2017-655 Health - MOU with Dept of Family Medicine FIT program

Browse Search

future payment for the provision of health care to an individual; and that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual. "Protected Health Information" includes without limitation "Electronic Protected Health Information" as defined below. The term "Electronic Protected Health Information- means Protected Health Information that is transmitted by Electronic Media (as defined in the I- 1111AA Security and Privacy Rule) or maintained in Electronic Media. II. PERMITTED USES AND DISCLOSURES (a) Business Associate may use or disclose Protected Health Information only as permitted or required by this Agreement or as required by law. Except as specifically set forth herein, Business Associate may not use or disclose Protected Health Information in a manner that would violate the HIPAA Security and Privacy Rule if such use or disclosure were done by Covered Entity. Specifically, Business Associate may use or disclose Protected Health Information (l) for meeting its obligations as set forth in any agreements between the Parties evidencing their business relationship, including the Arrangement Agreement, or (2) as required by applicable law, rule or regulation, or by an accrediting or credentialing organization to whom Covered Entity is required to disclose such information, or (3) as otherwise permitted under this Agreement, the Arrangement Agreement (if consistent with this Agreement and the HIPAA Security and Privacy Rule), or the HIPAA Security and Privacy Rule, or (4) as would be permitted by the HIPAA Security and Privacy Rule as if such use or disclosure were made by Covered Entity. (b) Business Associate may de- identify Protected Health Information only at the specific direction of and only for the use of Covered Entity. Business Associate may not sell Protected Health Information except at the direction of Covered Entity and in compliance with the requirements of the I II PAA Security and Privacy Rule. (c) Notwithstanding the prohibitions set forth in this Agreement, (i) Business Associate may use Protected Health Information for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate; (ii) Business Associate may disclose Protected Health Information for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided that as to any such disclosure, the following requirements are met: (A) The disclosure is required by law; or (B) Business Associate obtains reasonable assurances from the person to whcnn the information is disclosed that the information will remain confidential and will be used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached; (iii) Business Associate may provide data aggregation services relating to the health care operations of Covered Entity pursuant to any agreements between the Parties evidencing their business relationship. For purposes of this Agreement, data aggregation means the combining of Protected Health Information by Business Associate with the Protected Health Information received by Business Associate in its capacity as a business associate of another covered entity, to permit data analyses that relate to the health care operations of the respective covered entities. (00102384.DOCX)