Orange County NC Website
Browse       Search
5 <br />July 2024 <br />by Law or for the purpose for which it was disclosed to the person, and the person notifies <br />Business Associate of any instances of which it is aware in which the confidentiality, <br />integrity, and or availability of the Protected Health Information has been breached <br />immediately upon becoming aware. <br /> <br />(d) Business Associate may provide data aggregation services relating to the health care <br />operations of Covered Entity pursuant to any agreements between the Parties evidencing their business <br />relationship as permitted by 45 CFR 164.504(e)(2)(i)(B). <br /> <br />(e) Other Uses Strictly Limited. Nothing in this Agreement shall permit the Business <br />Associate to share Protected Health Information with Business Associate’s affiliates or contractors except <br />for the purposes of the Service Agreement(s) between the Covered Entity and Business Associate(s) <br />identified in Section I (a) of this Agreement. <br /> <br />(f) Covered Entity Authorization for Additional Uses. Any use of Protected Health <br />Information by Business Associate, its affiliate or Contractor, other than those purposes of t his Agreement, <br />shall require express written authorization by the Covered Entity, and a new Business Associate Agreement <br />or amendment as necessary. Activities which are prohibited include, but are not limited to, Marketing, as <br />defined by 45 CFR 164.503 or the sharing for Commercial Use or any purpose construed by Covered Entity <br />as Marketing or Commercial Use, even if such sharing would be permitted by federal or state laws. <br /> <br />(g) Business Associate may de-identify Protected Health Information only at the specific <br />direction of and only for the use of Covered Entity. Business Associate may not sell Protected Health <br />Information except at the direction of Covered Entity and in compliance with the requirements of the <br />HIPAA Rules. <br /> <br />IV. AVAILABILITY OF PHI <br /> <br /> (a) Access to Protected Health Information. Business Associate agrees, in the event the <br />Business Associate maintains protected health information in a Designated Record Set, to make available, <br />within ten (10) days of a request by Covered Entity in a time and manner designated by Covered Entity, <br />Protected Health Information in a Designated Record Set, to Covered Entity or as directed by Covered <br />Entity, to an individual in order to meet the requirements of 45 CFR 164.524 of the HIPAA Rules. <br /> <br />(b) Amendments to Protected Health Information. In the event that the Business Associate <br />maintains Protected Health Information in a Designated Record Set, Business Associate agrees to make any <br />amendment(s) to Protected Health Information in a designated record set that the Covered Entity directs or <br />agrees to pursuant to the HIPAA Rules at the request of Covered Entity or an individual, within ten (10) <br />days of receipt of a request from Covered Entity and in the time and manner designated by Covered Entity. <br /> <br />(c) Accounting of Disclosures. Business Associate agrees to maintain and make available the <br />information required to provide an accounting of disclosures, as required by 45 CFR 164.528 of the HIPAA <br />Security and Privacy Rule. Business Associate will comply with Covered Entity’s policy regarding <br />accounting of disclosures. <br /> <br />(d) Document Disclosures. In the event an Individual makes a request under this Section of <br />the Agreement directly to Business Associate, Business Associate will notify Covered Entity of such <br />request within three (3) business days and shall cooperate with, and act only at the direction of Covered <br />Entity in responding to such request. <br /> <br />V. OBLIGATIONS OF COVERED ENTITY <br /> <br />Docusign Envelope ID: 1CF66486-1DB7-491A-9655-4FEEFEFF6BEE <br />In Process <br />Docusign Envelope ID: 990FE6D3-EA62-4090-A5F1-B27674BBDED5