No Obligation to Third Parties The execution and delivery of this Agreement shall not be deemed to confer any rights upon, nor obligate either of the parties hereto to, any person or entity not a party to this Agreement.
Business Associate Obligations Business Associate agrees to comply with applicable federal confidentiality and security laws, specifically the provisions of the HIPAA Rules and the HITECH Act applicable to business associates, including:
2.1 Use and Disclosure of PHI. Except as otherwise permitted by this Agreement, the HIPAA Rules, or applicable law, Business Associate shall not make any uses or disclosures of PHI except as necessary to provide services to, or on behalf of, Covered Entity as described in the Underlying Agreement, and shall not use or disclose PHI that would violate the HIPAA Rules or HITECH Act if used or disclosed by Covered Entity; provided, however, Business Associate may use and disclose PHI as necessary for the proper management and administration of Business Associate, or to carry out its legal responsibilities, consistent with Covered Entity’s minimum necessary policies and procedures. Business Associate may not use or disclose PHI which it creates, receives, maintains or transmits for or on behalf of the Covered Entity for any purpose except as otherwise provided by the Agreement and this BAA. Business Associate agrees to review and understand any state privacy and security laws to the extent that such laws are not preempted by HIPAA, as may be amended from time to time. Business Associate acknowledges that it shall comply specifically with the HIPAA Security Rule, and, to the extent that Business Associate is to carry out one or more of Covered Entity’s obligations under the Privacy Rule, it shall comply with the requirements of the Privacy Rule which apply to Covered Entity in the performance of such obligation(s). Business Associate shall in such cases:
2.1.1 provide information to members of its workforce using or disclosing PHI regarding the confidentiality requirements in the HIPAA Rules and this Agreement;
2.1.2 obtain reasonable assurances, in writing from the person or entity to whom the PHI is disclosed that: (i) the PHI will be held in confidence and further used and disclosed only as required by law or for the purpose for which it was disclosed to the person or entity; and (ii) the person or entity will notify Business Associate of any instances of which it is aware in which confidentiality of the PHI has been breached; and
2.1.3 agree to notify the Privacy Officer of Covered Entity of any instances of which it is aware in which the PHI is used or disclosed for a purpose that is not otherwise provided for in this Agreement or for a purpose not expressly permitted by the HIPAA Rules or HITECH Act.
2.2 Marketing; Sale of PHI. Business Associate may not use or disclose PHI for marketing purposes. Marketing includes any communication which would encourage the recipient to use or purchase a product or service. Business Associate may not use or disclose PHI where it has directly or indirectly received remuneration, financial or otherwise, from or on behalf of the recipient of the PHI in exchange for the PHI. “Sale” is not limited to circumstances where a transfer of ownership occurs, and would include access, license or lease agreements.
No Obligations to Third Parties Except as otherwise expressly provided herein, the execution and delivery of this Agreement shall not be deemed to confer any rights upon, nor obligate any of the parties hereto, to any person or entity other than the parties hereto.
OBLIGATIONS AND ACTIVITIES OF CONTRACTOR AS BUSINESS ASSOCIATE 1. CONTRACTOR agrees not to use or further disclose PHI COUNTY discloses to CONTRACTOR other than as permitted or required by this Business Associate Contract or as required by law.
2. XXXXXXXXXX agrees to use appropriate safeguards, as provided for in this Business Associate Contract and the Agreement, to prevent use or disclosure of PHI COUNTY discloses to CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY other than as provided for by this Business Associate Contract.
3. XXXXXXXXXX agrees to comply with the HIPAA Security Rule at Subpart C of 45 CFR Part 164 with respect to electronic PHI COUNTY discloses to CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY.
4. CONTRACTOR agrees to mitigate, to the extent practicable, any harmful effect that is known to CONTRACTOR of a Use or Disclosure of PHI by CONTRACTOR in violation of the requirements of this Business Associate Contract.
5. XXXXXXXXXX agrees to report to COUNTY immediately any Use or Disclosure of PHI not provided for by this Business Associate Contract of which CONTRACTOR becomes aware. CONTRACTOR must report Breaches of Unsecured PHI in accordance with Paragraph E below and as required by 45 CFR § 164.410.
6. CONTRACTOR agrees to ensure that any Subcontractors that create, receive, maintain, or transmit PHI on behalf of CONTRACTOR agree to the same restrictions and conditions that apply through this Business Associate Contract to CONTRACTOR with respect to such information.
7. CONTRACTOR agrees to provide access, within fifteen (15) calendar days of receipt of a written request by COUNTY, to PHI in a Designated Record Set, to COUNTY or, as directed by COUNTY, to an Individual in order to meet the requirements under 45 CFR § 164.524. If CONTRACTOR maintains an Electronic Health Record with PHI, and an individual requests a copy of such information in an electronic format, CONTRACTOR shall provide such information in an electronic format.
8. CONTRACTOR agrees to make any amendment(s) to PHI in a Designated Record Set that COUNTY directs or agrees to pursuant to 45 CFR § 164.526 at the request of COUNTY or an Individual, within thirty (30) calendar days of receipt of said request by COUNTY. XXXXXXXXXX agrees to notify COUNTY in writing no later than ten (10) calendar days after said amendment is completed.
9. CONTRACTOR agrees to make internal practices, books, and records, including policies and procedures, relating to the use and disclosure of PHI received from, or created or received by CONTRACTOR on behalf of, COUNTY available to COUNTY and the Secretary in a time and manner as determined by COUNTY or as designated by the Secretary for purposes of the Secretary determining COUNTY’S compliance with the HIPAA Privacy Rule.
10. CONTRACTOR agrees to document any Disclosures of PHI COUNTY discloses to CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY, and to make information related to such Disclosures available as would be required for COUNTY to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
11. CONTRACTOR agrees to provide COUNTY or an Individual, as directed by COUNTY, in a time and manner to be determined by COUNTY, that information collected in accordance with the Agreement, in order to permit COUNTY to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528.
12. XXXXXXXXXX agrees that to the extent CONTRACTOR carries out COUNTY’s obligation under the HIPAA Privacy and/or Security rules CONTRACTOR will comply with the requirements of 45 CFR Part 164 that apply to COUNTY in the performance of such obligation.
13. If CONTRACTOR receives Social Security data from COUNTY provided to COUNTY by a state agency, upon request by COUNTY, CONTRACTOR shall provide COUNTY with a list of all employees, subcontractors and agents who have access to the Social Security data, including employees, agents, subcontractors and agents of its subcontractors.
14. CONTRACTOR will notify COUNTY if CONTRACTOR is named as a defendant in a criminal proceeding for a violation of HIPAA. COUNTY may terminate the Agreement, if CONTRACTOR is found guilty of a criminal violation in connection with HIPAA. COUNTY may terminate the Agreement, if a finding or stipulation that CONTRACTOR has violated any standard or requirement of the privacy or security provisions of HIPAA, or other security or privacy laws are made in any administrative or civil proceeding in which CONTRACTOR is a party or has been joined. COUNTY will consider the nature and seriousness of the violation in deciding whether or not to terminate the Agreement.
Protection of Customer Data The Supplier shall not delete or remove any proprietary notices contained within or relating to the Customer Data. The Supplier shall not store, copy, disclose, or use the Customer Data except as necessary for the performance by the Supplier of its obligations under this Call Off Contract or as otherwise Approved by the Customer. To the extent that the Customer Data is held and/or Processed by the Supplier, the Supplier shall supply that Customer Data to the Customer as requested by the Customer and in the format (if any) specified by the Customer in the Call Off Order Form and, in any event, as specified by the Customer from time to time in writing. The Supplier shall take responsibility for preserving the integrity of Customer Data and preventing the corruption or loss of Customer Data. The Supplier shall perform secure back-ups of all Customer Data and shall ensure that up-to-date back-ups are stored off-site at an Approved location in accordance with any BCDR Plan or otherwise. The Supplier shall ensure that such back-ups are available to the Customer (or to such other person as the Customer may direct) at all times upon request and are delivered to the Customer at no less than six (6) Monthly intervals (or such other intervals as may be agreed in writing between the Parties). The Supplier shall ensure that any system on which the Supplier holds any Customer Data, including back-up data, is a secure system that complies with the Security Policy and the Security Management Plan (if any). If at any time the Supplier suspects or has reason to believe that the Customer Data is corrupted, lost or sufficiently degraded in any way for any reason, then the Supplier shall notify the Customer immediately and inform the Customer of the remedial action the Supplier proposes to take. If the Customer Data is corrupted, lost or sufficiently degraded as a result of a Default so as to be unusable, the Supplier may: require the Supplier (at the Supplier's expense) to restore or procure the restoration of Customer Data to the extent and in accordance with the requirements specified in Call Off Schedule 8 (Business Continuity and Disaster Recovery) or as otherwise required by the Customer, and the Supplier shall do so as soon as practicable but not later than five (5) Working Days from the date of receipt of the Customer’s notice; and/or itself restore or procure the restoration of Customer Data, and shall be repaid by the Supplier any reasonable expenses incurred in doing so to the extent and in accordance with the requirements specified in Call Off Schedule 8 (Business Continuity and Disaster Recovery) or as otherwise required by the Customer.
Proprietary Information Obligations You acknowledge your continuing obligations under your Proprietary Information and Inventions Agreement, a copy of which is attached hereto as Exhibit A.
Obligations to Third Parties Each party warrants and represents that this Agreement does not conflict with any contractual obligations, expressed or implied, undertaken with any Third Party.
Confidentiality Obligation Information that comes into the possession of the parties in connection with the Agreement and the implementation of the Agreement shall be kept confidential, and shall not be disclosed to any third party without the consent of the other party. If the Customer is a public body, the scope of the confidentiality obligation under this provision shall not go beyond that laid down by the Act of 10 February 1967 relating to Procedure in Cases concerning the Public Administration (Public Administration Act) or corresponding sector-specific regulations. The confidentiality obligation pursuant to this provision shall not prevent the disclosure of information if such disclosure is demanded pursuant to laws or regulations, including any disclosure or right of access pursuant to the Act of 19 May 2006 relating to the Right of Access to Documents in the Public Administration (Freedom of Information Act). The other party shall, if possible, be notified prior to the disclosure of such information. The confidentiality obligation shall not prevent the information from being used when there is no legitimate interest in keeping it confidential, for example when it is in the public domain or is accessible to the public elsewhere. The parties shall take all necessary precautions to prevent unauthorised persons from gaining access to, or knowledge of, confidential information. The confidentiality obligation shall apply to the parties’ employees, subcontractors and other third parties who act on behalf of the parties in connection with the implementation of the Agreement. The parties may only transmit confidential information to such subcontractors and third parties to the extent necessary for the implementation of the Agreement, and provided that they are subjected to a confidentiality obligation corresponding to that stipulated in this clause 2.5. The confidentiality obligation shall not prevent the parties from utilising experience and expertise developed in connection with the implementation of the Agreement. The confidentiality obligation shall continue to apply after the expiry of the Agreement. Employees or others who resign from their positions with one of the parties shall be subjected to a confidentiality obligation following their resignation as well, as far as factors mentioned above are concerned. The confidentiality obligation shall lapse five (5) years after the delivery date, unless otherwise stipulated by law or regulation.
Confidentiality Obligations Each Party or third party whose Confidential Information has been disclosed retains ownership of its Confidential Information. Each Party agrees to (i) protect the Confidential Information received from the Disclosing Party in the same manner as it protects the confidentiality of its own proprietary and confidential materials but in no event with less than reasonable care; and (ii) use the Confidential Information received from the Disclosing Party solely for the purpose of the Agreement. Upon termination of the Agreement or upon written request submitted by the Disclosing Party, whichever comes first, the Receiving Party shall return or destroy, at the Disclosing Party’s choice, all of the Disclosing Party’s Confidential Information. Notwithstanding the foregoing, AVEVA shall not be required to return or destroy any such Confidential Information if such return or destruction is impracticable or technically infeasible. Except with respect to its Affiliates, employees, contractors, or agents who need to know Confidential Information in order to support the performance of such Party’s obligations related to the Agreement, and who are contractually bound by confidentiality obligations that are at least as protective as those contained in the Agreement, neither Party shall, disclose to any person any Confidential Information received from the Disclosing Party without the Disclosing Party’s prior written consent. The Receiving Party will be responsible for any breach of this Section 5 (Confidentiality) by its Affiliates, employees, contractors, and agents and any third party to whom it discloses Confidential Information in accordance with this Section 5 (Confidentiality). For Confidential Information that does not constitute a “trade secret” under applicable law, these confidentiality obligations will expire three (3) years after the termination or expiration of the Agreement. For Confidential Information that constitutes a “trade secret” under applicable law, these confidentiality obligations will continue until such information ceases to constitute a “trade secret” under such applicable law. However, the Receiving Party may disclose Confidential Information pursuant to an order of a court or governmental agency, provided, that, if permitted by applicable law, the Receiving Party shall first notify the Disclosing Party of such order and afford the Disclosing Party the opportunity to seek a protective order relating to such disclosure. Notwithstanding anything to the contrary contained in this Agreement, Customer authorizes AVEVA to collect, use, disclose, and modify in perpetuity information or data (including, but not limited to, general usage information and measurements) that is provided by Customer in connection with the use or receipt of the Products and Support Services (or generated or created in the course of AVEVA providing the Products and Support Services) for the purposes of developing, improving, optimizing, and delivering Products and Support Services; provided, however, that any disclosure of such data shall only include information or data that AVEVA develops or derives from such collected data or information (but such disclosure will not include the actual underlying Confidential Information of Customer).
Duration of Confidentiality Obligations The Receiving Party’s obligations under this Article apply to Confidential Information of the Furnishing Party disclosed to the Receiving Party before or after the Effective Date and will continue during the Agreement Term and survive the expiration or termination of the Agreement as follows:
(a) as to any portion of the Furnishing Party’s Confidential Information that constitutes a trade secret under applicable law, the obligations will continue for as long as the Furnishing Party continues to treat such information as a trade secret; and
(b) as to all other Confidential Information of the Furnishing Party, the obligations will survive for two (2) years after the Receiving Party’s fulfillment of its obligations under Section 13.4 with respect to the Confidential Information in question.
