Orange County NC Website
Browse       Search
(c) Notwithstanding the prohibitions set forth in this Agreement, <br /> (1) Business Associate may use Protected Health Information for the proper <br /> management and administration of Business Associate or to carry out the legal responsibilities of <br /> Business Associate ; <br /> (ii) Business Associate may disclose Protected Health Information for the proper <br /> management and administration of Business Associate or to carry out the legal responsibilities of <br /> Business Associate , provided that as to any such disclosure , the following requirements are met : <br /> (A) The disclosure is Required By Law; or <br /> (B ) Business Associate obtains reasonable assurances from the person to whom the <br /> information is disclosed that the information will remain confidential and will be used or further <br /> disclosed only as Required By Law or for the purpose for which it was disclosed to the person, <br /> and the person notifies Business Associate of any instances of which it is aware in which the <br /> confidentiality of the information has been breached ; <br /> (iii) Business Associate may provide data aggregation services relating to the health care <br /> operations of Covered Entity pursuant to any agreements between the Parties evidencing their <br /> business relationship . For purposes of this Agreement, data aggregation means the combining of <br /> Protected Health Information by Business Associate with the protected health information <br /> received by Business Associate in its capacity as a business associate of another covered entity, <br /> to permit data analyses that relate to the health care operations of the respective covered entities . <br /> III . CONFIDENTIALITY AND SECURITY REQUIREMENTS <br /> (a) Business Associate agrees not to use or disclose Protected Health Information <br /> other than as permitted or required by this Agreement or as Required By Law . To the extent <br /> Business Associate carries out obligations of Covered Entity under the HIPAA Rules , Business <br /> Associate shall comply with the applicable provisions of the HIPAA Rules as if such use or <br /> disclosure were made by Covered Entity , Covered Entity will not request Business Associate to <br /> use or disclose Protected Health Information in any manner that would not be permissible under <br /> the HIPAA Rules if done by Covered Entity . Business Associate agrees to comply with Covered <br /> Entity ' s policies regarding the Minimum Necessary use or disclosure of Protected Health <br /> Information, provided such policies are consistent with the HIPAA Rules and are provided to <br /> Business Associate in writing in advance . <br /> (b) Business Associate agrees to provide HIPAA training to all of its personnel who <br /> service Covered Entity ' s account or who otherwise will have access to Covered Entity ' s <br /> Protected Health Information . <br /> Exhibit C - 3 <br />