2021-071-E Health - Everbridge vaccination software

Browse Search

DocuSign Envelope ID: 16086DFC-1613-4024-BF92-DD86916E213E 13. General Uses and Disclosures. Pursuant to the Underlying Agreement, Business Associate provides services("Services")for the Covered Entity that involve the use and disclosure of PHI and/or ePHI. Except as otherwise specified herein, the Business Associate may make any and all uses of PHI and/or ePHI necessary to perform its obligations under the Underlying Agreement,this BAA or as Required By Law, provided that any such use or disclosure would not violate the Privacy and Security Rules if done by Covered Entity. All other uses not authorized by the Underlying Agreement, this BAA or by law are prohibited. 14. Business Activities of the Business Associate. Unless otherwise limited herein, the Business Associate may: (a) use the PHI in its possession within its workforce for its proper management and administration and to fulfill any present or future legal responsibilities of the Business Associate provided that such uses are permitted under state and federal confidentiality laws. (b) disclose the PHI in its possession to third parties for the purpose of its proper management and administration or to fulfill any present or future legal responsibilities of the Business Associate, provided that(i)the disclosures are required by law, as provided for in 45 C.F.R. §164.501, or(ii)the Business Associate has received from the third party satisfactory written assurances regarding its confidential handling of such PHI as required under 45 C.F.R. §164.504(e)(4). 15. Other Activities of Business Associate. In addition to using the PHI to perform the Services set forth in Section 14 above, Business Associate may: (a) Use PHI to provide Data Aggregation Services to Covered Entity as permitted by HIPAA. Under no circumstances may the Business Associate disclose PHI of one covered entity to another covered entity absent the explicit authorization of the Covered Entity or as required by law. (b) de-identify any and all PHI provided that the de-identification conforms to the requirements of 45 C.F.R. §164.514(b), and further provided that the Covered Entity maintains the documentation required by 45 C.F.R. §164.514(b) which may be in the form of a written assurance from the Business Associate. Pursuant to 45 C.F.R. §164.502(d)(2), de- identified information does not constitute PHI and is not subject to the terms of this Business Associate Agreement. 16. Obligations of Covered Entity. Covered Entity shall: (a) Provide Business Associate with the Notice of Privacy Practices that Covered Entity produces in accordance with the Privacy Rule, and any changes or limitations to such notice under 45 C.F.R. 164.520, to the extent that such changes or limitations may affect Business Associate's use or disclosure of PHI. (b) Notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 C.F.R. 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of PHI under this BAA. (c) Notify Business Associate of any changes in or revocation of permission by an individual to use or disclose PHI, if such change or revocation may affect Business Associate's permitted or required uses and disclosures of PHI under this BAA. 17. No Impermissible Request. Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the Privacy and Security Rule if done by Covered Entity, except as provided under Section 14-15 of this BAA. 18. Compliance with Security Rule. Effective April 20, 2005, Business Associate shall comply with the HIPAA Security Rule, which shall mean the Standards for Security of Electronic Protected Health Information at 45 C.F.R. Part 160 and Subparts A and C of Part 164, as amended by ARRA and the HITECH Act. The term "Electronic Health Record" or "EHR" as used in this BAA shall mean an electronic record of health-related information on an individual that is created, gathered, managed and consulted by authorized health care clinicians and staff. 3