Orange County NC Website
Browse       Search
37 <br /> <br />d. Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health <br />Information not provided for by this BAA of which it becomes aware, including breaches of unsecured <br />protected health information as required by 45 C.F.R. § 164.410. <br />e. Business Associate agrees, in accordance with 45 C.F.R. § 164.502(e)(1) and § 164.308(b)(2), to ensure <br />that any subcontractors that create, receive, maintain, or transmit protected health information on behalf <br />of Business Associate agree to the same restrictions and conditions that apply to Business Associate with <br />respect to such information. <br />f. Business Associate agrees to make available protected health information as necessary to satisfy Covered <br />Entity’s obligations in accordance with 45 C.F.R. § 164.524. <br />g. Business Associate agrees to make available Protected Health Information for amendment and incorporate <br />any amendment(s) to Protected Health Information in accordance with 45 C.F.R. § 164.526. <br />h. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and <br />records relating to the use and disclosure of Protected Health Information received from, or created or <br />received by Business Associate on behalf of, Covered Entity available to the Secretary for purposes of <br />the Secretary determining Covered Entity's compliance with the Privacy Rule. <br />i. Business Associate agrees to make available the information required to provide an accounting of <br />disclosures of Protected Health Information in accordance with 45 C.F.R. § 164.528. <br />4. PERMITTED USES AND DISCLOSURES <br />a. Except as otherwise limited in this BAA or by other applicable law or agreement, if the Participation <br />Agreement permits, Business Associate may use or disclose Protected Health Information to perform <br />functions, activities, or services for, or on behalf of, Covered Entity as specified in the Participation <br />Agreement, provided that such use or disclosure: <br />1) would not violate the Privacy Rule if done by Covered Entity; or <br />2) would not violate the minimum necessary policies and procedures of the Covered Entity. <br />b. Except as otherwise limited in this BAA or by other applicable law or agreements, if the Participation <br />Agreement permits, Business Associate may disclose Protected Health Information for the proper <br />management and administration of the Business Associate or to carry out the legal responsibilities of the <br />Business Associate, provided that: <br />1) the disclosures are Required By Law; or <br />2) Business Associate obtains reasonable assurances from the person to whom the information is <br />disclosed that it will remain confidential and will be used or further disclosed only as Required By <br />Law or for the purpose for which it was disclosed to the person, and the person notifies the Business <br />Associate of any instances of which it is aware in which the confidentiality of the information has <br />been breached. <br />c. Except as otherwise limited in this BAA or by other applicable law or agreements, if the Participation <br />Agreement permits, Business Associate may use Protected Health Information to provide data aggregation <br />services to Covered Entity as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B). <br />d. Notwithstanding the foregoing provisions, Business Associate may not use or disclose Protected Health <br />Information if the use or disclosure would violate any term of the Participation Agreement or other <br />applicable law or agreements. <br />5. TERM AND TERMINATION <br />a. Term. This BAA shall be effective as of the effective date stated above and shall terminate when the <br />Participation Agreement terminates. <br />b. Termination for Cause. Upon Covered Entity's knowledge of a material breach by Business Associate, <br />Covered Entity may, at its option: <br />1) Provide an opportunity for Business Associate to cure the breach or end the violation, and terminate <br />this BAA and services provided by Business Associate, to the extent permissible by law, if Business <br />Associate does not cure the breach or end the violation within the time specified by Covered Entity; <br />2) Immediately terminate this BAA and services provided by Business Associate, to the extent <br />permissible by law; or <br />3) If neither termination nor cure is feasible, report the violation to the Secretary as provided in the <br />Privacy Rule. <br />DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC