Record Use. The Plan Supervisor, Adopting Employer and Plan Administrator agree that the medical records, names, addresses, telephone numbers, Social Security numbers and other personal information relating to Participants, which the Plan Supervisor may obtain as a result of performing administrative services may be collected, maintained and used by the Plan Supervisor and the Plan Administrator as necessary to administer the HRA Plans and the Trusts. The Plan Supervisor and the Plan Administrator may use patient specific and individually identifiable information, as necessary to properly administer the HRA Plans and the Trusts, to defend any claim related to the HRA Plans or the provision of services under this Agreement, or as otherwise may be permitted by state or federal law. All parties agree that such information shall be considered confidential and protected as required under applicable law. In the event of an impermissible use or disclosure of protected health information that compromises the privacy or security of that protected health information, Plan Supervisor shall at its own expense remedy such breach, including but not limited to, following the HIPPA breach notification rules in 45 CFR Sections 164.400- 414, that require notification of breach to affected individuals, the Secretary, and if applicable, the media. In addition, the Plan Supervisor shall at its own expense comply with the data breach requirements under California law.
