2021/06/30 Council Agenda Packet

Entity determines it needs to include in notifications to the individual(s) under 45 C.F.R. §164.404(c). 3.12.2. After receipt of notice, from any source, of a Breach involving Unsecured Protected Health Information used, disclosed, maintained, accessed or otherwise possessed by Business Associate, or of a Breach involving Unsecured Protected Health Information for which the Business Associate is otherwise responsible, Covered Entity may in its sole discretion (i) require Business Associate, at Business Associate's sole expense, to use a mutually agreed upon written notice to notify, on Covered Entity's behalf, the individual(s) affected by the Breach, in accordance with the notification requirements set forth in 45 C.F.R. § 164.404, without unreasonable delay, but in no case later than sixty (60) days after discovery of the Breach; or (ii) elect to provide notice to the individual(s) affected by the Breach. 3.13. Remuneration in Exchange for PHI. Business Associate shall not directly or indirectly receive remuneration in exchange for any PHI unless Covered Entity notifies Business Associate that it obtained a valid authorization from the Individual specifying that the Individual's PHI may be exchanged for remuneration by the entity receiving such Individual's PHI. 3.14. Marketing. Business Associate must obtain or confirm that Covered Entity has obtained an authorization for any use or disclosure of PHI for marketing, as defined in 45 C.F.R. § 164.501. 3.15. Exporting Information. Business Associate shall ensure that any agent or subcontractor to whom Business Associate provides PHI, as well as Business Associate, not export PHI beyond the borders of the United States of America. 4. Obligations of Covered Entity. 4.1. Limited Disclosure Obligations. Covered Entity will limit the PHI provided to Business Associate to only that necessary to the business needs of Covered Entity. Prior to the transmission of PHI to Business Associate, Covered Entity will notify Business Associate of the need to transmit PHI and will arrange with Business Associate for the proper and secure transmission of such PHI. 4.2. Requested Restrictions. Covered Entity shall notify Business Associate, in writing, of any restriction on the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 C.F.R. § 164.522, which permits an Individual to request certain restrictions or uses and disclosures, to the extent that such restriction may affect Business Associate's use or disclosure of PHI. 4.3. Changes in or Revocation of Permission. Covered Entity will notify Business Associate in writing of any changes in, or revocation of, permission by an Individual to use or disclose PHI, to the extent that such changes or revocation may affect Business Associate's use or disclosure of PHI. 4.4. Permissible Requests by Covered Entity. Covered Entity shall not request Business Associate use or disclose PHI in any manner that would not be permissible under the HIPAA Privacy Regulations and the HIPAA Security Regulations if done by Covered Entity, except to the Page 5 of 9