Common use of Permitted Uses and Disclosures of PHI Clause in Contracts

Permitted Uses and Disclosures of PHI. 2.1 Pursuant to the Agreement, Business Associate provides services for NYC Health + Hospitals that may involve the use, access to, or disclosure of PHI or ePHI. 2.2 Except as otherwise specified in this BAA and pursuant to 42 U.S.C. § 17934, Business Associate may make any and all uses and disclosures of PHI necessary to perform its obligations under the Agreement, provided that such uses or disclosures do not violate the HIPAA Regulations if made by NYC Health + Hospitals. Unless otherwise limited herein or under applicable law, Business Associate may use PHI for the following purposes: 2.2.1 Business Associate may use or disclose PHI for proper management and administration of Business Associate as set forth in 45 C.F.R. § 164.504(e)(4). 2.2.2 Subject to section 2.2.4 below, Business Associate may disclose PHI in its possession to third parties for the purpose of performing its duties under the Agreement and/or this BAA. The third parties shall provide written assurances to Business Associate of their confidential handling of such PHI, which shall include adherence to the same restrictions and conditions on use and disclosure as set forth herein. 2.2.3 Business Associate may use or disclose PHI to meet any responsibilities required under (i) 45 C.F.R. § 164.103, or (ii) 45 C.F.R. § 164.504(e)(4). To the extent permitted by applicable law, prior to disclosing PHI as set forth herein, Business Associate shall notify NYC Health + Hospitals in writing and provide reasonable time for NYC Health + Hospitals to oppose such disclosure. If NYC Health + Hospitals does not respond to Business Associate regarding such opposition prior to the date on which such disclosure must be timely made, Business Associate may, in its own discretion, disclose PHI as required by applicable law. 2.2.4 Business Associate may aggregate the PHI in its possession with the PHI of other covered entities and provide NYC Health + Hospitals with data analyses relating to NYC Health + Hospitals’ health care operations in accordance with 45 C.F.R. § 164.504 (e)(2)(i)(B). Business Associate shall not disclose PHI to any other party pursuant to this section 2.2.4 without the express written authorization of NYC Health + Hospitals. 2.2.5 Business Associate may de-identify PHI and utilize de-identified PHI for purposes other than research, provided that Business Associate (i) de-identifies the PHI pursuant to the HIPAA requirements set forth in 45 C.F.R. § 164.514(b) and (ii) provides NYC Health + Hospitals with appropriate documentation if required by 45 C.F.R. § 164.514(b)(1)(ii). De- identified information does not constitute PHI. 2.2.6 Business Associate agrees that it will obtain NYC Health + Hospitals’ prior written approval for the use or disclosure of PHI or de-identified PHI for research purposes. Use or disclosure for research purposes that has not been approved by NYC Health + Hospitals is strictly prohibited.

Permitted Uses and Disclosures of PHI. 2.1 Pursuant to the Agreement, Business Associate provides services for NYC Health + Hospitals that may involve the use, access to, or disclosure of PHI or ePHI. 2.2 Except as otherwise specified in this BAA and pursuant to 42 U.S.C. § 17934, Business Associate may make any and all uses and disclosures of PHI necessary to perform its obligations under the Agreement, provided that such uses or disclosures do not violate the HIPAA Regulations if made by NYC Health + Hospitals. Unless otherwise limited herein or under applicable law, Business Associate may use PHI for the following purposes: 2.2.1 Business Associate may use or disclose PHI for proper management and administration of Business Associate as set forth in 45 C.F.R. § 164.504(e)(4). 2.2.2 Subject to section 2.2.4 below, Business Associate may disclose PHI in its possession to third parties for the purpose of performing its duties under the Agreement and/or this BAA. The third parties shall provide written assurances to Business Associate of their confidential handling of such PHI, which shall include adherence to the same restrictions and conditions on use and disclosure as set forth herein. 2.2.3 Business Associate may use or disclose PHI to meet any responsibilities required under (i) 45 C.F.R. § 164.103, or (ii) 45 C.F.R. § 164.504(e)(4). To the extent permitted by applicable law, prior to disclosing PHI as set forth herein, Business Associate shall notify NYC Health + Hospitals in writing and provide reasonable time for NYC Health + Hospitals to oppose such disclosure. If NYC Health + Hospitals does not respond to Business Associate regarding such opposition prior to the date on which such disclosure must be timely made, Business Associate may, in its own discretion, disclose PHI as required by applicable law. 2.2.4 Business Associate may aggregate the PHI in its possession with the PHI of other covered entities and provide NYC Health + Hospitals with data analyses relating to NYC Health + Hospitals’ health care operations in accordance with 45 C.F.R. § 164.504 (e)(2)(i)(B). Business Associate shall not disclose PHI to any other party pursuant to this section 2.2.4 without the express written authorization of NYC Health + Hospitals. 2.2.5 Business Associate may de-identify PHI and utilize de-identified PHI for purposes other than research, provided that Business Associate (i) de-identifies the PHI pursuant to the HIPAA requirements set forth in 45 C.F.R. § 164.514(b) and (ii) provides NYC Health + Hospitals with appropriate documentation if required by 45 C.F.R. § 164.514(b)(1)(ii). De- De-identified information does not constitute PHI. 2.2.6 Business Associate agrees that it will obtain NYC Health + Hospitals’ prior written approval for the use or disclosure of PHI or de-identified PHI for research purposes. Use or disclosure for research purposes that has not been approved by NYC Health + Hospitals is strictly prohibited.