2020/12/16 Council Agenda Packet

Julota° Julota® SaaS Agreement (i) If Business Associate is required to make a disclosure of information because of a legal requirement, it will track such a disclosure and will provide information to Covered Entity that would be necessary for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR 164.528. (j) Business Associate agrees that it will use or disclose only the minimal amount of PHI necessary to accomplish the intended purpose. (k) Business Associate agrees to alert Covered Entity of any Security Incident of which it becomes aware. (I) To the extent Business Associate is to carry out one of Covered Entity's obligations under the Privacy Rule, Business Associate agrees to comply with the requirements of the HIPAA Rules that apply to Covered Entity in the performance of such obligation. Permitted Uses and Disclosures by Business Associate. (a) Except as otherwise limited in this Agreement, Business Associate may use or disclose PHI to perform functions, activities or services for or on behalf of, Covered Entity as requested by Covered Entity provided that such use or disclosure would not violate the HIPAA Rules if done by Covered Entity. (b) Except as otherwise limited in this Agreement, Business Associate may disclose PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate, provided that disclosures are required by law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached (c) Except as otherwise limited in this Agreement Business Associate may use PHI to provide data aggregation services to Covered Entity as permitted by 45 CFR 164.504(e)(2)(i)(B). (d) Business Associate may use PHI to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR 164.502(j)(1). OBLIGATIONS OF COVERED ENTITY (a) Covered Entity shall notify Business Associate of any limitation(s) in its Notice of Privacy Practices to the extent that such limitation may affect Business Associate's use or disclosure of PHI. (b) Covered Entity shall provide Business Associate with any changes in, or revocation of, permission by Individual to use or disclose PHI if such changes affect Business Associate's permitted or required uses and disclosures. (c) Covered Entity shall notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of PHI. (a) Covered Entity shall notify Business Associate of any limitation(s) in its Notice of Privacy Practices to the extent that such limitation may affect Business Associate's use or disclosure of PHI. (b) Covered Entity shall provide Business Associate with any changes in, or revocation of, permission by Individual to use or disclose PHI, if such changes affect Business Associate's permitted or required uses and disclosures. (c) Covered Entity shall notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR 164.522, to the extent that such restriction may affect Business Associate s use or disclosure of PHI. page 15 of 16