Common use of Business Associates Obligations Clause in Contracts

Business Associates Obligations. Both parties agree that Business Associate shall: 1. not use or further disclose the PHI other than as permitted by this Agreement; 2. use administrative, physical and technical safeguards to prevent use or disclosure of PHI and/or EPHI other than as permitted or required by this Agreement; 3. report to Covered Entity any use or disclosure of any PHI and/or EPHI, or a Security Incident of which Business Associate becomes aware that is not permitted by this Agreement; 4. ensure that any subcontractor or agent of Business Associate to whom Business Associate provides any PHI and/or EPHI agrees to the same restrictions and conditions that apply to Business Associate with regard to the use and/or disclosure of PHI pursuant to this section; 5. upon request by Covered Entity, make available to Covered Entity, or as directed by Covered Entity, to the Individual, such PHI contained in a Designated Record Set maintained by Business Associate as necessary to allow Covered Entity to respond to a request for access to PHI as required by HIPAA; 6. incorporate any amendments or corrections to the PHI in its possession that constitutes a Designated Record Set maintained by Business Associate as required by HIPAA; 6. document disclosures of PHI in the same manner as would be required of Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI as required by HIPAA; 7. make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary of U.S. Department of Health and Human Services (“DHHS”) for purposes of determining Covered Entity’s compliance with HIPAA; and 8. except as provided for herein, or as required by law, upon termination of this Agreement and/or the Service Agreement, return to Covered Entity or destroy the PHI and retain no copies in any form, if feasible. If Business Associate determines that returning or destroying the PHI is infeasible, Business Associate agrees to extend the protections, limitations and restrictions of this section to such PHI and to limit any further uses and/or disclosures of such PHI retained to the purposes that make the return or destruction of the PHI infeasible, for as long as Business Associate maintains such PHI.

Business Associates Obligations. Both parties agree that (a) Business Associate shall: 1. agrees not to use or further disclose the PHI Protected Health Information other than as permitted allowed by this Agreement; 2, or as required by law. Additionally, Business Associate agrees to use administrative, physical and technical appropriate safeguards to prevent use or disclosure of PHI and/or EPHI other than as permitted Protected Health Information except for those allowed or required by this Agreement;purposes. 3. (b) Business Associate agrees to report to Covered Entity Client any use or disclosure of any PHI and/or EPHI, or a Security Incident of which Business Associate becomes aware that is the Protected Health Information not permitted by this Agreement;Agreement of which it becomes aware. 4. (c) Business Associate agrees to ensure that any subcontractor or agent of Business Associate agent, including a sube-Psychiatry, to whom Business Associate it provides any PHI and/or EPHI or allows access to Protected Health information agrees to the same restrictions and conditions that apply through this Agreement to Business Associate with regard respect to such information. (d) At the use and/or disclosure reasonable request of PHI pursuant Client, Business Associate agrees to this section; 5. upon request by Covered Entity, make available provide Client access to Covered Entity, or as directed by Covered Entity, to the Individual, such PHI contained Protected Health Information in a Designated Record Set maintained Set, in order that Client may satisfy the individual access requirements of the Privacy Rule located at 45 CFR § 164.524 (e) Business Associate agrees that at the reasonable request of Client it will make available protected health information for amendment and incorporate any amendments to protected health information in accordance with §164.526. (f) Business Associate agrees that upon request, it will make its internal practices, books, and records, including policies and procedures relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate as necessary to allow Covered Entity to respond to a request for access to PHI as required by HIPAA; 6. incorporate any amendments or corrections on behalf of Client, available to the PHI in its possession that constitutes a Designated Record Set maintained by Secretary of the Department of Health and Human Services for purposes of the Secretary determining Client’s compliance with the Privacy Rule. (g) Business Associate as required by HIPAA; 6. agrees to document disclosures of PHI in the same manner Protected Health Information and information related to such disclosures as would be required of Covered Entity for Client to respond to a request by an Individual individual for an accounting account of disclosures of PHI as required by HIPAA; 7Protected Health Information in accordance with 45 CFR § 164.528. make its internal practicesAdditionally, books and records Business Associate agrees to provide the information relating to the use and disclosure such documentation within a reasonable time of PHI available to the Secretary of U.S. Department of Health and Human Services Client’s request for such information. (“DHHS”h) for purposes of determining Covered Entity’s compliance with HIPAA; and 8. except as provided for herein, or as required by law, upon Upon termination of this Agreement and/or the Service Agreement, and so long as it is feasible, Business Associate will immediately return to Covered Entity or destroy all Protected Health Information in its possession. In the PHI and retain no copies in any form, if feasible. If event that Business Associate determines that returning or destroying the PHI Protected Health Information is infeasible, Business Associate agrees shall provide to Client written notification of the conditions that make return or destruction infeasible. In such circumstances, Business Associate shall extend the protections, limitations and restrictions protections of this section the Agreement to such PHI Protected Health Information and to limit any further uses and/or and disclosures of such PHI retained Protected Health Information to the those purposes that make the return or destruction of the PHI infeasible, for as so long as Business Associate maintains such PHIProtected Health Information.

Business Associates Obligations. Both parties agree that 3.1 Business Associate shall: 1. not use or further disclose the PHI other than as permitted by this Agreement; 2. use administrative, physical and technical safeguards to prevent use or disclosure of PHI and/or EPHI other than as permitted or required by this Agreement; 3. report to Covered Entity any use or disclosure of any PHI and/or EPHI, or a Security Incident of which Business Associate becomes aware that is not permitted by this Agreement; 4. ensure shall require that any subcontractor subcontractors that create, receive, maintain or agent transmit protected health information on behalf of Business Associate to whom Business Associate provides any PHI and/or EPHI agrees Associate, agree to the same restrictions and conditions conditions, in writing, that apply to Business Associate through this Agreement with regard respect to such protected health information. 3.2 Business Associate shall implement appropriate safeguards, and shall, where applicable, comply with the HIPAA Security Rule with respect to electronic protected health information, to prevent use and disclosure of protected health information other than as provided in this Agreement. 3.3 Business Associate shall comply with the standards applicable to Covered Entity to the use and/or disclosure extent Business Associate is to carry out any obligation of PHI pursuant Covered Entity under the HIPAA Privacy Rule. 3.4 Business Associate agrees to this section; 5. upon request by Covered Entity, make available to Covered Entity, or as directed by Covered Entitymitigate, to the Individualextent practicable, such PHI contained in any harmful effect of a Designated Record Set maintained use or disclosure of protected health information by Business Associate as necessary in violation of the requirements of this Agreement that becomes known to allow Business Associate. 3.5 Business Associate shall maintain and provide to Covered Entity to respond to a request for access to PHI as required by HIPAA; 6. incorporate any amendments or corrections to the PHI in its possession that constitutes a Designated Record Set maintained by Business Associate as required by HIPAA; 6. document disclosures of PHI in the same manner as would be required of Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI protected health information, if any, consistent with 45 C.F.R. § 164.528, within fifteen (15) business days of receipt of the request. 3.6 Business Associate shall make available to Covered Entity protected health information in a designated record set as required necessary for Covered Entity to fulfill its obligations under 45 CFR § 164.524, within fifteen (15) business days of receipt of the request. 3.7 Business Associate shall incorporate any amendments to Protected Health Information in a designated record set as directed or agreed to by HIPAA;Covered Entity in accordance with 45 CFR § 164.526, within fifteen (15) business days of request. 73.8 If an Individual submits a request for restriction or request for confidential communications as provided for in 45 CFR § 164.522 to Business Associate, then Business Associate shall report such request to Covered Entity within ten (10) business days of receipt. Business Associate shall not respond to such requests without Covered Entity’s express written authorization. 3.9 Business Associate shall make its internal practices, books and records relating to the use and disclosure of PHI protected health information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Secretary of Health and Human Services for the purpose of determining Covered Entity’s compliance with 45 C.F.R. § 164.504. 3.10 Business Associate shall report to Covered Entity any security incident of which Business Associate becomes aware in accordance with 45 CFR § 164.314(a)(2)(i)(C). 3.11 Business Associate shall report to Covered Entity within ten (10) business days after Business Associate becomes aware of any use or disclosure of information not provided for in the Service Agreement(s), including breaches of unsecured protected health information as required by 45 CFR § 164.410. In the event Business Associate discovers a breach of unsecured protected health information, Business Associate shall provide to Covered Entity the following information: (i) names and contact information of all individuals whose protected health information was involved; (ii) any information reasonably requested by Covered Entity that will allow it to perform and document a risk assessment in order to determine whether a breach has occurred; and (iii) information reasonably necessary to allow Covered Entity to provide a notification of breach. 3.12 Business Associate shall request, use and/or disclose only the minimum amount of protected health information necessary to accomplish the purpose of the request, use or disclosure. 3.13 Business Associate shall not directly or indirectly receive remuneration in exchange for any protected health information as prohibited by 45 CFR § 164.502(a)(5)(ii). 3.14 Business Associate shall not make or cause to be made any communication about a product or service that is prohibited by 45 CFR § 164.508(a)(3) and under the definition of marketing as set forth at 45 CFR § 164.501. 3.15 Business Associate shall not make or cause to be made any written fundraising communication that is prohibited by 45 CFR § 164.514(f). 3.16 If Business Associate conducts in whole or part electronic transactions on behalf of Covered Entity for which the U.S. Department of Health and Human Services (“DHHS”) for purposes of determining Covered Entity’s compliance with HIPAA; and 8. except as provided for herein, or as required by law, upon termination of this Agreement and/or the Service Agreement, return to Covered Entity or destroy the PHI and retain no copies in any form, if feasible. If Business Associate determines that returning or destroying the PHI is infeasiblehas established standards, Business Associate agrees to extend the protections, limitations and restrictions will comply with each applicable requirement of this section to such PHI and to limit any further uses and/or disclosures of such PHI retained to the purposes that make the return or destruction of the PHI infeasible, for as long as Business Associate maintains such PHI45 C.F.R. Part 162.