Permitted Uses and Disclosures by BA. (1) Except as otherwise limited in this Agreement, BA may use or disclose PHI to perform functions, activities, or services for, or on behalf of, Covered Entity as specified in the Service Contract, provided that such use or disclosure would not violate the Privacy Rule if done by Covered Entity.
(2) Except as otherwise limited in this Agreement, BA may disclose PHI for the proper management and administration of the BA, provided that disclosures are Required By Law, or BA obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as Required By Law or for the purpose for which it was disclosed to the person, and the person notifies the BA of any instances of which it is aware in which the confidentiality of the information has been breached.
(3) Except as otherwise limited in this Agreement, BA may use PHI to provide Data Aggregation Services to Covered Entity as permitted by 45 C.F.R. 164.504(e)(2)(i)(B).
(4) BA may use PHI to report violations of law to appropriate Federal and State authorities, consistent with 45 C.F.R. 502(j)(1).
Permitted Uses and Disclosures by BA. (a) Except as otherwise limited in this Agreement, BA may create, disclose or receive PHI from, or to provide services to, CE for purposes specified in Section C (“Description specifications work statement”) of CMS TrOOP Statement of Work (TrOOP “Services”), provided that such use or disclosure of PHI would not violate the HIPAA Privacy or Security Rules if done by CE. These uses and disclosures include, but are not limited to, uses and disclosures needed:
(1) To enable the CE to maintain calculations of CEs beneficiaries’ TrOOP expenditures.
(2) To enable the CE to engage in “payment” activities as that term is defined in 45 CFR § 164.501, upon CE’s beneficiaries’ enrollment in another Part D plan in the event CE’s Part D coverage ceases mid-year, and disclose TrOOP expenditure information to that new Part D plan for the year in which coverage under CE’s plan ceased.
(b) Except as otherwise limited in this Agreement, BA may use PHI for the proper management and administration of the BA or to carry out the legal responsibilities of the BA, and may disclose PHI to a third party for the same purposes, provided that the disclosures are required by law or BA has received from the third party legally binding written assurances that (i) the information will be held confidentially and used or further disclosed only as required by law or for the purpose for which it was disclosed to the third party; and (ii) the third party will notify BA of any instances of which it becomes aware in which the confidentiality of the information has been breached.
(c) BA may use PHI to report violations of law to appropriate Federal and State authorities, consistent with 45 C.F.R. § 164.502(j)(1).
(d) BA may use PHI to create information that is de-identified pursuant to 45 CFR § 164.514(b)(2) and use and disclose that de-identified information for purposes consistent with this Agreement, in accordance with the Privacy Rule, as well as any other applicable laws.
Permitted Uses and Disclosures by BA. BA may only Use or Disclose the Minimum Necessary PHI to perform the services set forth in the Underlying Agreement.
Permitted Uses and Disclosures by BA. BA may use or disclose PHI to perform functions, activities, or services for, or on behalf of, CE as specified in paragraph C(1) of this Addendum, provided that such Use or Disclosure would not violate the Privacy Rule if done by CE or the Minimum Necessary policies and procedures of the CE and/or Limited Data Set requirements of the Privacy Rule and HITECH.
1. The following functions, activities or services by BA shall be considered to be performed for, or on behalf of CE in BA’s capacity as a BA:
(i) Soliciting insurance on behalf of CE;
(ii) Transmitting an application for insurance or policy of insurance to or from CE;
(iii) Receiving or delivering a policy of insurance for CE; or
(iv) Receiving, collecting, or transmitting any initial premium of insurance as required by CE.
2. Except as otherwise limited in this Addendum, BA may disclose PHI for the proper management and administration of the BA, provided that the disclosures are Required By Law, or BA obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as Required By Law or for the purpose for which it was disclosed to the person, and the person notifies the BA of any instances of which it is aware in which the confidentiality of the information has been breached.
3. Except as otherwise limited in this Addendum, BA may use PHI to provide Data Aggregation services to CE as permitted by 45 CFR § 164.504(e)(2)(i)(B).
4. BA may use PHI to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR § 164.502(j)(1).
Permitted Uses and Disclosures by BA. Specific Use and Disclosure Provisions
Permitted Uses and Disclosures by BA. 4.1. BA may only use or disclose PHI as necessary to perform the services set forth in the Underlying Agreement, including for reporting on and evaluating the network or as required by law.
4.2. BA may use or disclose PHI as required by law.
4.3. BA agrees to make uses and disclosures and requests for PHI consistent with CE’s minimum necessary policies and procedures.
4.4. BA may not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by CE.
4.5. BA may use PHI in its possession to provide data aggregation services relating to the health care operations of CE, as provided for in 45 C.F.R. § 164.501.
4.6. BA may disclose PHI in its possession to third parties (subcontractors) for the purpose of its proper management and administration or to fulfill any of its present or future legal responsibilities provided that the disclosures are required by law or BA has entered into an agreement with subcontractor for the protection and use of PHI with substantially similar terms to this one.
4.7. BA may disclose PHI to other health care providers for the treatment purposes of such provider.
Permitted Uses and Disclosures by BA. BA may not use or disclose protected health information except for services relating to the health care operations of the CE.
Permitted Uses and Disclosures by BA. BA may use or disclose PHI on behalf of, or to provide services to, RMFMC for the following purposes:
1. BA may use PHI for the proper management and administration of the BA or to carry out the legal responsibilities of the BA.
2. BA may disclose PHI for the proper management and administration of the BA, provided:
a. The disclosure is Required By Law; or
b. The BA obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as Required By Law or for the purpose for which it was disclosed to the person, and the person notifies the BA of any instances of which it is aware in which the confidentiality of the information has been breached.
3. BA may use PHI to provide Data Aggregation services to RMFMC as permitted by 42 CFR § 164.504(e)(2)(i)(B).
4. BA may use PHI to report violations of law to appropriate federal and state authorities, consistent with § 164.502(j)(l).
Permitted Uses and Disclosures by BA. BA may use or disclose Protected Health Information to perform functions, activities, or services for, or on behalf of, Company as specified in paragraph 7(c)(1) of this Agreement, provided that such use or disclosure would not violate the Privacy rule if done by CE or the Minimum Necessary policies and procedures of CE and/or Limited Data Set requirements of the Privacy Rule and HITECH.
Permitted Uses and Disclosures by BA. SPECIFIC USE AND DISCLOSURE PROVISIONS Third Party Disclosure Confidentiality Except as otherwise limited in the Contract or this Agreement, BA may disclose PHI for the proper management and administration of the BA, provided that disclosures are required by law, or, if permitted by law, this Agreement, the Contract and any Ancillary Agreements, provided that, if BA discloses any PHI to a third party for such a purpose, BA shall enter into a written agreement with such third party requiring the third party to: (a) maintain the confidentiality, integrity, and availability of PHI and not to use or further disclose such information except as Required By Law or for the purpose for which it was disclosed, and (b) notify BA of any instances in which it becomes aware in which the confidentiality, integrity, and/or availability of the PHI is breached in a preliminary report within two (2) business days with a full report of the incident not less than five (5) business days from the time it became aware of the incident.
