Agenda 8-e - University of North Carolina Health Care System Electronic Medical Record System Access Agreement

Browse Search

Exhibit C - 2 I. DEFINITIONS Except as otherwise defined herein, any and all capitalized terms in this Agreement shall have the definitions set forth in the HIPAA Rules. In the event of an inconsistency between the provisions of this Agreement and mandatory provisions of the HIPAA Rules, as amended, the HIPAA Rules shall control. Where provisions of this Agreement are different than those mandated in the HIPAA Rules, but are nonetheless permitted by the HIPAA rules, the provisions of this Agreement shall control. The term “Protected Health Information” (“PHI”) shall have the meaning provided in 45 C.F.R. § 160.103 “Protected Health Information” includes without limitation “Electronic Protected Health Information” as defined below. The term “Electronic Protected Health Information” means Protected Health Information that is transmitted by Electronic Media (as defined in the HIPAA Rules) or maintained in Electronic Media. Business Associate acknowledges and agrees that all Protected Health Information that is created or received by Covered Entity and disclosed or made available in any form, including paper record, oral communication, audio recording, and electronic display by Covered Entity or its operating units to Business Associate or is created or received by Business Associate on Covered Entity’s behalf shall be subject to this Agreement. II. PERMITTED USES AND DISCLOSURES (a) Business Associate may use or disclose Protected Health Information only as permitted or required by this Agreement or as Required By Law. Except as specifically set forth herein, Business Associate may not use or disclose Protected Health Information in a manner that would violate the HIPAA Rules if such use or disclosure were done by Covered Entity. Specifically, Business Associate may use or disclose Protected Health Information (1) for meeting its obligations as set forth in any agreements between the Parties evidencing their business relationship, including the Arrangement Agreement, or (2) as required by applicable law, rule or regulation, or by an accrediting or credentialing organization to whom Covered Entity is required to disclose such information, or (3) as otherwise permitted under this Agreement, the Arrangement Agreement (if consistent with this Agreement and the HIPAA Rules), or the HIPAA Rules, or (4) as would be permitted by the HIPAA Rules as if such use or disclosure were made by Covered Entity. (b) Business Associate may De-identify Protected Health Information only at the specific direction of and only for the use of Covered Entity. Business Associate may not sell Protected Health Information except at the direction of Covered Entity and in compliance with the requirements of the HIPAA Rules. 33