Common use of Permissible Uses and Disclosures Clause in Contracts

Permissible Uses and Disclosures. Applicant shall not use or further disclose the limited data set specified in this agreement except as permitted by this agreement or as required by federal or Florida law. Applicant shall establish appropriate administrative, technical, and physical safeguards compliant with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended, and associated federal regulations and Florida law to protect the confidentiality of and to prevent unauthorized use or access to the limited data set. Applicant shall not release or allow the release of the limited data set specified in this agreement to any persons or entities other than as permitted by the agreement. Applicant shall record and maintain a list of all individuals and entities that are permitted to use or receive the limited data set per Section 5 of the agreement and the list must be updated when changes occur. Applicant shall restrict disclosure of the limited data set to the minimum number of individuals listed in Section 5 of the agreement who require the information in order to perform the functions of this agreement. Applicant shall instruct individuals to which the limited data set is disclosed of all obligations under this agreement and shall require the individuals to maintain those obligations. Applicant shall secure the limited data set when the data is not under the direct and immediate control of an authorized individual performing the functions of this agreement. The Applicant must conduct all activities in compliance with 45 CFR 164 Subpart C to ensure data security, including, but not limited to encryption of all information that is confidential under Florida or federal law, while in transmission and while resident on portable electronic media storage devices. Encryption shall be consistent with Federal Information Processing Standards (FIPS), and/or the National Institute of Standards and Technology (NIST) publications regarding cryptographic standards. Applicant shall not attempt to identify the information or use the limited data set to track or link an individual’s data to any other data source, and any profiles or descriptions of individuals that the Applicant constructs from the limited data set shall not be further released or published without the express written consent of the Agency. Applicant shall not attempt to use the limited data set to determine real or likely identities, gain information about an individual, or contact an individual. Applicant shall make a good faith effort to identify any use or disclosure of the limited data set not provided for by this agreement. Applicant shall notify the Agency by certified mail, return receipt requested, or in person with proof of delivery within seventy-two (72) hours of discovery of any use or disclosure of the limited data set not provided for by this agreement of which Applicant is aware. Applicant shall not sell, transfer, or trade any of the limited data sets unless specifically authorized by the Agency. A violation of this section shall constitute a material breach of this agreement.

Permissible Uses and Disclosures. Applicant shall not use or further disclose the limited data set specified in this agreement except as permitted by this agreement or as required by federal or Florida law. Applicant shall establish appropriate administrative, technical, and physical safeguards compliant with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended, and associated federal regulations and Florida law to protect the confidentiality of and to prevent unauthorized use or access to the limited data set. Applicant shall not release or allow the release of the limited data set specified in this agreement to any persons or entities other than as permitted by the agreement. Applicant shall record and maintain a list of all individuals and entities that are permitted to use or receive the limited data set per Section 5 of the agreement and the list must be updated when changes occur. Applicant shall restrict disclosure of the limited data set to the minimum number of individuals listed in Section 5 of the agreement who require the information in order to perform the functions of this agreement. Applicant shall instruct individuals to which the limited data set is disclosed of all obligations under this agreement and shall require the individuals to maintain those obligations. Applicant shall secure the limited data set when the data is not under the direct and immediate control of an authorized individual performing the functions of this agreement. The Applicant must conduct all activities in compliance with 45 CFR 164 Subpart C to ensure data security, including, but not limited to encryption of all information that is confidential under Florida or federal law, while in transmission and while resident on portable electronic media storage devices. Encryption shall be consistent with Federal Information Processing Standards (FIPS), and/or the National Institute of Standards and Technology (NIST) publications regarding cryptographic standards. Applicant shall not attempt to identify the information or use the limited data set to track or link an individual’s data to any other data source, and any profiles or descriptions of individuals that the Applicant constructs from the limited data set shall not be further released or published without the express written consent of the Agency. Applicant shall not attempt to use the limited data set to determine real or likely identities, gain information about an individual, or contact an individual. Applicant shall make a good faith effort to identify any use or disclosure of the limited data set not provided for by this agreement. Applicant shall notify the Agency by certified mail, return receipt requested, or in person with proof of delivery within seventy-two (72) hours of discovery of any use or disclosure of the limited data set not provided for by this agreement of which Applicant is aware. Applicant shall not sell, transfer, or trade any of the limited data sets unless specifically authorized by the Agency. A violation of this section shall constitute a material breach of this agreement.