First CHoice Agreement - Laserfiche WebLink

Home Browse Search

1.8 "Protected Health Information" or "PHI" shall have the same meaning as the term "protected health information" in 45 C.F.R. § 160.103, limited to the information created, received, maintained, or transmitted by BA from or on behalf of CE pursuant to this Agreement. 1.9 "Required by Law" shall have the same meaning found in 45 C.F.R. § 164.103. 1.10 "Secretary" shall mean the Secretary of the Department of Health and Human Services or his or her designee. 1.11 "Unsecured PHI" shall have the same meaning as the term "unsecured protected health information" in 45 C.F.R. § 164.402. 1.12 "Use" or "Uses" shall mean, with respect to Protected Health Information, the sharing, employment, application, utilization, examination, or analysis of such information within BA's internal operations. 2. Authorized Uses and Disclosures by Business Associate. 2.1 General Use and Disclosure Except as otherwise limited in this Agreement, BA may Use or Disclose PHI on behalf of CE as necessary to provide services as set forth in the Services Agreement, if such Use or Disclosure of PHI would not violate the Privacy Rule if done by CE. 2.2 Business Activities of Business Associate 2.2.1 Unless otherwise limited herein, BA may Use PHI: (a) As necessary for the proper management and administration of BA or to carry out the legal responsibilities of BA; (b) To provide Data Aggregation services as permitted by 42 CFR § 164.504(e)(2)(i)(B); (c) To De -identify any and all PHI created, received, maintained, or transmitted by BA on behalf of CE provided that the De -identification conforms to the requirements of the HIPAA Rules. Such resulting De -identified information is not PHI and is not subject to the terms of this Agreement; and (d) As Required by Law. 2.2.2 Unless otherwise limited herein, BA may Disclose PHI for the proper management and administration of BA or to carry out the legal responsibilities of BA provided that: (a) The Disclosure is Required by Law; or (b) BA obtains reasonable assurances from the person to whom the PHI is Disclosed that it will be held confidentially and Used or further Disclosed only as Required by Law or for the purposes for which it was Disclosed to the person, and the person notifies BA of any instances of which it is aware in which the confidentiality of the PHI has been breached. 3. Business Associate Obligations. 3.1 Use of PHI BA shall not Use or further Disclose PHI other than as permitted or required by the Services Agreement, this Agreement, or as Required by Law. In Using, Disclosing, or requesting PHI from CE, BA agrees to limit PHI to the minimum necessary to accomplish the intended purpose of such Use, Disclosure, or request. "Minimum necessary" shall be interpreted in accordance with the HITECH Act and the HIPAA Rules, and implementing regulation or guidance on the definition. 3.2 Appropriate Safeguards; Compliance with Security Rule FCHN-PRO-042016 18