Responsibilities of Covered Entity. Covered Entity shall notify Business Associate, in writing, of an Individual’s request to restrict the Use or Disclosure of such Individual’s PHI, any limitations in Covered Entity’s Privacy Notice relevant to Business Associate’s performance of its obligations under this BAA or the Agreement, or any revocation by an Individual of authorization to Use or Disclose PHI.
Responsibilities of Covered Entity. With regard to the use and/or disclosure of PHI by the Business Associate, Covered Entity hereby agrees:
a. to inform the Business Associate of any limitations in the form of notice of privacy practices that Covered Entity provides to Individuals pursuant to 45 C.F.R. § 164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI.
b. to inform the Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose PHI, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI.
c. to notify the Business Associate, in writing and in a timely manner, of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 CFR § 164.522, to the extent that such restriction may impact in any manner the use and/or disclosure of PHI by the Business Associate under this Agreement. If the Business Associate receives a request to restrict the disclosure of PHI directly from an Individual, Business Associate shall notify Covered Entity of such request and Covered Entity shall be responsible for making the determination, in accordance with the Privacy, as to whether Business Associate shall comply with that request.
d. Except if the Business Associate will use or disclose PHI for (and the Underlying Agreement includes provisions for) data aggregation or management, administration and legal activities and responsibilities of the Business Associate, the Covered Entity will not request Business Associate to use or disclose PHI in any manner that would not be permissible under the Privacy Rule if done by the Covered Entity.
Responsibilities of Covered Entity. With regard to the use and/or disclosure of PHI by the Business Associate, Covered Entity hereby agrees:
(a) to inform the Business Associate of any limitations in the form of notice of privacy practices that Covered Entity provides to individuals pursuant to 45 CFR §164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI hereunder.
(b) to inform the Business Associate of any changes in, or revocation of, the permission by an individual to use or disclose PHI, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI hereunder.
(c) to notify the Business Associate, in writing and in a timely manner, of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may impact in any manner the use and/or disclosure of PHI by the Business Associate under this Addendum.
(d) Covered Entity will not request Business Associate to use or disclose PHI in any manner that would not be permissible under the Privacy and Security Rule if done by the Covered Entity.
Responsibilities of Covered Entity. Covered Entity shall, with respect to Business Associate:
(a) provide Business Associate a copy of Covered Entity's notice of privacy practices ("Notice") currently in use;
(b) notify Business Associate of any limitations in the Notice pursuant to 45 C.F.R. § 164.520, to the extent that such limitations may affect Business Associate's use or disclosure of PHI;
(c) notify Business Associate of any changes to the Notice that Covered Entity provides to individuals pursuant to 45 C.F.R. § 164.520, to the extent that such changes may affect Business Associate's use or disclosure of PHI;
(d) notify Business Associate of any changes in, or withdrawal of, the consent or authorization of an individual regarding the use or disclosure of PHI provided to Covered Entity pursuant to 45 C.F.R. § 164.506 or § 164.508, to the extent that such changes may affect Business Associate's use or disclosure of PHI; and
(e) notify Business Associate, in writing and in a timely manner, of any restrictions on use and/or disclosure of PHI as provided for in 45 C.F.R. § 164.522 agreed to by Covered Entity, to the extent that such restriction may affect Business Associate's use or disclosure of PHI.
Responsibilities of Covered Entity. Covered Entity shall:
a. provide Business Associate with the notice of privacy practices that Covered Entity produces in accordance with 45 C.F.R. §164.520, as well as any changes to such notice.
b. provide Business Associate, in writing, with any changes in, or revocation of, permission by Individual to the use or disclosure of PHI, if such changes affect Business Associate’s permitted or required uses or disclosures. Upon receipt by Business Associate of such notice of changes, Business Associate shall cease the use and disclosure of any such Individual’s PHI except to the extent it has relied on such use or disclosure, or where an exception under HIPAA expressly applies.
c. notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 C.F.R. §164.522.
d. not request or require Business Associate to use and/or disclose PHI in a manner not permitted by HIPAA.
Responsibilities of Covered Entity. With regard to the use and/or disclosure of Protected Health Information by Business Associate, Covered Entity agrees to:
A. Notify Business Associate of any limitation(s) in its notice of privacy practices in accordance with 45 CFR §164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI.
B. Notify Business Associate of any changes in, or revocation of, permission by an Individual to use or disclose Protected Health Information, to the extent that such changes may affect Business Associate’s use or disclosure of PHI.
C. Notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR §164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI.
D. Except for data aggregation or management and administrative activities of Business Associate, Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under HIPAA if done by Covered Entity.
Responsibilities of Covered Entity. Covered Entity:
3.1 shall identify the records it furnishes to Business Associate that it considers to be PHI for purposes of the Agreement, and provide to Business Associate only the minimum PHI necessary to accomplish the Services.
3.2 in the event that the Covered Entity honors a request to restrict the use or disclosure of PHI pursuant to 45 C.F.R. § 164.522(a) or makes revisions to its notice of privacy practices of Covered Entity in accordance with 45 C.F.R. § 164.520 that increase the limitations on uses or disclosures of PHI or agrees to a request by an Individual for confidential communications under 45 C.F.R. § 164.522(b), Covered Entity agrees not to provide Business Associate any PHI that is subject to any of those restrictions or limitations, unless Covered Entity notifies Business Associate of the restriction or limitation and Business Associate agrees in writing to honor the restriction or limitation.
3.3 shall be responsible for using administrative, physical and technical safeguards to maintain and ensure the confidentiality, privacy and security of PHI transmitted to Business Associate pursuant to the Agreement, in accordance with the requirements of HIPAA.
3.4 shall obtain any consent or authorization that may be required by applicable federal or state laws prior to furnishing Business Associate the PHI for use and disclosure in accordance with this BAA.
3.5 if Covered Entity is an employer sponsored health plan, Covered Entity represents that to the extent applicable, it has ensured and has received certification from the applicable Plan Sponsor that the Plan Sponsor has taken the appropriate steps in accordance with 45 C.F.R. § 164.504(f) and 45 C.F.R. § 164.314(b) to enable Business Associate on behalf of Covered Entity to disclose PHI to Plan Sponsor, including but not limited to amending its plan documents to incorporate the requirements set forth in 45 C.F.R. § 164.504(f)(2) and 45 C.F.R. § 164.314(b). Covered Entity shall ensure that only employees authorized under 45 C.F.R. § 164.504(f) shall have access to the PHI disclosed by Business Associate to Plan Sponsor.
Responsibilities of Covered Entity. 5.1 Covered Entity shall notify Business Associate of any limitation(s) in the Notice of Privacy Practices of Covered Entity under 45 CFR 164.520, to the extent that such limitation may affect Business Associate’s Use or Disclosure of Protected Health Information.
5.2 Covered Entity shall notify Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose his or her Protected Health Information, to the extent that such changes may affect Business Associate’s Use or Disclosure of Protected Health Information.
5.3 Covered Entity shall notify Business Associate of any restriction on the Use or Disclosure of Protected Health Information that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect Business Associate’s Use or Disclosure of Protected Health Information.
5.4 Covered Entity shall use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic Protected Health Information that it may access from Business Associate’s system, and to ensure that the Use or Disclosure of such Protected Health Information comply with the HIPAA Rules. Business Associate shall not be responsible for enforcing such Covered Entity-developed safeguards.
5.5 Covered Entity shall ensure that the data it transmits, or direct another entity to transmit, to Business Associate, is timely, complete, and accurate, and will not cause a Security Incident or commit a Breach.
Responsibilities of Covered Entity. Covered Entity agrees to:
a. Notify Business Associate promptly of any restriction on the Use or Disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent such restriction may affect Business Associate's Use or Disclosure of PHI.
b. Notify Business Associate of any changes in, or revocation of, the permission by an Individual to Use or Disclose PHI, to the extent that such changes may affect Business Associate's Use or Disclosure of PHI.
c. Provide Business Associate with a copy of any amendment to PHI which is accepted by Covered Entity under 45 CFR 164.526 which Covered Entity believes will apply to PHI maintained by Business Associate in a Designated Record Set.
d. Not request Business Associate to Use or Disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Covered Entity, with exception for any Data Aggregation services permitted under Section 4.
e. Obtain any consent, authorization, or permission that may be required by the Privacy Rule, Part 2.
Responsibilities of Covered Entity. In addition to any other obligations set forth in the Agreement, including in this BAA, Covered Entity:
3.1 shall provide to Business Associate only the minimum PHI necessary to accomplish the Services;
3.2 in the event that the Covered Entity honors a request to restrict the use or disclosure of PHI pursuant to 45 C.F.R. § 164.522(a) or makes revisions to its notice of privacy practices of Covered Entity in accordance with 45 C.F.R. § 164.520 that increase the limitations on uses or disclosures of PHI or agrees to a request by an Individual for confidential communications under 45 C.F.R. § 164.522(b), Covered Entity agrees not to provide Business Associate any PHI that is subject to any of those restrictions or limitations to the extent any may limit Business Associate’s ability to use and/or disclose PHI as permitted or required under this BAA unless Covered Entity notifies Business Associate of the restriction or limitation and Business Associate agrees to honor the restriction or limitation;
3.3 shall be responsible for using administrative, physical and technical safeguards at all times to maintain and ensure the confidentiality, privacy and security of PHI transmitted to Business Associate pursuant to the Agreement, including this BAA, in accordance with the standards and requirements of HIPAA, until such PHI is received by Business Associate; and
3.4 shall obtain any consent or authorization that may be required by applicable federal or state laws and regulations prior to furnishing Business Associate the PHI.
