Orange County NC Website
Browse       Search
<br />2 <br /> <br />1. Definitions. For purposes of this BAA, the Parties give the following meaning to each of <br />the terms in Section 1 below. Any capitalized term used in this BAA, but not otherwise <br />defined, has the meaning given to that term in the Privacy Rule or pertinent law. <br />A. “Affiliate” means a subsidiary or affiliate of Covered Entity that is, or has been, considered a <br />covered entity, as defined by HIPAA. <br />B. “Breach” means the acquisition, access, use, or disclosure of PHI in a manner not permitted <br />under the Privacy Rule which compromises the security or privacy of the PHI, as defined in <br />45 CFR §164.402. <br />C. “Breach Notification Rule” means the portion of HIPAA set forth in Subpart D of 45 CFR Part <br />164. <br />D. “Data Aggregation” means, with respect to PHI created or received by Business Associate in <br />its capacity as the “business associate” under HIPAA of Covered Entity, the combining of <br />such PHI by Business Associate with the PHI received by Business Associate in its capacity <br />as a business associate of one or more other “covered entity” under HIPAA, to permit data <br />analyses that relate to the Health Care Operations (defined below) of the respective covered <br />entities. The meaning of “data aggregation” in this BAA shall be consistent with the meaning <br />given to that term in the Privacy Rule. <br />E. “Designated Record Set” has the meaning given to such term under the Privacy Rule, <br />including 45 CFR §164.501.B. <br />F. “De-Identify” means to alter the PHI such that the resulting information meets the <br />requirements described in 45 CFR §§164.514(a) and (b). <br />G. “Electronic PHI” means any PHI maintained in or transmitted by electronic media as defined <br />in 45 CFR §160.103. <br />H. “Health Care Operations” has the meaning given to that term in 45 CFR §164.501. <br />I. “HHS” means the U.S. Department of Health and Human Services. <br />J. “HITECH Act” means the Health Information Technology for Economic and Clinical Health <br />Act, enacted as part of the American Recovery and Reinvestment Act of 2009, Public Law <br />111-005. <br />K. “Individual” has the same meaning given to that term i in 45 CFR §§164.501 and 160.130 <br />and includes a person who qualifies as a personal representative in accordance with 45 CFR <br />§164.502(g). <br />L. “Privacy Rule” means that portion of HIPAA set forth in 45 CFR Part 160 and Part 164, <br />Subparts A and E. <br />M. “Protected Health Information” or “PHI” has the meaning given to the term “protected <br />health information” in 45 CFR §§164.501 and 160.103, limited to the information created or <br />received by Business Associate from or on behalf of Covered Entity. <br />N. “Security Incident” means the attempted or successful unauthorized access, use, disclosure, <br />modification, or destruction of information or interference with system operations in an <br />information system. <br />Docusign Envelope ID: 570451FC-66D7-4F0D-A133-FD52C5F42668Docusign Envelope ID: 2F0A6F2B-A88D-43A2-97AA-4CF0CF9C3EE6