03-09-26-R - Laserfiche WebLink

Home Browse Search

29 4. Except as otherwise limited in this Business Associate Agreement, Business Associate may use Protected Health Information to provide Data Aggregation services to Covered Entity as permitted by 45 C.F.R. Section 164.504(e)(2)(i)(B). 5. Except as otherwise limited in this Business Associate Agreement, Business Associate may use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent with 45 C.F.R. Section 164.502(j)(1). 6. Business Associate will limit the use, disclosure, or request of Protected Health Information, to the extent practicable, (i) to the Limited Data Set, or (ii) if needed by Business Associate, to the minimum necessary (as determined by Business Associate) to accomplish the intended purpose of such use, disclosure, or request, except to the extent a broader use, disclosure, or request of Protected Health Information is allowed by the Privacy Rule. Business Associate’s ability to satisfy the requirement of this Paragraph III.B.6 by use of the Limited Data Set shall be available until the effective date of subsequent guidance issued by the Secretary regarding what constitutes “minimum necessary,” at which time Business Associate will take reasonable efforts to limit the use, disclosure, or request of Protected Health Information to the minimum necessary (as defined by such Secretary’s guidance) to accomplish the intended purpose of such use, disclosure, or request, except to the extent a broader use, disclosure, or request of Protected Health Information is allowed by the Privacy Rule. 7. Except as otherwise authorized by the Privacy Rule, Business Associate shall not directly or indirectly receive remuneration (whether financial or nonfinancial) in exchange for any Protected Health Information of a Covered Individual unless Covered Entity has received a valid authorization from the Covered Individual that includes a specification of whether the Protected Health Information can be further exchanged for remuneration by the entity receiving Protected Health Information of that Covered Individual. This Paragraph III.B.7 shall apply to exchanges of Protected Health Information occurring on or after the compliance date applicable under the final regulations issued under HITECH that address this restriction. 8. Except as otherwise allowed by the Privacy Rule, Business Associate may not use or disclose Protected Health Information regarding a Covered Individual with respect to a communication about a product or service that encourages recipients of the communication to purchase or use the product or service unless Covered Entity receives no direct or indirect payment in exchange for making such communication and the communication is made to the Covered Individual: (i) to describe a health-related product or service (or payment for such product or service) that is provided by, or included in,