Permitted and Future Uses of EHI. Once EHI is received by a QHIN, the recipient QHIN may exchange, retain, aggregate, Use, and Disclose such EHI only in accordance with Applicable Law and only for: (i) one or more of the Exchange Purposes in accordance with the Common Agreement (subject to the restriction below with respect to Individual Access as Services); (ii) the proper management and administration of its business and to carry out its legal responsibilities pursuant to the Common Agreement and the BAA, if applicable; (iii) investigation of a Breach or to comply with the HIPAA Rules or other applicable legal privacy and security obligations; (iv) judicial and administrative proceedings and for law enforcement purposes as well any other applicable governmental authorities (e.g. Federal Trade Commission); (v) as otherwise permitted by Applicable Law; and (vi) any purpose explicitly approved by an Individual only after the Individual has received at least a written privacy summary and the Minimum Information for such purpose. Notwithstanding the foregoing, if the Exchange Purpose is Individual Access Services, then the QHIN shall be allowed to exchange, retain, aggregate, Use, and Disclose EHI only for purposes of Individual Access Services. All exchanges, retentions, aggregations, Uses and Disclosures of EHI by QHINs shall be subject to audit procedures as described in the ARTCs.
Permitted and Future Uses of EHI. Once EHI is received by a Participant, the recipient Participant may exchange, retain, aggregate, Use, and Disclose such EHI only in accordance with Applicable Law and only for: (i) one or more of the Exchange Purposes in accordance with the Framework Agreement to which the Participant is a party (subject to the restriction below with respect to Individual Access Services); (ii) the proper management and administration of its business and to carry out its legal responsibilities pursuant to the Framework Agreement to which it is a party and the BAA, if applicable; (iii) investigation of a Breach or to comply with the HIPAA Rules or other applicable legal privacy and security obligations;
Permitted and Future Uses of EHI. Once EHI is received by a Participant Member, the recipient Participant Member may exchange, retain, aggregate, Use, and Disclose such EHI only in accordance with Applicable Law and only for: (i) one or more of the Exchange Purposes in accordance with the Framework Agreement to which the Participant Member is a party (subject to the restriction below with respect to Individual Access Services); (ii) the proper management and administration of its business and to carry out its legal responsibilities pursuant to the Framework Agreement to which it is a party and the BAA, if applicable; (iii) investigation of a Breach or to comply with the HIPAA Rules or other applicable legal privacy and security obligations; (iv) judicial and administrative proceedings and for law enforcement purposes as well as any other applicable governmental authorities (e.g., Federal Trade Commission); (v) if the Participant Member is a Covered Entity or a Business Associate, as otherwise permitted by Applicable Law; and (vi) any purpose explicitly approved by an Individual only after the Individual has received at least a written privacy summary and the Minimum Information for such purpose. Notwithstanding the foregoing, if the Exchange Purpose is Individual Access Services, then the Participant Member shall be allowed to exchange, retain, aggregate, Use, and Disclose EHI only for purposes of Individual Access Services. All exchanges, retentions, aggregations, Uses and Disclosures of EHI by Participant Members shall be subject to audit procedures as described in the ARTCs.
