Common use of Parts 160 and 164 Clause in Contracts

Parts 160 and 164. In cases where PHI may occasionally need to be disclosed from VA to the Academic Institution, this will only be done with the applicable authority under the Privacy Rule as well as other VA privacy statutes. Shared HPTs or shared faculty members may need to submit PHI directly to the Academic Institution. Both the VA medical center and the Academic Institution agree to: • Utilize de-identified data (whether in electronic or paper format) wherever possible in this relationship, • Protect individually identifiable health information by securely managing the confidentiality, integrity, and availability of PHI, • Implement appropriate administrative, physical, and technical safeguards and controls to protect PHI and document applicable policies and procedures to prevent any Use or Disclosure of PHI other than as allowed under the authority of all applicable VA privacy statutes such as the Privacy Act, 38 U.S.C. § 7332, 38 U.S.C. § 5705, 38 U.S.C. § 5701 and all HIPAA regulations, • Not use or further disclose PHI other than as permitted or required by this agreement or as required by law, • Report to the other party (and to its own HIPAA Privacy Officer) all security incidents involving PHI within 24 hours of discovery. The reports shall be sent by e-mail to the appropriate representative, as identified by each party. With respect to any such possible incidents, each party shall comply with all applicable reporting, individual notification, and mitigation requirements under VA policy.