2015_1130_CCpacket - Laserfiche WebLink

Home

2. PERMITTED USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION 2.1. Performance of Services. Except as otherwise expressly permitted in this BAA, Business Associate may create, maintain, Use, transmit, and Disclose PHI only to the extent necessary to perform Services for or on behalf of Covered Entity. Except for the Uses and Disclosures in Section 2.2 and 2.3, Business Associate may not Use or Disclose PHI in a manner that would violate the Privacy Regulation if done by the Covered Entity. 2.2. Other Permitted Uses and Disclosures. In addition to the Uses and Disclosures permitted by section 2.1, unless otherwise limited by this BAA, the Business Associate may Use and Disclose PHI as follows, but only if the Use or Disclosure is permitted under applicable law: 2.2.1. Use for management of Business Associate's business and to meet legal responsibilities. Business Associate may Use PHI for the proper management and administration of the Business Associate's business, or to fulfill the Business Associate's present or future legal responsibilities. 2.2.2. Disclosure for management of Business Associate's business and to meet legal responsibilities. Business Associate may Disclose PHI for the proper management and administration of the Business Associate's business, ar to fulfill the Business Associate's present or future legal responsibilities, but only if (a) the Disclosure is Required by Law, or (b) Business Associate 1. obtains reasonable assurances from the person to whom the PHI is disclosed that the PHI will remain confidential and used or further disclosed only as Required by Law or for the purposes for which it was disclosed to the person, and 2. the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the PHI has been breached. 2.3. Data aggregation. At Covered Entity's request or with Covered Entity's consent, Business Associate may aggregate the PHI in its possession with the protected health information of other covered entities that Business Associate has in its possession through its capacity as a business associate to those other covered entities, but only if the purpose of the aggregation is to provide Covered Entity with data analyses relating to the Covered Entity's Health Care Operations. 2.4. Subcontractors. If Business Associate delegates one or more of its functions or activities under the Underlying Agreement to a Subcontractor, Business Associate may Disclose PHI to the Subcontractor, and Subcontractor may create, receive, maintain, transmit, Use or Disclose PHI on behalf of Business Associate, but only as follows: 2.4.1. Content of Subcontractor BAA. Business Associate and Subcontractor must have a written business associate agreement that complies with 45 C.F.R. § 164.504(e), and with 45 C.F.R. § 164.314(a) as applicable. In addition, the business associate agreement: 1032762-6 16