Laserfiche WebLink
purpose for which the PHI is needed. <br />"Protected Health Information (PHI)" means individually identifiable health <br />information created, received, maintained or transmitted by Business Associate on <br />behalf of a health care component of the Covered Entity that relates to the provision <br />of health care to an Individual; the past, present, or future physical or mental health <br />or condition of an Individual; or the past, present, or future payment for provision of <br />health care to an Individual. 45 CFR 160.103. PHI includes demographic <br />information that identifies the Individual or about which there is reasonable basis to <br />believe can be used to identify the Individual. 45 CFR 160.103. PHI is information <br />transmitted or held in any form or medium and includes EPHI. 45 CFR 160.103. <br />PHI does not include education records covered by the Family Educational Rights <br />and Privacy Act, as amended, 20 USCA 1232g(a)(4)(B)(iv) or employment records <br />held by a Covered Entity in its role as employer. <br />"Security Incident" means the attempted or successful unauthorized access, use, <br />disclosure, modification or destruction of information or interference with system <br />operations in an information system. <br />m. "Subcontractor" as used in this HIPAA Compliance section of the Contract (in <br />addition to its definition in the General Terms and Conditions) means a Business <br />Associate that creates, receives, maintains, or transmits Protected Health <br />Information on behalf of another Business Associate. <br />n. "Use" includes the sharing, employment, application, utilization, examination, or <br />analysis, of PHI within an entity that maintains such information. <br />3. Compliance. Business Associate shall perform all Contract duties, activities and tasks <br />in compliance with HIPAA, the HIPAA Rules, and all attendant regulations as <br />promulgated by the U.S. Department of Health and Human Services, Office of Civil <br />Rights. <br />4. Use and Disclosure of PHI. Business Associate is limited to the following permitted <br />and required uses or disclosures of PHI: <br />a. Duty to Protect PHI. Business Associate shall protect PHI from, and shall use <br />appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 (Security <br />Standards for the Protection of Electronic Protected Health Information) with respect <br />to EPHI, to prevent the unauthorized Use or disclosure of PHI other than as provided <br />for in this Contract or as required by law, for as long as the PHI is within its <br />possession and control, even after the termination or expiration of this Contract. <br />b. Minimum Necessary Standard. Business Associate shall apply the HIPAA Minimum <br />Necessary standard to any Use or disclosure of PHI necessary to achieve the <br />purposes of this Contract. See 45 CFR 164.514 (d)(2) through (d)(5). <br />c. Disclosure as Part of the Provision of Services. Business Associate shall only Use <br />or disclose PHI as necessary to perform the services specified in this Contract or as <br />Professional Services Agreement <br />Page 23 <br />