rules. c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information electronic protected health information or other protected health information by Business Associate in violation of the requirements of this Agreement. d. Business Associate agrees to report to Covered Entity (i) any use or of disclosure of the Protected Health Information electronic protected health information or other protected health information not provided for by this Agreement of which it becomes aware and (ii) any security incident of which it becomes aware. e. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information electronic protected health information and/or other protected health information received from, or created or received by Business Associate on behalf of Covered Entity, Entity (i) agrees to be bound by the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information, and (ii) agrees to implement reasonable and appropriate safeguards to protect such information. f. Business Associate agrees to provide access, at the request of Covered Entity, to Protected Health Information electronic protected health information and other protected health information in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual individual in order to meet the requirements under 45 CFR 164.524. g. Business Associate agrees, at the that request of the Covered Entity, to make any amendment(s) to Protected Health Information electronic protected health information and other protected health information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526. h. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures concerning electronic protected health information and Protected Health Information, other protected health information relating to the use and disclosure of Protected Health Information electronic protected health information and other protected health information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Davidson County Department of Social ServicesSecretary, in a time and manner designated by the Secretary, Secretary for the purposes of the Davidson County Department of Social Services Secretary determining Covered Entity's ’s compliance with the Privacy Ruleand Security Rules. i. Business Associate agrees to document such disclosures of Protected Health Information electronic protected health information and other protected health information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual individual for an accounting of disclosures of Protected Health Information electronic protected health information and other protected health information in accordance with 45 CFR 164.528, and to provide this information to Covered Entity or an Individual individual to permit such a response. x. Xxxxxxxx Associate agrees to notify each individual whose PHI has been, or is reasonably believed by the Covered Entity to have been, accessed, acquired, used or disclosed as a result a breach, pursuant to CFR 164.410 except when Law Enforcement requires a delay pursuant to 45 CFR 164.412. k. Without unreasonable delay and in no case later than sixty ( 60) days after discovery of a breach by notice in plain language including and to the extent possible, Covered Entity shall notify individuals and Media if required in a manner that meets the requirements of 45 CFR 164-404 (d) per the following: 1. A brief description of what happened, including the date of the breach and the date the breach was discovered. 2. A description of the types of Protected Health Information (PHI) that were involved in the breach (such as what information was involved; name, social security number, diagnosis, or any other types of identifying information involved. 3. Any steps individuals should take to protect themselves from potential harm resulting from the breach. 4. A brief description of what the covered entity is doing to investigate the breach, to mitigate harm to individuals, and to protect against further breaches; and, 5. Contact procedures for individuals to ask questions or learn additional information, which shall include a toll-free telephone number, an email address, web site and/or postal address. 6. Prominent media outlets serving the state or jurisdiction of the affected residents shall be notified only if there are more than 500 individuals affected in a single state of jurisdiction.

Obligations of Business Associate. a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By by Law. b. Business Associate agrees to use appropriate safeguards and comply, where applicable, with subpart C of 45 C.F.R. Part 164 with respect to the electronic protected health information, to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement. c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. d. Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware, including breaches of unsecured protected health information as required by 45 C.F.R 164.410. e. Business Associate agrees agrees, in accordance with 45 C.F.R. 164.502(e)(1) and 164.308(b)(2), to ensure that any agentsubcontractors that create, including a subcontractorreceive, to whom it provides Protected Health Information received frommaintain, or created or received by Business Associate transmit protected health information on behalf of Covered Entity, agrees Business Associate agree to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. f. Business Associate agrees to provide access, at the request of make available protected health information as necessary to satisfy Covered Entity, to Protected Health Information ’s obligations in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under accordance with 45 CFR C.F.R 164.524. g. Business Associate agrees, at the request of the Covered Entity, agrees to make available Protected Health Information for amendment and incorporate any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to accordance with 45 CFR C.F.R. 164.526. h. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, records relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Davidson County Department of Social Services, in a time and manner designated by the Secretary, Secretary for purposes of the Davidson County Department of Social Services determining Covered Entity's ’s compliance with the Privacy Rule. i. Business Associate agrees to document such disclosures of Protected Health Information and make available the information related required to such disclosures as would be required for Covered Entity to respond to a request by an Individual for provide an accounting of disclosures of Protected Health Information in accordance with 45 CFR C.F.R. 164.528, and to provide this information to Covered Entity or an Individual to permit such a response.

Obligations of Business Associate. a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By Lawlaw. b. Business Associate agrees to use appropriate safeguards and comply, where applicable, with subpart C of 45 C.F.R. Part 164 with respect to electronic protected health information, to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement. c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. d. Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware, including breaches of unsecured Protected Health Information as required by 45 C.F.R. 164.410. e. Business Associate agrees agrees, in accordance with 45 C.F.R. 164.502(e)(1) and 164.308(b)(2), to ensure that any agentsubcontractors that create, including a subcontractorreceive, to whom it provides Protected Health Information received from, maintain or created or received by Business Associate transmit protected health information on behalf of Covered Entity, agrees Business Associate agree to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. f. Business Associate agrees to provide access, at the request of Covered Entity, to make available Protected Health Information in a Designated Record Set as necessary to Covered Entity or, as directed by satisfy Covered Entity, to an Individual 's obligations in order to meet the requirements under accordance with 45 CFR C.F.R. 164.524. g. Business Associate agrees, at the request of the Covered Entity, agrees to make available Protected Health Information for amendment so that Covered Entity can incorporate any amendment(s) amendments to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to accordance with 45 CFR C.F.R. 164.526. h. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, records relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Davidson County Department of Social Services, in a time and manner designated by the Secretary, Secretary for purposes of the Davidson County Department of Social Services Secretary determining Covered Entity's compliance with the Privacy Rule. i. Business Associate agrees to document such disclosures of Protected Health Information and make available the information related required to such disclosures as would be required for Covered Entity to respond to a request by an Individual for provide an accounting of disclosures of Protected Health Information in accordance with 45 CFR C.F.R. - 164.528, and to provide this information to Covered Entity or an Individual to permit such a response.

Obligations of Business Associate. In connection with this Agreement and in consideration of the mutual promises contained herein, the sufficiency of which is acknowledged by the parties, the parties hereby agree as follows: a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By Lawrequired by law. b. Business Associate agrees to use appropriate reasonable administrative, physical and technical safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement. c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. d. Business Associate agrees to report to Covered Entity any use unauthorized acquisition, access, use, or disclosure of unsecured PHI the Protected Health Information not provided for by this Agreement Business Associate holds on behalf of the covered entity, including the identity of each individual who is the subject of the unsecured PHI of which it becomes awareaware without unreasonable delay and in no case later than ten calendar days after the discovery of the breach. e. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of of, Covered Entity, Entity agrees to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information.. DHS-4001 rev. 80/63/00/32/01100 Page 2 of 6 f. Business Associate agrees to provide access, at the request of Covered Entity, to Protected Health Information in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR 164.524. g. Business Associate agrees, at the request of the Covered Entity, to make any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526. h. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Davidson County Department of Social ServicesSecretary, in a time and manner designated by the Secretary, for purposes of the Davidson County Department of Social Services Secretary determining Covered Entity's compliance with the Privacy Rule. i. Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528, and to provide this information to Covered Entity or an Individual to permit such a response. Business Associate agrees to implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the Protected Health Information that the Business Associate creates, receives, maintains or transmits on behalf of the Covered Entity.

Obligations of Business Associate. a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By by Law. b. Business Associate agrees to use appropriate safeguards and comply, where applicable, with subpart C of 45 C.F.R. Part 164 with respect to prevent use electronic protected health information, to preventuse or disclosure of the Protected Health Information other than as provided for by this Agreement. c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to knownto Business Associate of a use or disclosure of Protected Health Information by Business Associate in Associatein violation of the requirements of this Agreement. d. Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware, including breaches of unsecured protected health information as required by 45 C.F.R. § 164.410. e. Business Associate agrees agrees, in accordance with 45 C.F.R. § 164.502(e)(1) and § 164.308(b)(2), to ensure that any agentsubcontractors that create, including a subcontractorreceive, to whom it provides Protected Health Information received frommaintain, or created or received by Business Associate transmit protected health information on behalf of Covered Entity, agrees Business Associate agree to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. f. Business Associate agrees to provide access, at the request of make available protected health information as necessary to satisfy Covered Entity, to Protected Health Information ’s obligations in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under accordance with 45 CFR C.F.R. § 164.524. g. Business Associate agrees, at the request of the Covered Entity, agrees to make available Protected Health Information for amendment and incorporate any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to accordance with 45 CFR C.F.R. § 164.526. h. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, records relating to the use and disclosure of Protected Health Information received from, or created or received received, by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Davidson County Department of Social Services, in a time and manner designated by the Secretary, for Secretaryfor purposes of the Davidson County Department of Social Services Secretary determining Covered Entity's compliance with the Privacy Rule. i. Business Associate agrees to document such disclosures of Protected Health Information and make available the information related required to such disclosures as would be required for Covered Entity to respond to a request by an Individual for provide an accounting of disclosures of Protected Health Information in accordance with 45 CFR C.F.R. § 164.528, and to provide this information to Covered Entity or an Individual to permit such a response.

Obligations of Business Associate. a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By Law. b. . Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement. c. . Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. d. . Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware. e. . Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity, Entity agrees to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. f. . Business Associate agrees to provide access, at the request of Covered Entity, to Protected Health Information in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR 164.524. g. . Business Associate agrees, at the request of the Covered Entity, to make any amendment(s) amendments to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526. h. . Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Davidson County Department of Social ServicesSecretary, in a time and manner designated by the Secretary, for purposes of the Davidson County Department of Social Services Secretary determining Covered Entity's compliance with the Privacy Rule. i. . Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528, and to provide this information to Covered Entity or an Individual to permit such a response.

Obligations of Business Associate. In connection with this Agreement and in consideration of the mutual promises contained herein, the sufficiency of which is acknowledged by the parties, the parties hereby agree as follows: a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By Lawrequired by law. b. Business Associate agrees to use appropriate reasonable administrative, physical and technical safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement. c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. d. Business Associate agrees to report to Covered Entity any use unauthorized acquisition, access, use, or disclosure of unsecured PHI the Protected Health Information not provided for by this Agreement Business Associate holds on behalf of the covered entity, including the identity of each individual who is the subject of the unsecured PHI of which it becomes awareaware without unreasonable delay and in no case later than ten calendar days after the discovery of the breach. e. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of of, Covered Entity, Entity agrees to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. f. Business Associate agrees to provide access, at the request of Covered Entity, to Protected Health Information in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR 164.524. g. Business Associate agrees, at the request of the Covered Entity, to make any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526. h. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Davidson County Department of Social ServicesSecretary, in a time and manner designated by the Secretary, for purposes of the Davidson County Department of Social Services Secretary determining Covered Entity's compliance with the Privacy Rule. i. Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528, and to provide this information to Covered Entity or an Individual to permit such a response. Business Associate agrees to implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the Protected Health Information that the Business Associate creates, receives, maintains or transmits on behalf of the Covered Entity.

Obligations of Business Associate. With regard to its use and disclosure of PHI, BA agrees that: a. Business Associate agrees to It will not use or further disclose Protected Health Information PHI other than as permitted or required by this Agreement BAA or as Required By Lawrequired by law. BA shall implement and use appropriate safeguards, and comply, where applicable, with the HIPAA Security Rule with respect to electronic protected health information and documentation requirements. BA acknowledges and agrees that the administrative, physical and technical safeguards requirements of 45 CFR Sections 164.308, 164.310 and 164.312 shall apply to the BA in the same manner that such sections apply to the Covered Entity. b. Business Associate agrees to It will use appropriate safeguards to prevent use or disclosure of the Protected Health Information PHI other than as provided for by this AgreementBAA. c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. d. Business Associate agrees to It will report to Covered Entity any use or disclosure of the Protected Health Information not provided for by PHI in violation of this Agreement of which it BA becomes aware. e. Business Associate agrees to d. It will ensure that any agentagents, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate PHI on behalf of Covered Entity, agrees to the same restrictions and conditions that apply through this Agreement to Business Associate the BA with respect to such information. f. Business Associate agrees to provide access. BA shall ensure that any agent, at the request of Covered Entityincluding a subcontractor, to Protected Health Information whom it provides PHI agrees in a Designated Record Set writing to Covered Entity or, as directed by Covered Entity, implement reasonable and appropriate safeguards to an Individual in order protect it; and report to meet the requirements under 45 CFR 164.524. g. Business Associate agrees, at the request of the Covered Entity, to make any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526any security incidents of which it becomes aware. h. Unless otherwise prohibited e. It will document any and all disclosures of PHI by law, Business Associate agrees to make internal practices, books, and recordsBA or its agents, including policies and procedures and Protected Health Informationsubcontractors, relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Davidson County Department of Social Services, in a time and manner designated by the Secretary, for purposes of the Davidson County Department of Social Services determining Covered Entity's compliance with the Privacy Rule. i. Business Associate agrees to document such disclosures of Protected Health Information and as well as any other information related to such disclosures as of PHI that would be required for Covered Entity to respond to a an Individual’s request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528C.F.R. 164.528 and will make such documentation and disclosure available to the Covered Entity. f. It will, subject to any applicable privilege, following consultation with Covered Entity, make available to the Secretary of the U.S. Department of Health and Human Services (“HHS”) any and all internal practices, books, and records of BA or its agents, including subcontractors, relating to provide this the use and disclosure of PHI, for purposes of determining Covered Entity’s compliance with the Privacy Rule. g. It will notify Covered Entity of any and all requests by the Secretary of HHS for information prior to any release of information thereunder. h. It will, as required by the HITECH Act, comply with 45 C.F.R. 164.308, 164.310, 164.312, and 164.315 of the Security Rule. i. It will, as required by the HITECH Act, determine the Minimum Necessary PHI to be disclosed for uses, disclosures or requests of or for Covered Entity’s PHI, other than those exempt from the Minimum Necessary requirement specified in 45 C.F.R. 164.502(b)(2), in order to accomplish the intended purpose of the use, disclosure, or request, consistent with the terms of the BAA. To the extent practicable and consistent with the terms of the BAA, the Minimum Necessary shall be the information contained in a Limited Data Set, as defined in 45 C.F.R. 164.514(e)(2). j. As required by the HITECH Act, effective not later than six (6) months after the date on which the Secretary publishes applicable final regulations, BA will not, directly or indirectly, receive remuneration in exchange for Covered Entity’s PHI unless BA or Covered Entity has obtained an authorization from the subject Individual(s), which complies with all applicable requirements, or otherwise permitted by the Rules. BA may not rely on any of the foregoing exceptions without advance notice to Covered Entity describing the types of circumstances and the applicable exceptions to be relied upon by BA. k. To the extent the BA is to carry out one or an Individual more of Covered Entity’s obligation(s) under Subpart E of 45 CFR Part 164, BA agrees to permit comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such a responseobligation(s). BA further agrees not to use or disclose PHI other than as permitted or required by the Agreement, in furtherance of the services provided by BA for Covered Entity, or as required by law. BA will not sell PHI and Electronic Health Records or use or disclose PHI for marketing or fundraising purposes as set forth in 42 U.S.C. § 17935(d) or 42 U.S.C. § 17936(a), respectively. The BA shall secure PHI in accordance with 42 U.S.C. § 17932(h) and the related regulations at 45 CFR Part 14, subpart D, as well as any guidance issued by the Secretary that specifies secure technologies and methodologies such that Unsecured PHI is not maintained by the BA.

Obligations of Business Associate. a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By Lawlaw. b. Business Associate agrees to use appropriate safeguards and comply, where applicable, with subpart C of 45 C.F.R. Part 164 with respect to electronic protected health information, to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement. c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. d. Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware, including breaches of unsecured Protected Health Information as required by 45 C.F.R. 164.410. e. Business Associate agrees agrees, in accordance with 45 C.F.R. 164.502(e)(1) and 164.308(b)(2), to ensure that any agentsubcontractors that create, including a subcontractorreceive, to whom it provides Protected Health Information received from, maintain or created or received by Business Associate transmit protected health information on behalf of Covered Entity, agrees Business Associate agree to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. f. Business Associate agrees to provide access, at the request of Covered Entity, to make available Protected Health Information in a Designated Record Set as necessary to Covered Entity or, as directed by satisfy Covered Entity, to an Individual 's obligations in order to meet the requirements under accordance with 45 CFR C.F.R. 164.524. g. Business Associate agrees, at the request of the Covered Entity, agrees to make available Protected Health Information for amendment and incorporate any amendment(s) amendments to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to accordance with 45 CFR 164.526C.F.R. -164.526. h. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, records relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Davidson County Department of Social Services, in a time and manner designated by the Secretary, Secretary for purposes of the Davidson County Department of Social Services Secretary determining Covered Entity's compliance with the Privacy Rule. i. Business Associate agrees to document such disclosures of Protected Health Information and make available the information related required to such disclosures as would be required for Covered Entity to respond to a request by an Individual for provide an accounting of disclosures of Protected Health Information in accordance with 45 CFR C.F.R. - 164.528, and to provide this information to Covered Entity or an Individual to permit such a response.

Obligations of Business Associate. a. A. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement Contract or as Required By Lawrequired by law. b. B. Business Associate agrees to use appropriate safeguards and comply, where applicable, with subpart C of 45 C.F.R. Part 164 with respect to electronic protected health information, to prevent use or disclosure of the Protected Health Information other than as provided for by this AgreementContract. c. C. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this AgreementContract. d. D. Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement Contract of which it becomes aware, including breaches of unsecured protected health information as required by 45 C.F.R. § 164.410. e. E. Business Associate agrees agrees, in accordance with 45 C.F.R. § 164.502(e)(1) and § 164.308(b)(2), to ensure that any agentsubcontractors that create, including a subcontractorreceive, to whom it provides Protected Health Information received frommaintain, or created or received by Business Associate transmit protected health information on behalf of Covered Entity, agrees Business Associate agree to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. f. F. Business Associate agrees to provide access, at the request of make available protected health information as necessary to satisfy Covered Entity, ’s obligations in accordance with 45 C.F.R. § 164.524. G. Business Associate agrees to make available Protected Health Information in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR 164.524. g. Business Associate agrees, at the request of the Covered Entity, to make for amendment and incorporate any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to accordance with 45 CFR C.F.R. § 164.526. h. Unless X. Xxxxxx otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, records relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Davidson County Department of Social Services, in a time and manner designated by the Secretary, Secretary for purposes of the Davidson County Department of Social Services Secretary determining Covered Entity's compliance with the Privacy Rule. i. I. Business Associate agrees to document such disclosures of Protected Health Information and make available the information related required to such disclosures as would be required for Covered Entity to respond to a request by an Individual for provide an accounting of disclosures of Protected Health Information in accordance with 45 CFR C.F.R. § 164.528, and to provide this information to Covered Entity or an Individual to permit such a response.,

Obligations of Business Associate. a. With regard to its use and disclosure of PHI, Business Associate agrees to not shall: A. Not use or disclose Protected Health Information PHI other than as permitted or required by this the Underlying Agreement or as Required By Law.required by law; b. Business Associate agrees to B. Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI and use appropriate safeguards to prevent use or disclosure of the Protected Health Information PHI other than as permitted here; C. Report to Covered Entity any use or disclosure of PHI not provided for by this Agreement. c. BAA and any Security Incident of which Business Associate agrees becomes aware; D. Use reasonable commercial efforts to mitigate, to the extent practicable, mitigate any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information PHI by Business Associate in violation of the requirements of this Agreement.BAA; d. E. Ensure that any agents and subcontractors to whom Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware. e. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity, agrees PHI agree to the same restrictions and conditions via a written business associate agreement between that apply through this Agreement BAA to Business Associate and that such agents and subcontractors implement reasonable and appropriate safeguards with respect to such information.PHI; f. F. Make available to Covered Entity any PHI maintained by Business Associate agrees to provide access, at the request of Covered Entity, to Protected Health Information in a Designated Record Set to Covered Entity or, as directed by within 20 days of receiving a written request from Covered Entity, so that Covered Entity can respond to an Individual in order requests for access or amendments; G. Incorporate amendments to meet the requirements under 45 CFR 164.524. g. any PHI maintained by Business Associate agrees, at the request of the Covered Entity, to make any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526. h. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, relating to the use and disclosure within 40 days of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the receiving a written request from Covered Entity, or to the Davidson County Department of Social Services, in a time and manner designated by the Secretary, for purposes of the Davidson County Department of Social Services determining Covered Entity's compliance with the Privacy Rule.; i. Business Associate agrees to document such H. Document disclosures of Protected Health Information PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528, PHI and to provide this information accounting to Covered Entity or an Individual within 40 days of receiving a written request from Covered Entity, at the address specified by Covered Entity in the request; and I. Make Business Associate’s internal practices, books and records relating to permit such a responsethe use and disclosure of PHI and Business Associate’s policies, procedures and documentation related to the safeguards required by the Security Rule available to the Secretary for purposes of determining Covered Entity’s compliance with the HIPAA Regulations.

Obligations of Business Associate. a. (a) Business Associate agrees to not use or disclose Electronic Protected Health Information or other Protected Health Information other than as permitted or required by this Agreement or as Required By by Law. b. (b) Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the Electronic Protected Health Information and other Protected Health Information that it creates, receives, maintains, or transmits on behalf of Covered Entity, other than as provided for by this Agreement, as required by the Privacy and Security Rules. Business Associate shall review and modify its security measures and safeguards to continue provision of reasonable and appropriate protection of Electronic Protected Health Information, and update documentation of such security measures. c. (c) Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Electronic Protected Health Information or other Protected Health Information by Business Associate in violation of the requirements of this Agreement. d. (d) Business Associate agrees to report to Covered Entity (i) any use or disclosure of the Electronic Protected Health Information or other Protected Health Information not provided for by this Agreement of which it becomes aware and (ii) any Security Incident or Breach of which it becomes aware. e. (e) Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Electronic Protected Health Information and/or other Protected Health Information received from, or created created, received or received transmitted by Business Associate on behalf of Covered Entity, agrees to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. f. (f) Business Associate agrees to provide access, at the request of Covered Entity, to Electronic Protected Health Information and other Protected Health Information in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR 164.524. g. (g) Business Associate agrees, at the request of the Covered Entity, to make any amendment(s) to Electronic Protected Health Information and other Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526. h. (h) Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures concerning Electronic Protected Health Information and other Protected Health Information, relating to the use and disclosure of Electronic Protected Health Information and other Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Davidson Union County Department of Social ServicesConsolidated Human Services Agency, in a time and manner designated by the Secretary, for purposes of the Davidson County Department of Social Services Secretary determining Covered Entity's compliance with the Privacy Ruleand Security Rules. i. (i) Business Associate agrees to document such disclosures of Electronic Protected Health Information and information other Protected Health Information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual individual for an accounting of disclosures of Electronic Protected Health Information and other Protected Health Information by Business Associate or its agents, including subcontractors, in accordance with 45 CFR 164.528164.528 and Section 13405(c)(3) of the HITECH Act, and to provide this information to Covered Entity or an Individual individual to permit such a response. (j) Business Associate will, pursuant to the HITECH Act and its implementing regulations, comply with all additional requirements of the Privacy and Security Rules as applicable to Business Associate, including specifically, but not limited to, the requirements of 45 CFR 164.308, 164.310, 164.312, and 164.316. (k) Following the discovery of a breach of security for unsecured Protected Health Information subject to this Agreement, Business Associate shall notify Covered Entity of the breach pursuant to 45 CFR 164.410 and Section 13402 of the HITECH Act, and shall include in the notification the information required by those provisions. Business Associate shall cooperate fully with and provide any information requested by Covered Entity in the Covered Entity’s breach analysis procedures, including risk assessment. A breach shall be treated as discovered by Business Associate as of the first day on which such breach is known, or reasonably should have been known, to Business Associate to have occurred. Business Associate shall provide notification to Covered Entity without unreasonable delay, and in no event less than 30 calendar days after discovery of a breach by Business Associate. (l) Business Associate will, pursuant to the HITECH Act and its implementing regulations, comply with all additional applicable requirements of the Privacy Rule, including those contained in 45 CFR 164.502(e) and 164.504(e)(1)(ii), at such time as the requirements are applicable to Business Associate. (m) Business Associate shall not directly or indirectly receive remuneration in exchange for any protected health information except as specifically authorized by the Contract and by the HITECH Act Section 13405(d) and its implementing regulations. (n) Business Associate shall not engage in any communications within the definition of “marketing” in the HITECH Act except as authorized by the Contract and by the HITECH Act and its implementing regulations.

Obligations of Business Associate. a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By Law. b. Business Associate agrees to use will establish and maintain appropriate safeguards to prevent use any Use or disclosure Disclosure of the Protected Health Information PHI, other than as provided for by this AgreementAgreement or as required by law. Business Associate shall ensure that any subcontractors or agents to whom it provides PHI agree in writing to the same terms, conditions and restrictions contained in this Appendix that apply to Business Associate with respect to the Use and Disclosure of PHI. b. Covered Entity shall not delegate to Business Associate the determination and processing of an Individual member’s request for amendments to his or her PHI in a Designated Record Set. Business Associate shall promptly forward all requests for amendments to PHI to Covered Entity upon receipt. Covered Entity will make the final determination to grant or deny amendments and complete all required processing. Business Associate hereby agrees to make amendments to PHI in a Designated Record Set as and when approved by Covered Entity so as to permit Covered Entity to timely comply with the requirements of 45 C.F.R. 164.526. c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known Covered Entity shall not delegate to Business Associate the determination and processing of Individual member requests for an accounting of Disclosures of PHI. Business Associate shall promptly forward all requests for an accounting of Disclosures of PHI to Covered Entity upon receipt. Covered Entity will complete all required processing in connection with such request. Business Associate hereby agrees to promptly make available information collected relating to applicable accountings of PHI Disclosures to Covered Entity, so as to permit Covered Entity to timely respond to a use or disclosure request by an Individual for an accounting of Disclosures of Protected Health Information by in accordance with 45 C.F.R. 164.528 d. Covered Entity shall not delegate to Business Associate the determination and processing of an Individual’s request for access to his or her PHI in violation of a Designated Record Set. Business Associate shall promptly forward all requests for access to PHI to Covered Entity upon receipt. Covered Entity will make the final determination to grant or deny access to PHI in a Designated Record Set and complete all required processing in connection with such access. Business Associate hereby agrees to promptly make available PHI in a Designated Record Set to Covered Entity so as to permit Covered Entity to timely comply with the requirements of this Agreement. d. Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware45 C.F.R. 164.524. e. Business Associate agrees to ensure make available to the Secretary (i) Business Associate’s internal practices, books and records relating to the Use and Disclosure of PHI for the purposes of determining Covered Entity’s compliance with the Privacy Rule; and (ii) Business Associate’s policies, procedures and documentation relating to the safeguards described herein, for the purposes of determining Covered Entity’s compliance with the Security Rule. f. Business Associate shall have procedures in place for mitigating any injurious or harmful effect from the Use or Disclosure of PHI in a manner contrary to this Appendix. g. Business Associate agrees that it will: (1) Implement Administrative Safeguards, Physical Safeguards, and Technical Safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of EPHI; (2) Ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity, such information agrees to the same restrictions implement reasonable and conditions that apply through this Agreement appropriate safeguards to Business Associate with respect to such information.protect it; and f. Business Associate agrees to provide access, at the request of Covered Entity, to Protected Health Information in a Designated Record Set (3) Report to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR 164.524any Security Incident of which it becomes aware. g. Business Associate agrees, at the request of the Covered Entity, to make any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526. h. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Davidson County Department of Social Services, in a time and manner designated by the Secretary, for purposes of the Davidson County Department of Social Services determining Covered Entity's compliance with the Privacy Rule. i. Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528, and to provide this information to Covered Entity or an Individual to permit such a response.

Obligations of Business Associate. a. A. Business Associate agrees to not use Use or disclose Protected Health Information Disclose PHI other than as permitted or required by this Agreement Addendum, the Agreement, or as Required By Law. In case of any conflict between this Addendum and the Agreement, this Addendum shall govern. b. B. Business Associate agrees to use appropriate safeguards to prevent use inappropriate Use or disclosure Disclosure of the Protected Health Information PHI, other than as provided for by this AgreementAddendum. c. C. As required by 45 CFR § 164.530(f), Business Associate agrees to mitigate, to the extent practicablepractical, any harmful effect that is known to Business Associate of a use Use or disclosure Disclosure of Protected Health Information PHI by Business Associate in violation of the requirements of this AgreementPrivacy and Security Rules. d. D. Business Associate agrees to report to Covered Entity in writing any use Use or disclosure Disclosure of the Protected Health Information PHI not provided for by this Agreement Addendum and/or in violation of which it becomes awarethe Privacy and Security Rules within five (5) days of becoming aware of such Use or Disclosure. e. E. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information PHI received from, or created by or received by Business Associate on behalf of Covered Entity, Entity agrees to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. f. F. If Business Associate receives PHI from Covered Entity in a Designated Record Set, Business Associate agrees to provide access, at the request of Covered Entity, and in the time and manner reasonably designated by Covered Entity, to Protected Health Information PHI in a Designated Record Set Set, to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under of 45 CFR § 164.524. g. G. If Business Associate agreesreceives PHI from Covered Entity in a Designated Record Set, at the request of the Covered Entity, Business Associate agrees to make any amendment(s) amendments to Protected Health Information PHI in a Designated Record Set that the Covered Entity reasonably directs or agrees to pursuant to 45 CFR 164.526§ 164.526 at the request of Covered Entity or an Individual, and in the time and manner reasonably designated by Covered Entity. h. Unless otherwise prohibited by law, H. Business Associate agrees to make its PHI and internal practices, books, and records, including policies and procedures and Protected Health Informationprocedures, relating to the use Use and disclosure Disclosure of Protected Health Information PHI received from, or created by or received by Business Associate on behalf of, of Covered Entity available to the Covered Entity, or to the Davidson County Department of Social ServicesSecretary, in a time and the manner lawfully designated by the Secretary, for purposes of the Davidson County Department of Social Services Secretary determining Covered Entity's compliance with the Privacy Ruleand Security Rules. Business Associate shall provide to Covered Entity a copy of any PHI that Business Associate provides to the Secretary concurrently with providing such PHI to the Secretary. i. I. Business Associate agrees to document such disclosures its Disclosures of Protected Health Information PHI and information related to such disclosures Disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures Disclosures of Protected Health Information PHI in accordance with 45 CFR § 164.528, and . J. Business Associate agrees to provide this information to Covered Entity or in a time and manner reasonably designated by Covered Entity, information collected in accordance with this Addendum, to permit Covered Entity to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528. K. Business Associate (and its agents or subcontractors) shall only request, Use and Disclose the minimum amount of PHI necessary to permit such accomplish the purpose of the request, Use or Disclosure. L. Business Associate agrees to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the Electronic PHI that it creates, receives, maintains, or transmits on behalf of Covered Entity as required by 45 CFR § 164.314. M. Business Associate agrees to ensure that any agent, including a responsesubcontractor, to whom it provides Electronic PHI, agrees to implement reasonable and appropriate safeguards to protect the PHI. N. Business Associate agrees to report to Covered Entity any Security Incidents to which Business Associate becomes aware. O. Business Associate acknowledges that Business Associate has no ownership rights with respect to the PHI.

Obligations of Business Associate. a. A. Business Associate agrees not to not use or disclose Protected Health Information PHI other than as permitted or required by this Agreement or as Required By Lawrequired by law. b. B. Business Associate agrees to use appropriate safeguards to prevent the use or disclosure of the Protected Health Information PHI other than as provided for by in this Agreement, and to have written documentation of such safeguards. C. Business Associate agrees to report to Covered Entity within forty-eight (48) hours any use or disclosure, of which it becomes aware, that is in violation of this Agreement. c. D. Business Associate agrees to mitigate, to the extent practicablepractical, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information PHI by Business Associate in violation of the requirements of this Agreement, in accordance with 45 CFR 164.530(f). d. Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware. e. E. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of Covered EntityPHI, agrees in writing to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. f. F. Business Associate agrees to provide accessaccess to PHI, at the request make amendments to PHI, and provide an accounting of disclosures of PHI, contained in a designated record set, as reasonably requested by an individual, in accordance with 45 CFR 164.524, 164.526, and 164.528, respectively. Business Associate shall document and provide reports to Covered Entity, to Protected Health Information in a Designated Record Set to Covered Entity or, as directed reasonably requested by Covered Entity, of Business Associate’s receipt of and response to such requests. G. Business Associate agrees to provide to Covered Entity in a time and manner reasonably designated by Covered Entity information collected in accordance with this Agreement to permit Covered Entity to respond to a request by an Individual individual for access to PHI, amendment of PHI, or an accounting of disclosures of PHI, in order to meet the requirements under accordance with 45 CFR 164.524, 164.526, and 164.528, respectively. g. Business Associate agrees, at the request of the Covered Entity, to make any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526. h. Unless otherwise prohibited by law, H. Business Associate agrees to make its internal practices, books, and records, including policies and procedures and Protected Health Information, records relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, PHI available to Covered Entity available to and the Covered Entity, or to the Davidson County Department Secretary of Social ServicesHHS, in a time and the manner lawfully designated by the Secretary, for purposes of the Davidson County Department of Social Services Secretary determining Covered Entity's compliance with the Privacy Rule. i. Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528, and to provide this information to Covered Entity or an Individual to permit such a response.

Obligations of Business Associate. a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or permitted, required by this Agreement Agreement, or as Required By by Law. b. Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement. c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. d. Business Associate agrees to report to Covered Entity (i) any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes awareaware and (ii) any Breach of unsecured Protected Health Information as specified by 45 CFR 164.410. e. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity, agrees to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. f. Business Associate agrees to provide access, at the request of Covered Entity, to Protected Health Information in a Designated Record Set Set, to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR 164.524Individual. g. f. Business Associate agrees, at the request of the Covered Entity, agrees to make any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526§ 164.526 at the request of Covered Entity or an Individual. h. Unless otherwise prohibited by law, g. Business Associate agrees to make its internal practices, books, and records, including policies and procedures and Protected Health Information, records relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Covered Entity, or to the Davidson County Department of Social ServicesSecretary, in or to a time and manner person designated by the Secretary, for purposes of the Davidson County Department of Social Services Secretary determining Covered Entity's compliance with the Privacy Rule or Security Rule. i. h. Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR § 164.528, and . i. Business Associate agrees to provide this information to Covered Entity or information to permit Covered Entity to respond to a request by an Individual to permit such a responsefor an accounting of disclosures of Protected Health Information in accordance with 45 CFR § 164.528.

Obligations of Business Associate. BUSINESS ASSOCIATE AGREES TO: a. Business Associate agrees to not Not use or disclose Protected Health Information the PHI other than as permitted or required by this Agreement or as Required By Law. b. Access only the PHI of patients who are assigned by Covered Entity to Business Associate agrees to use Associate. c. Use appropriate safeguards to prevent use or disclosure of the Protected Health Information PHI other than as provided for by this Agreement. Business Associate acknowledges that the HITECH Act requires Business Associate to comply with the Security Rule as well as all additional security provisions of the HITECH Act as if Business Associate were a covered entity. c. Business Associate agrees d. Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the Electronic PHI that it creates, receives, maintains, or transmits on behalf of Covered Entity: and make its policies and procedures, and documentation required by the Security Rule relating to mitigatesuch safeguards, available to the Secretary of the Department of Health and Human Services (“HHS”) for purposes of determining Covered Entity’s compliance with the Security Rule. e. Mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information PHI by Business Associate in violation of the requirements of this Agreement. d. Business Associate agrees to report f. Report to Covered Entity any use or disclosure of the Protected Health Information PHI not provided for by this Agreement of which Business Associate becomes aware, as more fully detailed in Section 3.3 below. g. Report to Covered Entity any Security Incident with respect to Electronic PHI of which it becomes aware, as more fully detailed in Section 3.3 of this Agreement. e. Business Associate agrees h. Ensure that all of its subcontractors and agents that receive, use or have access to ensure that any agentPHI agree, including a subcontractorin writing, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity, agrees to essentially the same restrictions and conditions on the use and/or disclosure of PHI that apply through this Agreement to Business Associate with respect to such information. f. Business Associate agrees i. Ensure that all of its subcontractors and agents to provide access, at whom it provides Electronic PHI agree to implement reasonable and appropriate safeguards to protect such Electronic PHI. j. At the request of Covered Entity and in the time and manner specified by Covered Entity, provide access to Protected Health Information PHI in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet applicable access requirements of the requirements under 45 CFR 164.524Privacy Rule. g. Business Associate agrees, at k. At the request of Covered Entity and in the time and manner specified by Covered Entity, to make any amendment(s) to Protected Health Information PHI in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526Set. h. Unless otherwise prohibited by law, Business Associate agrees to make I. Make its internal practices, books, books and records, including policies and procedures and Protected Health Information, records relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity PHI available to the Covered Entity, or to the Davidson County Department Secretary of Social ServicesHHS, in a the time and manner designated specified by the Secretary, for purposes of the Davidson County Department of Social Services Secretary determining Covered Entity's Entity compliance with the Privacy Rule.Rule and Section 13405(c)(3) of the HITECH Act. 3 i. Business Associate agrees to document m. Document such disclosures of Protected Health Information PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information PHI in accordance with 45 CFR 164.528the requirements of the Privacy Rule. n. Provide to Covered Entity, in the time and manner specified by Covered Entity, information collected in accordance with Section 3.1.1. of this Agreement, to provide this information permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI. o. Return to Covered Entity or an Individual destroy, within thirty (30) days of the termination of this Agreement or any Underlying Contract, all PHI obtained from Covered Entity or created or obtained by Business Associate on behalf of Covered Entity with respect to permit the affected Underlying Contract(s), including such a responsePHI that is in the possession of Business Associate’s subcontractors and agents, and retain no copies if it is feasible to do so. If return or destruction of the PHI is infeasible, Business Associate shall notify Covered Entity of the conditions that make return or destruction infeasible, extend all protections contained in this Agreement to any retained PHI, and limit any further uses and/or disclosures of the PHI to the purposes that make the return or destruction of the PHI infeasible. This Section 3.1 shall survive any termination or expiration of this Agreement.