Common use of PERMITTED USES AND DISCLOSURES BY CONTRACTOR Clause in Contracts

PERMITTED USES AND DISCLOSURES BY CONTRACTOR. 1. Contractor may use or further disclose PHI County discloses to Contractor as necessary to perform functions, activities, or services for, or on behalf of, County as specified in the Contract, provided that such use or Disclosure would not violate the HIPAA Privacy Rule if done by COUNTY except for the specific Uses and Disclosures set forth below. a. Contractor may use PHI County discloses to Contractor, if necessary, for the proper management and administration of Contractor. b. Contractor may disclose PHI County discloses to Contractor for the proper management and administration of Contractor or to carry out the legal responsibilities of Contractor, if: i. The Disclosure is required by law; or ii. Contractor obtains reasonable assurances from the person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person and the person immediately notifies Contractor of any instance of which it is aware in which the confidentiality of the information has been breached. c. Contractor may use or further disclose PHI County discloses to Contractor to provide Data Aggregation services relating to the Health Care Operations of Contractor. 2. Contractor may use PHI County discloses to Contractor, if necessary, to carry out legal responsibilities of Contractor. 3. Contractor may use and disclose PHI County discloses to Contractor consistent with the minimum necessary policies and procedures of County. 4. Contractor may use or disclose PHI County discloses to Contractor as required by law. 5. Contractor shall share PHI as reasonably requested by the County to carry out its responsibilities as plan administrator of the Plan(s), including, without limitation, for purposes of auditing the performance of Contractor.

PERMITTED USES AND DISCLOSURES BY CONTRACTOR. 1. Contractor may use or further disclose PHI County discloses to Contractor as necessary to perform functions, activities, or services for, or on behalf of, County as specified in the Contract, provided that such use or Disclosure would not violate the HIPAA Privacy Rule if done by COUNTY except for the specific Uses and Disclosures set forth below. a. Contractor may use PHI County discloses to Contractor, if necessary, for the proper management and administration of Contractor. b. Contractor may disclose PHI County discloses to Contractor for the proper management and administration of Contractor or to carry out the legal responsibilities of Contractor, if: i. The Disclosure is required by law; or ii. Contractor obtains reasonable assurances from the person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person and the person immediately notifies Contractor of any instance of which it is aware in which the confidentiality of the information has been breached. c. Contractor may use or further disclose PHI County discloses to Contractor to provide Data Aggregation services relating to the Health Care Operations of Contractor. 2. Contractor may use PHI County discloses to Contractor, if necessary, to carry out legal responsibilities of Contractor. 3. Contractor may use and disclose PHI County discloses to Contractor consistent with the minimum necessary policies and procedures of County. 4. Contractor may use or disclose PHI County discloses to Contractor as required by law. 5. Contractor shall share PHI as reasonably requested by the County to carry out its responsibilities as plan administrator of the Plan(s), including, without limitation, for purposes of auditing the performance of Contractor.

PERMITTED USES AND DISCLOSURES BY CONTRACTOR. 1. Contractor may use or further disclose PHI County discloses to Contractor as necessary to perform functions, activities, or services for, or on behalf of, County as specified in the ContractAgreement, provided that such use or Disclosure would not violate the HIPAA Privacy Rule if done by COUNTY County except for the specific Uses and Disclosures set forth below. a. Contractor may use PHI County discloses to Contractor, if necessary, for the proper management and administration of Contractor. b. Contractor may disclose PHI County discloses to Contractor for the proper management and administration of Contractor or to carry out the legal responsibilities of Contractor, if: i. The Disclosure is required by law; or ii. Contractor obtains reasonable assurances from the person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person and the person immediately notifies Contractor of any instance of which it is aware in which the confidentiality of the information has been breached. c. Contractor may use or further disclose PHI County discloses to Contractor to provide Data Aggregation services relating to the Health Care Operations of Contractor. 2. Contractor may use PHI County discloses to Contractor, if necessary, to carry out legal responsibilities of Contractor. 3. Contractor may use and disclose PHI County discloses to Contractor consistent with the minimum necessary policies and procedures of County. 4. Contractor may use or disclose PHI County discloses to Contractor as required by law. 5. Contractor shall share PHI as reasonably requested by the County to carry out its responsibilities as plan administrator of the Plan(s), including, without limitation, for purposes of auditing the performance of Contractor.

PERMITTED USES AND DISCLOSURES BY CONTRACTOR. 1. Contractor may use or further disclose PHI County discloses to Contractor as necessary to perform functions, activities, or services for, or on behalf of, County as specified in the ContractContract MA-017-202301-MC, provided that such use or Disclosure would not violate the HIPAA Privacy Rule if done by COUNTY County except for the specific Uses and Disclosures set forth below. a. Contractor may use PHI County discloses to Contractor, if necessary, for the proper management and administration of Contractor. b. Contractor may disclose PHI County discloses to Contractor for the proper management and administration of Contractor or to carry out the legal responsibilities of Contractor, if: i. The Disclosure is required by law; or ii. Contractor obtains reasonable assurances from the person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person and the person immediately notifies Contractor of any instance of which it is aware in which the confidentiality of the information has been breached. c. Contractor may use or further disclose PHI County discloses to Contractor to provide Data Aggregation services relating to the Health Care Operations of Contractor. 2. Contractor may use PHI County discloses to Contractor, if necessary, to carry out legal responsibilities of Contractor. 3. Contractor may use and disclose PHI County discloses to Contractor consistent with the minimum necessary policies and procedures of County. 4. Contractor may use or disclose PHI County discloses to Contractor as required by law. 5. Contractor shall share PHI as reasonably requested by the County to carry out its responsibilities as plan administrator of the Plan(s), including, without limitation, for purposes of auditing the performance of Contractor.

PERMITTED USES AND DISCLOSURES BY CONTRACTOR. 1. Contractor may use or further disclose PHI County discloses to Contractor as necessary to perform functions, activities, or services for, or on behalf of, County as specified in the ContractContract #, provided that such use or Disclosure would not violate the HIPAA Privacy Rule if done by COUNTY except for the specific Uses and Disclosures set forth below. a. Contractor may use PHI County discloses to Contractor, if necessary, for the proper management and administration of Contractor. b. Contractor may disclose PHI County discloses to Contractor for the proper management and administration of Contractor or to carry out the legal responsibilities of Contractor, if: i. The Disclosure is required by law; or ii. Contractor obtains reasonable assurances from the person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person and the person immediately notifies Contractor of any instance of which it is aware in which the confidentiality of the information has been breached. c. Contractor may use or further disclose PHI County discloses to Contractor to provide Data Aggregation services relating to the Health Care Operations of Contractor. 2. Contractor may use PHI County discloses to Contractor, if necessary, to carry out legal responsibilities of Contractor. 3. Contractor may use and disclose PHI County discloses to Contractor consistent with the minimum necessary policies and procedures of County. 4. Contractor may use or disclose PHI County discloses to Contractor as required by law. 5. Contractor shall share PHI as reasonably requested by the County to carry out its responsibilities as plan administrator of the Plan(s), including, without limitation, for purposes of auditing the performance of Contractor.

PERMITTED USES AND DISCLOSURES BY CONTRACTOR. 1. Contractor may use or further disclose PHI County discloses to Contractor as necessary to perform functions, activities, or services for, or on behalf of, County as specified in the ContractContract MA-042- 17011455, provided that such use or Disclosure would not violate the HIPAA Privacy Rule if done by COUNTY County except for the specific Uses and Disclosures set forth below. a. Contractor may use PHI County discloses to Contractor, if necessary, for the proper management and administration of Contractor. b. Contractor may disclose PHI County discloses to Contractor for the proper management and administration of Contractor or to carry out the legal responsibilities of Contractor, if: i. The Disclosure is required by law; or ii. Contractor obtains reasonable assurances from the person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person and the person immediately notifies Contractor of any instance of which it is aware in which the confidentiality of the information has been breached. c. Contractor may use or further disclose PHI County discloses to Contractor to provide Data Aggregation services relating to the Health Care Operations of Contractor. 2. Contractor may use PHI County discloses to Contractor, if necessary, to carry out legal responsibilities of Contractor. 3. Contractor may use and disclose PHI County discloses to Contractor consistent with the minimum necessary policies and procedures of County. 4. Contractor may use or disclose PHI County discloses to Contractor as required by law. 5. Contractor shall share PHI as reasonably requested by the County to carry out its responsibilities as plan administrator of the Plan(s), including, without limitation, for purposes of auditing the performance of Contractor.

PERMITTED USES AND DISCLOSURES BY CONTRACTOR. 1. Contractor may use or further disclose PHI County discloses to Contractor as necessary to perform functions, activities, or services for, or on behalf of, County as specified in the ContractContract MA-042-19011809, provided that such use or Disclosure would not violate the HIPAA Privacy Rule if done by COUNTY County except for the specific Uses and Disclosures set forth below. a. Contractor may use PHI County discloses to Contractor, if necessary, for the proper management and administration of Contractor. b. Contractor may disclose PHI County discloses to Contractor for the proper management and administration of Contractor or to carry out the legal responsibilities of Contractor, if: i. The Disclosure is required by law; or ii. Contractor obtains reasonable assurances from the person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person and the person immediately notifies Contractor of any instance of which it is aware in which the confidentiality of the information has been breached. c. Contractor may use or further disclose PHI County discloses to Contractor to provide Data Aggregation services relating to the Health Care Operations of Contractor. 2. Contractor may use PHI County discloses to Contractor, if necessary, to carry out legal responsibilities of Contractor. 3. Contractor may use and disclose PHI County discloses to Contractor consistent with the minimum necessary policies and procedures of County. 4. Contractor may use or disclose PHI County discloses to Contractor as required by law. 5. Contractor shall share PHI as reasonably requested by the County to carry out its responsibilities as plan administrator of the Plan(s), including, without limitation, for purposes of auditing the performance of Contractor.

PERMITTED USES AND DISCLOSURES BY CONTRACTOR. 1. Contractor may use or further disclose PHI County discloses to Contractor as necessary to perform functions, activities, or services for, or on behalf of, County as specified in the Contract, provided that such use or Disclosure would not violate the HIPAA Privacy Rule if done by COUNTY except for the specific Uses and Disclosures set forth below. a. Contractor may use PHI County discloses to Contractor, if necessary, for the proper management and administration of Contractor. b. Contractor may disclose PHI County discloses to Contractor for the proper management and administration of Contractor or to carry out the legal responsibilities of Contractor, if: i. The Disclosure is required by law; or ii. Contractor obtains reasonable assurances from the person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person and the person immediately promptly notifies Contractor of any instance of which it is aware in which the confidentiality of the information has been breached. c. Contractor may use or further disclose PHI County discloses to Contractor to provide Data Aggregation services relating to the Health Care Operations of Contractor. 2. Contractor may use PHI County discloses to Contractor, if necessary, to carry out legal responsibilities of Contractor. 3. Contractor may use and disclose PHI County discloses to Contractor consistent with the minimum necessary policies and procedures of County. 4. Contractor may use or disclose PHI County discloses to Contractor as required by law. 5. Contractor shall share PHI as reasonably requested by the County to carry out its responsibilities as plan administrator of the Plan(s), including, without limitation, for purposes of auditing the performance of Contractor.

PERMITTED USES AND DISCLOSURES BY CONTRACTOR. 1. Contractor may use or further disclose PHI County discloses to Contractor as necessary to perform functions, activities, or services for, or on behalf of, County as specified in the ContractContract #( TBD), provided that such use or Disclosure would not violate the HIPAA Privacy Rule if done by COUNTY except for the specific Uses and Disclosures set forth below. a. Contractor may use PHI County discloses to Contractor, if necessary, for the proper management and administration of Contractor. b. Contractor may disclose PHI County discloses to Contractor for the proper management and administration of Contractor or to carry out the legal responsibilities of Contractor, if: i. The Disclosure is required by law; or ii. Contractor obtains reasonable assurances from the person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person and the person immediately notifies Contractor of any instance of which it is aware in which the confidentiality of the information has been breached. c. Contractor may use or further disclose PHI County discloses to Contractor to provide Data Aggregation services relating to the Health Care Operations of Contractor. 2. Contractor may use PHI County discloses to Contractor, if necessary, to carry out legal responsibilities of Contractor. 3. Contractor may use and disclose PHI County discloses to Contractor consistent with the minimum necessary policies and procedures of County. 4. Contractor may use or disclose PHI County discloses to Contractor as required by law. 5. Contractor shall share PHI as reasonably requested by the County to carry out its responsibilities as plan administrator of the Plan(s), including, without limitation, for purposes of auditing the performance of Contractor.

PERMITTED USES AND DISCLOSURES BY CONTRACTOR. 1. Contractor may use or further disclose PHI County discloses to Contractor as necessary to perform functions, activities, or services for, or on behalf of, County as specified in the ContractContract MA 017- 24010765, provided that such use or Disclosure would not violate the HIPAA Privacy Rule if done by COUNTY County except for the specific Uses and Disclosures set forth below. a. Contractor may use PHI County discloses to Contractor, if necessary, for the proper management and administration of Contractor. b. Contractor may disclose PHI County discloses to Contractor for the proper management and administration of Contractor or to carry out the legal responsibilities of Contractor, if: i. The Disclosure is required by law; or ii. Contractor obtains reasonable assurances from the person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person and the person immediately notifies Contractor of any instance of which it is aware in which the confidentiality of the information has been breached. c. Contractor may use or further disclose PHI County discloses to Contractor to provide Data Aggregation services relating to the Health Care Operations of Contractor. 2. Contractor may use PHI County discloses to Contractor, if necessary, to carry out legal responsibilities of Contractor. 3. Contractor may use and disclose PHI County discloses to Contractor consistent with the minimum necessary policies and procedures of County. 4. Contractor may use or disclose PHI County discloses to Contractor as required by law. 5. Contractor shall share PHI as reasonably requested by the County to carry out its responsibilities as plan administrator of the Plan(s), including, without limitation, for purposes of auditing the performance of Contractor.

PERMITTED USES AND DISCLOSURES BY CONTRACTOR. 1. Contractor may use or further disclose PHI County discloses to Contractor as necessary to perform functions, activities, or services for, or on behalf of, County as specified in the ContractContract MA-XXX, provided that such use or Disclosure would not violate the HIPAA Privacy Rule if done by COUNTY except for the specific Uses and Disclosures set forth below. a. Contractor may use PHI County discloses to Contractor, if necessary, for the proper management and administration of Contractor. b. Contractor may disclose PHI County discloses to Contractor for the proper management and administration of Contractor or to carry out the legal responsibilities of Contractor, if: i. The Disclosure is required by law; or ii. Contractor obtains reasonable assurances from the person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person and the person immediately notifies Contractor of any instance of which it is aware in which the confidentiality of the information has been breached. c. Contractor may use or further disclose PHI County discloses to Contractor to provide Data Aggregation services relating to the Health Care Operations of Contractor. 2. Contractor may use PHI County discloses to Contractor, if necessary, to carry out legal responsibilities of Contractor. 3. Contractor may use and disclose PHI County discloses to Contractor consistent with the minimum necessary policies and procedures of County. 4. Contractor may use or disclose PHI County discloses to Contractor as required by law. the HIPAA Privacy Rule if done by County. 54. County shall not request Contractor shall share to use or disclose PHI as reasonably requested by in any manner that would not be permissible under accordance with 45 CFR § 164.522, to the County to carry out its responsibilities as plan administrator extent that such restriction may affect Contractor’s Use or Disclosure of the Plan(s), including, without limitation, for purposes of auditing the performance of ContractorPHI.

PERMITTED USES AND DISCLOSURES BY CONTRACTOR. 1. Contractor may use or further disclose PHI County discloses to Contractor as necessary to perform functions, activities, or services for, or on behalf of, County as specified in the ContractContract MA-017-202301- MC, provided that such use or Disclosure would not violate the HIPAA Privacy Rule if done by COUNTY County except for the specific Uses and Disclosures set forth below. a. Contractor may use PHI County discloses to Contractor, if necessary, for the proper management and administration of Contractor. b. Contractor may disclose PHI County discloses to Contractor for the proper management and administration of Contractor or to carry out the legal responsibilities of Contractor, if: i. The Disclosure is required by law; or ii. Contractor obtains reasonable assurances from the person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person and the person immediately notifies Contractor of any instance of which it is aware in which the confidentiality of the information has been breached. c. Contractor may use or further disclose PHI County discloses to Contractor to provide Data Aggregation services relating to the Health Care Operations of Contractor. 2. Contractor may use PHI County discloses to Contractor, if necessary, to carry out legal responsibilities of Contractor. 3. Contractor may use and disclose PHI County discloses to Contractor consistent with the minimum necessary policies and procedures of County. 4. Contractor may use or disclose PHI County discloses to Contractor as required by law. 5. Contractor shall share PHI as reasonably requested by the County to carry out its responsibilities as plan administrator of the Plan(s), including, without limitation, for purposes of auditing the performance of Contractor.

PERMITTED USES AND DISCLOSURES BY CONTRACTOR. 1. Contractor may use or further disclose PHI County discloses to Contractor as necessary to perform functions, activities, or services for, or on behalf of, County as specified in the Contract, provided that such use or Disclosure would not violate the HIPAA Privacy Rule if done by COUNTY except for the specific Uses and Disclosures set forth below. a. Contractor may use PHI County discloses to Contractor, if necessary, for the proper management and administration of Contractor. b. Contractor may disclose PHI County discloses to Contractor for the proper management and administration of Contractor or to carry out the legal responsibilities of Contractor, if: i. The Disclosure is required by law; or ii. Contractor obtains reasonable assurances from the person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person and the person immediately promptly notifies Contractor of any instance of which it is aware in which the confidentiality of the information has been breached. c. Contractor may use or further disclose PHI County discloses to Contractor to provide Data Aggregation services relating to the Health Care Operations of Contractor. 2. Contractor may use PHI County discloses to Contractor, if necessary, to carry out legal responsibilities of Contractor. 3. Contractor may use and disclose PHI County discloses to Contractor consistent with the minimum necessary policies and procedures of County. 4. Contractor may use or disclose PHI County discloses to Contractor as required by law. 5. Contractor shall share PHI as reasonably requested by the County to carry out its responsibilities as plan administrator of the Plan(s), including, without limitation, for purposes of auditing the performance of Contractor.

PERMITTED USES AND DISCLOSURES BY CONTRACTOR. 1. Contractor may use or further disclose PHI County discloses to Contractor as necessary to perform functions, activities, or services for, or on behalf of, County as specified in the ContractContract MA- 042-14010509, provided that such use or Disclosure would not violate the HIPAA Privacy Rule if done by COUNTY County except for the specific Uses and Disclosures set forth below. a. Contractor may use PHI County discloses to Contractor, if necessary, for the proper management and administration of Contractor. b. Contractor may disclose PHI County discloses to Contractor for the proper management and administration of Contractor or to carry out the legal responsibilities of Contractor, if: i. The Disclosure is required by law; or ii. Contractor obtains reasonable assurances from the person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person and the person immediately notifies Contractor of any instance of which it is aware in which the confidentiality of the information has been breached. c. Contractor may use or further disclose PHI County discloses to Contractor to provide Data Aggregation services relating to the Health Care Operations of Contractor. 2. Contractor may use PHI County discloses to Contractor, if necessary, to carry out legal responsibilities of Contractor. 3. Contractor may use and disclose PHI County discloses to Contractor consistent with the minimum necessary policies and procedures of County. 4. Contractor may use or disclose PHI County discloses to Contractor as required by law. 51. County shall notify Contractor of any limitation(s) in County’s notice of privacy practices in G. OBLIGATIONS OF COUNTY Disclosure of PHI. 2. County shall share notify Contractor of any changes in, or revocation of, the permission by anIndividual to use or disclose his or her PHI, to the extent that such changes may affect Contractor’s Use or Disclosure of PHI. 3. County shall notify Contractor of any restriction to the Use or Disclosure of PHI as reasonably requested that County has agreed to in accordance with 45 CFR § 164.522, to the extent that such restriction may affect Contractor’s Use or Disclosure of PHI. 4. County shall not request Contractor to use or disclose PHI in any manner that would not be permissible under the HIPAA Privacy Rule if done by the County to carry out its responsibilities as plan administrator of the Plan(s), including, without limitation, for purposes of auditing the performance of ContractorCounty.

PERMITTED USES AND DISCLOSURES BY CONTRACTOR. 1. Contractor may use or further disclose PHI County discloses to Contractor as necessary to perform functions, activities, or services for, or on behalf of, County as specified in the ContractContract MA- 017-202405-KA, provided that such use or Disclosure would not violate the HIPAA Privacy Rule if done by COUNTY County except for the specific Uses and Disclosures set forth below. a. Contractor may use PHI County discloses to Contractor, if necessary, for the proper management and administration of Contractor. b. Contractor may disclose PHI County discloses to Contractor for the proper management and administration of Contractor or to carry out the legal responsibilities of Contractor, if: i. (1) The Disclosure is required by law; or ii. (2) Contractor obtains reasonable assurances from the person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person and the person immediately notifies Contractor of any instance of which it is aware in which the confidentiality of the information has been breached. c. Contractor may use or further disclose PHI County discloses to Contractor to provide perform Data Aggregation services relating services. The provisions of this Agreement notwithstanding, Contractor is permitted to de-identify Protected Health Information, provided that it does so in accordance with HIPAA de-identification rules. De- identified information does not constitute Protected Health Information, and may be used and disclosed by Contractor for its own purposes, including, without limitation, for purposes of developing comparative databases, performing statistical analysis and research, and improving the Health Care Operations quality of Contractor’s products and services. 2. Contractor may use PHI County discloses to Contractor, if necessary, to carry out legal responsibilities of Contractor.. Docusign Envelope ID: 589EFEA4-C448-4FC7-A588-84111CBB9CF4 3. Contractor may use and disclose PHI County discloses to Contractor consistent with the minimum necessary policies and procedures of County. 4. Contractor may use or disclose PHI County discloses to Contractor as required by law. 5. Contractor shall share PHI as reasonably requested by the County to carry out its responsibilities as plan administrator of the Plan(s), including, without limitation, for purposes of auditing the performance of Contractor.

PERMITTED USES AND DISCLOSURES BY CONTRACTOR. 1. Contractor may use or further disclose PHI County discloses to Contractor as necessary to perform functions, activities, or services for, or on behalf of, County as specified in the Contract, provided that such use or Disclosure would not violate the HIPAA Privacy Rule if done by COUNTY except for the specific Uses and Disclosures set forth below. a. a) Contractor may use PHI County discloses to Contractor, if necessary, for the proper management and administration of Contractor. b. b) Contractor may disclose PHI County discloses to Contractor for the proper management and administration of Contractor or to carry out the legal responsibilities of Contractor, if: i. i) The Disclosure is required by law; or ii. ) Contractor obtains reasonable assurances from the person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person and the person immediately notifies Contractor of any instance of which it is aware in which the confidentiality of the information has been breached. c. c) Contractor may use or further disclose PHI County discloses to Contractor to provide Data Aggregation services relating to the Health Care Operations of Contractor. 2. Contractor may use PHI County discloses to Contractor, if necessary, to carry out legal responsibilities of Contractor. 3. Contractor may use and disclose PHI County discloses to Contractor consistent with the minimum necessary policies and procedures of County. 4. Contractor may use or disclose PHI County discloses to Contractor as required by law. 5. Contractor shall share PHI as reasonably requested by the County to carry out its responsibilities as plan administrator of the Plan(s), including, without limitation, for purposes of auditing the performance of Contractor.

PERMITTED USES AND DISCLOSURES BY CONTRACTOR. 1. Contractor may use or further disclose PHI County discloses to Contractor as necessary to perform functions, activities, or services for, or on behalf of, County as specified in the ContractContract MA- 042-14010576, provided that such use or Disclosure would not violate the HIPAA Privacy Rule if done by COUNTY County except for the specific Uses and Disclosures set forth below. a. Contractor may use PHI County discloses to Contractor, if necessary, for the proper management and administration of Contractor. b. Contractor may disclose PHI County discloses to Contractor for the proper management and administration of Contractor or to carry out the legal responsibilities of Contractor, if: i. The Disclosure is required by law; or ii. Contractor obtains reasonable assurances from the person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person and the person immediately notifies Contractor of any instance of which it is aware in which the confidentiality of the information has been breached. c. Contractor may use or further disclose PHI County discloses to Contractor to provide Data Aggregation services relating to the Health Care Operations of Contractor. 2. Contractor may use PHI County discloses to Contractor, if necessary, to carry out legal responsibilities of Contractor. 3. Contractor may use and disclose PHI County discloses to Contractor consistent with the minimum necessary policies and procedures of County. 4. Contractor may use or disclose PHI County discloses to Contractor as required by law. 51. County shall notify Contractor of any limitation(s) in County’s notice of privacy practices in accordance with 45 CFR § 164.520, to the extent that such limitation may affect Contractor’s Use or G. OBLIGATIONS OF COUNTY County of Orange Health Care Agency 33 MA-042-1201060414010576 2. County shall share notify Contractor of any changes in, or revocation of, the permission by anIndividual to use or disclose his or her PHI, to the extent that such changes may affect Contractor’s Use or Disclosure of PHI. 3. County shall notify Contractor of any restriction to the Use or Disclosure of PHI as reasonably requested that Countyhas agreed to in accordance with 45 CFR § 164.522, to the extent that such restriction may affect Contractor’s Use or Disclosure of PHI. 4. County shall not request Contractor to use or disclose PHI in any manner that would not be permissible under the HIPAA Privacy Rule if done by the County to carry out its responsibilities as plan administrator of the Plan(s), including, without limitation, for purposes of auditing the performance of ContractorCounty.