2019-834-E AMS - StarPoint scanning services

Browse Search

12 accreditation, or financial services to or for such Covered Entity, or to or for and organized health care arrangement in which the Covered Entity participates, where the provision of the service involves the disclosure of Individually Identifiable Health Information from such Covered Entity or arrangement, or from another Business Associate of such Covered Entity or arrangement, to the person. d. “Individually Identifiable Health Information” means information that is a subset of health information, including demographic information collected from an individual, and; (1) is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (2) relates to past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and a) that identifies the individual; or b) with respect to which there is a reasonable cause to believe the information can be used to identify the individual. e. “Protected Health Information” or “PHI” means Individually Identifiable Health Information that is transmitted by electronic media; maintained in any medium described in the definition of the term electronic media in the HIPAA Regulations; or transmitted or maintained in any other form or medium. Protected Health Information excludes Individually Identifiable Health Information in educational records covered by the Family Educational Right and Privacy Act, as amended, 20 U.S.C. § 1232g, and records described at 20 U.S.C. § 1232g(a)(4)(B)(iv). f. “Data Aggregation” means, with respect to PHI created or received by a Business Associate in its capacity as the Business Associate of a Covered Entity, the combining of such PHI by the Business Associate with the PHI received by the Business Associate in its capacity as a Business Associate of another covered entity, to permit data analyses that relate to the health care operations of the respective covered entities. 2. Status of Parties. Business Associate hereby acknowledges and agrees the Covered Entity is a covered entity as defined under the HIPAA Regulations and that Business Associate is a business associate as defined under the HIPAA Regulations. 3. Permitted Uses and Disclosures. a. Performance of Services. Business Associate may use and disclose PHI received from, or created or received on behalf of, Covered Entity only in connection with the performance of the services contracted for in the agreement between Business Associate and Covered Entity dated _________________ (“the Underlying Agreement”). b. Proper Management and Administration. Business Associate may use PHI received by Business Associate in its capacity as Business Associate of Covered Entity for the proper management and administration of Business Associate in connection with the performance of services in the Underlying Agreement and as permitted by this Agreement. Business Associate may disclose Covered Entity’s PHI for such proper management and administration of Business Associate only with the prior consent of Covered Entity. Any such disclosure of PHI shall only be made if a Business Associate obtains reasonable assurances from the person to whom the PHI is disclosed that: (1) the PHI will be held confidentially and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and (2) Business Associate will be notified by such person of any instances of which it becomes aware in which the confidentiality of the PHI has been breached. DocuSign Envelope ID: 2A625151-A0A5-4550-AF52-91CBC3DDBC3C