Orange County NC Website
Browse       Search
13 <br />c. Data Aggregation. Business Associate may use and disclose PHI received by Business Associate <br />in its capacity as Business Associate of Covered Entity to provide Data Aggregation services relating to the <br />health care operations of Covered Entity only with permission of the Covered Entity. <br /> <br />4. Nondisclosure. <br /> <br />a. As Provided in Agreement. Business Associate shall not use or further disclose Covered Entity’s <br />PHI otherwise than as permitted or required by this Agreement. <br /> <br />b. Disclosures Required By Law. Business Associate shall not, without prior written consent of <br />Covered Entity, disclose any PHI on the chance that such disclosure is required by law without notifying <br />Covered Entity so that the Covered Entity shall have an opportunity to object to the disclosure and to seek <br />appropriate relief. If Covered Entity objects to such a disclosure, Business Associate shall refrain from <br />disclosing the PHI until Covered Entity has exhausted all alternatives for relief. Business Associate shall <br />require reasonable assurances from persons receiving PHI in accordance with Section 3b that such persons <br />will provide Covered Entity with similar notice and opportunity to object before disclosing PHI on the <br />chance that such disclosure is required by law. <br /> <br />c. Additional Restrictions. If Covered Entity notifies Business Associate that Covered Entity has <br />agreed to be bound by additional restrictions on the uses or disclosures of Covered Entity’s PHI pursuant to <br />HIPAA or the HIPAA Regulations, Business Associate shall be bound by such additional restrictions and <br />shall not disclose Covered Entity’s PHI in violation of such additional restrictions. <br /> <br />5. Safeguards, Reporting, Mitigation and Enforcement. <br /> <br />a. Safeguards. Business Associate shall maintain a comprehensive written information privacy and <br />security program that includes administrative, technical and physical safeguards that reasonably and <br />appropriately protect the confidentiality, integrity and availability of any electronic PHI it creates, receives, <br />maintains or transmits on behalf of Covered Entity. In addition to any safeguards specifically set forth in <br />this Agreement, Business Associate shall use any and all appropriate safeguards to prevent use or <br />disclosure of Covered Entity’s PHI otherwise than as provided by this Agreement. <br /> <br />b. Business Associate’s Agents. Business Associate shall not disclose PHI to any agent or <br />subcontractor except with the prior written consent of Covered Entity. Business Associate shall ensure that <br />any agents, including subcontractors, to whom it provides PHI received from, or created or received by <br />Business Associate on behalf of, Business Associate agree in writing to be bound by the same restrictions <br />and conditions that apply to Business Associate with respect to such PHI including appropriate safeguards. <br />Business Associate shall be fully liable to Covered Entity for any acts, failures or omissions of the Agent in <br />providing the services as if they were the Business Associate’s own acts, failures or omissions, to the extent <br />permitted by law. <br /> <br />c. Reporting. Business Associate shall report to Covered Entity within twenty-four (24) hours any <br />use or disclosure of Covered Entity’s PHI in violation of this Agreement or applicable law of which it <br />becomes aware. <br /> <br />d. Mitigation. Business Associate shall have procedures in place to mitigate, to the maximum extent <br />practicable, any deleterious effect from any use or disclosure of Covered Entity’s PHI in violation of this <br />Agreement or applicable law. <br /> <br />e. Sanctions. Business Associate shall have and apply appropriate sanctions against any employee, <br />subcontractor or agent who uses or discloses Covered Entity’s PHI in violation of the Agreement or <br />applicable law. <br /> <br />f. Covered Entity’s Rights of Access and Inspection. From time to time upon reasonable notice, <br />or upon a reasonable determination by Covered Entity that Business Associate has breached this <br />Agreement, Covered Entity may inspect the facilities, systems, books and records of Business Associate to <br />DocuSign Envelope ID: 2A625151-A0A5-4550-AF52-91CBC3DDBC3C