Orange County NC Website
Browse       Search
Exhibit C - 3 <br /> <br /> <br /> (c) Notwithstanding the prohibitions set forth in this Agreement, <br /> <br /> (i) Business Associate may use Protected Health Information for the proper <br />management and administration of Business Associate or to carry out the legal responsibilities of <br />Business Associate; <br /> <br /> (ii) Business Associate may disclose Protected Health Information for the proper <br />management and administration of Business Associate or to carry out the legal responsibilities of <br />Business Associate, provided that as to any such disclosure, the following requirements are met: <br /> <br />(A) The disclosure is Required By Law; or <br />(B) Business Associate obtains reasonable assurances from the person to whom the <br />information is disclosed that the information will remain confidential and will be used or further <br />disclosed only as Required By Law or for the purpose for which it was disclosed to the person, <br />and the person notifies Business Associate of any instances of which it is aware in which the <br />confidentiality of the information has been breached; <br /> <br />(iii) Business Associate may provide data aggregation services relating to the health care <br />operations of Covered Entity pursuant to any agreements between the Parties evidencing their <br />business relationship. For purposes of this Agreement, data aggregation means the combining of <br />Protected Health Information by Business Associate with the protected health information <br />received by Business Associate in its capacity as a business associate of another covered entity, <br />to permit data analyses that relate to the health care operations of the respective covered entities. <br /> <br />III. CONFIDENTIALITY AND SECURITY REQUIREMENTS <br /> <br /> (a) Business Associate agrees not to use or disclose Protected Health Information <br />other than as permitted or required by this Agreement or as Required By Law. To the extent <br />Business Associate carries out obligations of Covered Entity under the HIPAA Rules, Business <br />Associate shall comply with the applicable provisions of the HIPAA Rules as if such use or <br />disclosure were made by Covered Entity. Covered Entity will not request Business Associate to <br />use or disclose Protected Health Information in any manner that would not be permissible under <br />the HIPAA Rules if done by Covered Entity. Business Associate agrees to comply with Covered <br />Entity’s policies regarding the Minimum Necessary use or disclosure of Protected Health <br />Information, provided such policies are consistent with the HIPAA Rules and are provided to <br />Business Associate in writing in advance. <br /> <br /> (b) Business Associate agrees to provide HIPAA training to all of its personnel who <br />service Covered Entity’s account or who otherwise will have access to Covered Entity’s <br />Protected Health Information. <br /> <br />34