Common use of Return or Destruction of Protected Health Information Clause in Contracts

Return or Destruction of Protected Health Information. Upon termination, cancellation, expiration or other conclusion of this Agreement, the Business Associate will: a. Return to the Covered Entity or, if return is not feasible, destroy all PHI and any compilation of PHI in any media or form. The Business Associate agrees to ensure that this provision also applies to PHI of the Covered Entity in possession of Subcontractors and agents of the Business Associate. The Business Associate agrees that any original record or copy of PHI in any media is included in and covered by this provision, as well as all original or copies of PHI provided to Subcontractors or agents of the Business Associate. The Business Associate agrees to complete the return or destruction as promptly as possible, but not more than thirty (30) business days after the conclusion of this Agreement. b. If the Business Associate destroys PHI, it shall be done with the use of technology or methodology that renders the PHI unusable, unreadable, or undecipherable to unauthorized individuals as specified by HHS in HHS guidance. Acceptable methods for destroying PHI include: i. Paper, film, or other hard copy media: shredded or destroyed in order that PHI cannot be read or reconstructed; and ii. Electronic media: cleared, purged or destroyed consistent with the standards of the National Institute of Standards and Technology (NIST). Redaction is specifically excluded as a method of destruction of PHI, unless the information is properly redacted so as to be fully de-identified. c. If the Business Associate believes that the return or destruction of PHI is not feasible, the Business Associate shall provide written notification of the conditions that make return or destruction not feasible. The Business Associate shall extend the protections of this Agreement to PHI and prohibit other further uses or disclosures of the PHI of the Covered Entity without the express written authorization of the Covered Entity. Subsequent use or disclosure of any PHI subject to this provision will be limited to the use or disclosure that makes return or destruction not feasible. Obligations of Business Associate shall survive the termination of this Agreement.

Return or Destruction of Protected Health Information. Upon termination, cancellation, expiration or other conclusion of this Agreement, the Business Associate shall and shall ensure its Subcontractors that possess PHI or data derived from PHI (“Related Data”) chose and fulfill one of the following options with respect to such PHI and Related Data will: a. Return PHI, and any Related Data, in whatever form or medium that Business Associate received from or created on behalf of the Covered Entity to the Covered Entity or, if return is not feasible, destroy all PHI and any Related Data and any compilation of PHI in any media or form. Covered Entity will be provided the opportunity to determine "feasibility" of returning PHI. The Business Associate agrees to ensure that this provision also applies to PHI of the Covered Entity in possession of Subcontractors subcontractors and agents of the Business Associate. The Business Associate agrees that any original record or copy of PHI in any media is included in and covered by this provision, as well as all original or copies of PHI provided to Subcontractors subcontractors or agents of the Business Associate. In such case, no copies of such PHI and Related Data shall be retained. The Business Associate agrees to complete the return or destruction as promptly as possible, but not more than thirty sixty (3060) business calendar days after the conclusion of this Agreement. The Business Associate will provide written documentation evidencing that return or destruction of all PHI has been completed. b. If the Business Associate destroys PHI, and any Related Data, it shall be done with the use of technology or methodology that renders the PHI unusable, unreadable, or undecipherable to unauthorized individuals as specified by HHS in HHS guidanceguidance at xxxx://xxx.xxx.xxx/ocr/privacy/hipaa/administrative/breachnotificationrule/brguidance.html. Acceptable methods for destroying PHI include: i. Paper, film, or other hard copy media: shredded or destroyed in order that PHI or Related Data cannot be read or reconstructed; and ii. Electronic media: cleared, purged or destroyed consistent with the standards of the National Institute of Standards and Technology (NIST). iii. Redaction is specifically excluded as a method of destruction of PHIPHI or Related Data, unless the information is properly redacted so as to be fully de-identified. c. If the Business Associate believes that the return or destruction of PHI PHI, and any Related Data, is not feasible, the Business Associate shall provide written notification of the conditions that make return or destruction not feasible. The This notice shall be provided as promptly as possible, but not more than sixty (60) calendar days after the conclusion of this Agreement. If the Business Associate and Covered Entity agree that return or destruction of PHI and Related Data is not feasible, the Business Associate shall extend the protections of this Agreement to PHI and Related Data received from or created on behalf of Covered Entity, and prohibit other further uses or disclosures of the PHI and Related Data of the Covered Entity without the express written authorization of the Covered Entity. Subsequent use or disclosure of any PHI and Related Data subject to this provision will be limited to the use or disclosure that makes return or destruction not feasible. Obligations of Business Associate shall survive the termination of this Agreement.

Return or Destruction of Protected Health Information. Upon termination, cancellation, expiration or other conclusion of this Agreement, the Business Associate will: a. Return to the Covered Entity or, if return is not feasible, destroy all PHI and any compilation of PHI in any media or form. The Business Associate agrees to ensure that this provision also applies to PHI of the Covered Entity in possession of Subcontractors and agents of the Business Associate. The Business Associate agrees that any original record or copy of PHI in any media is included in and covered by this provision, as well as all original or copies of PHI provided to Subcontractors or agents of the Business Associate. The Business Associate agrees to complete the return or destruction as promptly as possible, but not more than thirty (30) business days after the conclusion of this Agreement. b. If the Business Associate destroys PHI, it shall be done with the use of technology or methodology that renders the PHI unusable, unreadable, or undecipherable to unauthorized individuals as specified by HHS in HHS guidance. Acceptable methods for destroying PHI include: i. (i) Paper, film, or other hard copy media: shredded or destroyed in order that PHI cannot be read or reconstructed; and (ii. ) Electronic media: cleared, purged or destroyed consistent with the standards of the National Institute of Standards and Technology (NIST). Redaction is specifically excluded as a method of destruction of PHI, unless the information is properly redacted so as to be fully de-identified. c. If the Business Associate believes that the return or destruction of PHI is not feasible, the Business Associate shall provide written notification of the conditions that make return or destruction not feasible. The Business Associate shall extend the protections of this Agreement to PHI and prohibit other further uses or disclosures of the PHI of the Covered Entity without the express written authorization of the Covered Entity. Subsequent use or disclosure of any PHI subject to this provision will be limited to the use or disclosure that makes return or destruction not feasible. Obligations of Business Associate shall survive the termination of this Agreement.

Return or Destruction of Protected Health Information. Upon termination, cancellation, expiration or other conclusion of this Agreement, the Business Associate will: a. Return to the Covered Entity or, if return is not feasible, destroy all PHI and any compilation of PHI in any media or form. The Business Associate agrees to ensure that this his provision also applies to PHI of the Covered Entity in possession of Subcontractors subcontractors and agents of the Business Associate. The Business Associate agrees that any original record or copy of PHI in any media is included in and covered by this provision, as well as all original or copies of PHI provided to Subcontractors subcontractors or agents of the Business Associate. The Business Associate agrees to complete the return or destruction as promptly as possible, but not more than thirty (30) business days after the conclusion of this Agreement. The Business Associate will provide written documentation evidencing that return or destruction of all PHI has been completed. b. If the Business Associate destroys PHI, it shall be done with the use of technology or methodology that renders the PHI unusable, unreadable, or undecipherable to unauthorized individuals as specified by HHS Fond du Lac County in HHS Fond du Lac County guidance. Acceptable methods for destroying PHI include: i. (i) Paper, film, film or other hard copy media: ; shredded or destroyed in order that PHI cannot be read or reconstructed; and (ii. ) Electronic media: cleared, purged or destroyed consistent with the standards of the National Institute of Standards and Technology (NIST). Redaction is specifically excluded as a method of destruction of PHI, unless the information is properly redacted so as to be fully de-identified. c. If the Business Associate believes that the return or destruction of PHI is not feasible, the Business Associate shall provide written notification of the conditions that make return or destruction not feasible. The If the Business Associate and Covered Entity agree that return or destruction of PHI is not feasible, the Business Associate shall extend the protections of this Agreement to PHI and prohibit other further uses or disclosures of the PHI of the Covered Entity without the express written authorization of the Covered Entity. Subsequent use or disclosure of any PHI subject to this provision will be limited to the use or disclosure that makes return or destruction not feasible. Obligations of Business Associate shall survive the termination of this Agreement.

Return or Destruction of Protected Health Information. Upon termination, cancellation, expiration expiration, or other conclusion of this AgreementAgreement as determined by the Covered Entity, the Business Associate willshall, and shall ensure its Subcontractors that possess PHI or data derived from PHI, fulfill one of the following options with respect to PHI as directed by the Covered Entity: a. Return PHI, and any Related Data, to the Covered Entity or, if return is not feasible, destroy all PHI and any compilation of PHI in any media customary industry form or form. The Business Associate agrees to ensure that this provision also applies to PHI medium as directed within the sole discretion of the Covered Entity in possession of Subcontractors and agents of at the Business Associate’s expense. The Business Associate agrees that any original record or copy of PHI in any media is included in and covered by this provision, as well as all original or No copies of such PHI provided to Subcontractors or agents of the Business Associateand Related Data shall be retained. The Business Associate agrees to complete the return or destruction PHI and Related Data shall be returned as promptly as possible, but not more than thirty after the effective date of conclusion of this Agreement or the Underlying Contract. Within five (305) business days after the effective date of the conclusion of this AgreementAgreement or the Underlying Contract, Business Associate shall certify on oath in writing to Covered Entity that such return has been completed. b. If Destroy the Business Associate destroys PHI, it shall be done with the use of and any Related Data, using technology or a methodology that renders the PHI PHI, or Related Data, unusable, unreadable, or undecipherable to unauthorized individuals as specified by HHS in HHS guidanceits guidance at: xxxx://xxx.xxx.xxx/ocr/privacy/hipaa/administrative/breachnotificationrule/brguidance.html. Acceptable methods for destroying PHI or Related Data include: i. Paper: (A) paper, film, or other hard copy media: media shredded or destroyed in order that PHI or Related Data cannot be read or reconstructed; and ii. Electronic media: and (B) electronic media cleared, purged or destroyed consistent with the standards of the National Institute of Standards and Technology (NIST). Redaction is specifically excluded as a method of destruction of PHI, unless the information PHI or Related Data is properly redacted so as to be fully de-identifiedspecifically excluded. c. If the Business Associate believes that the return or destruction of PHI or Related Data is not feasible, the Business Associate shall provide written notification of the conditions that make return or destruction infeasible. If the Covered Entity agrees that return or destruction is not feasible. The , Business Associate shall extend the protections of this Agreement to PHI and prohibit other Related Data received from or created on behalf of Covered Entity, and limit further uses or and disclosures of such PHI and Related Data, for so long as Business Associate maintains the PHI of PHI. If the Covered Entity without does not agree that destruction is infeasible, the express written authorization of Business Associate must return the PHI in the format and within time frame as determined by the Covered Entity. Subsequent use or disclosure of any PHI subject to this provision will be limited to the use or disclosure that makes return or destruction not feasible. Obligations of Entity at Business Associate shall survive the termination of this AgreementAssociate’s expense.

Return or Destruction of Protected Health Information. Upon termination, cancellation, expiration expiration, or other conclusion of this Agreement, the Business Associate will: a. Return to the Covered Entity or, if return is not feasible, destroy all PHI Protected Health Information and any compilation of PHI Protected Health Information in any media or form. The Business Associate agrees to ensure that this provision also applies to PHI Protected Health Information of the Covered Entity in possession of Subcontractors subcontractors and agents of the Business Associate. The Business Associate agrees that any original record or copy of PHI Protected Health Information in any media is included in and covered by this provision, as well as all original originals or copies of PHI Protected Health Information provided to Subcontractors subcontractors or agents of the Business Associate. The Business Associate agrees to complete the return or destruction as promptly as possible, but not more than thirty (30) 30 business days after the conclusion of this Agreement. The Business Associate will provide written documentation evidencing that return or destruction of all Protected Health Information has been completed. b. If the Business Associate destroys PHIProtected Health Information, it shall be done with the use of technology or methodology that renders the PHI Protected Health Information unusable, unreadable, or undecipherable to unauthorized individuals as specified by HHS in HHS guidance. Acceptable methods for destroying PHI Protected Health Information include: i. PaperFor paper, film, or other hard copy media: shredded Shredding or destroyed destroying in order that PHI Protected Health Information cannot be read or reconstructed; and ii. Electronic For electronic media: clearedClearing purging, purged or destroyed destroying consistent with the standards of the National Institute of Standards and Technology technology (NIST). ) Redaction is specifically excluded as a method of destruction of PHI, unless the information Protected Health. Information is properly redacted so as to be fully de-identified. c. If the Business Associate believes that the return or destruction of PHI Protected Health Information is not feasible, the Business Associate shall provide written notification of the conditions that make return or destruction is not feasible. The If the Business Associate and Covered Entity agree that return or destruction of Protected Health Information is not feasible, the Business Associate shall extend the protections of this Agreement to PHI Protected Health Information and prohibit other further uses or disclosures of the PHI Protected Health Information of the Covered Entity without the express written authorization of the Covered Entity. Subsequent use or disclosure of any PHI Protected Health Information subject to this provision will be limited to the use or disclosure that makes return or destruction not feasible. Obligations of Business Associate shall survive the termination of this Agreement.

Return or Destruction of Protected Health Information. Upon termination, cancellation, expiration expiration, or other conclusion of this Agreement, the Business Associate will: a. Return to the Covered Entity or, if return is not feasible, destroy all PHI Protected Health Information and any compilation of PHI Protected Health Information in any media or form. The Business Associate agrees to ensure that this provision also applies to PHI Protected Health Information of the Covered Entity in possession of Subcontractors subcontractors and agents of the Business Associate. The Business Associate agrees that any original record or copy of PHI Protected Health Information in any media is included in and covered by this provision, as well as all original originals or copies of PHI Protected Health Information provided to Subcontractors subcontractors or agents of the Business Associate. The Business Associate agrees to complete the return or destruction as promptly as possible, but not more than thirty (30) 30 business days after the conclusion of this Agreement. The Business Associate will provide written documentation evidencing that return or destruction of all Protected Health Information has been completed. b. If the Business Associate destroys PHIProtected Health Information, it shall be done with the use of technology or methodology that renders the PHI Protected Health Information unusable, unreadable, or undecipherable to unauthorized individuals as specified by HHS in HHS guidance. Acceptable methods for destroying PHI Protected Health Information include: i. PaperFor paper, film, or other hard copy media: shredded Shredding or destroyed destroying in order that PHI Protected Health Information cannot be read or reconstructed; and ii. Electronic For electronic media: clearedClearing, purged purging, or destroyed destroying consistent with the standards of the National Institute of Standards and Technology (NIST). ) Redaction is specifically excluded as a method of destruction of PHI, unless the information Protected Health Information. Information is properly redacted so as to be fully de-identified. c. If the Business Associate believes that the return or destruction of PHI Protected Health Information is not feasible, the Business Associate shall provide written notification of the conditions that make return or destruction is not feasible. The If the Business Associate and Covered Entity agree that return or destruction of Protected Health Information is not feasible, the Business Associate shall extend the protections of this Agreement to PHI Protected Health Information and prohibit other further uses or disclosures of the PHI Protected Health Information of the Covered Entity without the express written authorization of the Covered Entity. Subsequent use or disclosure of any PHI Protected Health Information subject to this provision will be limited to the use or disclosure that makes return or destruction not feasible. Obligations of Business Associate shall survive the termination of this Agreement.