Laserfiche WebLink
not violate (1) the Privacy and Security Rules if done by Covered Entity or (2) Covered Entity's policies <br />and procedures which limit disclosures to the minimum necessary. <br />b. Additional Use and Disclosure Provisions. <br />(1) Except as otherwise limited in this Agreement, Business Associate may use <br />Protected Health Information for the proper management and administration of the Business Associate or <br />to carryout the legal responsibilities of the Business Associate. <br />(2) Except as otherwise limited in this Agreement, Business Associate may disclose <br />Protected Health Information for the proper management and administration of the Business Associate, <br />provided that disclosures are required by law or Business Associate obtains reasonable assurances from <br />the person to whom the information is disclosed that it will remain confidential and used or further <br />disclosed only as required by law or for the purpose for which it was disclosed to the person, and the <br />person notifies the Business Associate of any instances of which it is aware in which the confidentiality of <br />the information has been breached. <br />(3) Except as otherwise limited in this Agreement, Business Associate may use <br />Protected Health Information to provide data aggregation services to Covered Entity as permitted by <br />45 C.F.R. § 164.504(e)(2)(1)(B). <br />(4) Business Associate may use Protected Health Information to report violations of <br />law to appropriate Federal and State authorities, consistent with § 164.5020)(1). <br />5. Obligations of Covered Entity. 4 <br />a. Notice of Privacy Practices. Covered Entity shall notify Business Associate of any <br />limitation(s) in Covered Entity's notice of privacy practices in accordance with 45 C.F.R. § 164.520, to the <br />extent that such limitation may affect Business Associate's use or disclosure of Protected Health <br />Information. <br />b. Changes to Authorization. Covered Entity shall notify Business Associate of any <br />changes in, or revocation of, permission by an individual to use or disclose Protected Health Information, <br />to the extent that such changes may affect Business Associate's use or disclosure of Protected Health <br />Information. <br />C. Restrictions on Consent. Covered Entity shall notify Business Associate of any <br />restriction to the use or disclosure of Protected Health Information to which Covered Entity has agreed in <br />accordance with 45 C.F.R. § 164.522, to the extent that such restriction may affect Business Associate's <br />use or disclosure of Protected Health Information. <br />d. Requests in Violation of Privacy Rule. Covered Entity shall not request Business <br />Associate to use or disclose Protected Health Information in any manner that would not be permissible <br />under the Privacy and Security Rules if done by Covered Entity. <br />6. Term and Termination. <br />a. Term. The term of this Agreement as it relates to the use and disclosure of Protected <br />Health Information shall be effective as of the Effective Date identified below and shall terminate when all <br />of the Protected Health Information provided by Covered Entity to Business Associate, or created, <br />maintained, or received by Business Associate on behalf of Covered Entity, is destroyed or returned to <br />Covered Entity or, if it is not feasible to return or destroy Protected Health Information, protections are <br />extended to such information, in accordance with the termination provisions in this Section. <br />BUSINESS ASSOCIATE AGREEMENT - 3 <br />55555.0713.5940675.1 <br />