Proper Management and Administration. Except as otherwise expressly limited in this BAA or the Underlying Agreement, Business Associate may use PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided that any disclosure of information received in such capacity will be made only if: (i) Required by law; or (ii) Business Associate obtains written reasonable assurances from the person to whom the information is disclosed that it will be held confidentially and used or further disclosed only as Required By Law or for the purpose for which it was disclosed to the person, and the person notifies Business Associate of any breaches of the confidentiality of the PHI. Data Aggregation. In addition to using the Protected Health Information to perform the Services set forth in Section 2(a) of this BAA, Business Associate may use Protected Health Information for Data Aggregation purposes for the Health Care Operations of Covered Entity only, and only if expressly authorized under the Underlying Agreement. Business Associate may not de-identify Protected Health Information received from or created on behalf of Covered Entity unless such de-identification is expressly permitted by the Underlying Agreement or this BAA or unless Business Associate obtains Covered Entity’s prior written consent to such de-identification.
Appears in 6 contracts
Samples: Information Security and Privacy Addendum, Information Security and Privacy Addendum, Information Security and Privacy Addendum
