2023/11/29 Council Agenda Packet

3 M. Required By Law. “Required By Law” has the same meaning as the term required by law in 45 CFR § 164.501. N. Secretary. “Secretary” means the Secretary of the Department of Health and Human Services or his or her designee. O. Security Incident. “Security Incident” will have the same meaning as the term Security Incident in 45 CFR § 164.304. P. Unsecured PHI. “Unsecured PHI” will mean PHI that is not rendered unusable, unreadable, or undecipherable to unauthorized Individuals through the use of a technology or methodology specified by the Secretary. SECTION 2 CONFIDENTIALITY AND HIPAA The Parties will comply with all applicable federal and state laws governing the confidentiality and privacy of health information including, without limitation, the HIPAA Rules, and Confidential Personal Information. A. Purposes for which PHI May Be Disclosed to Business Associate. In connection with the services provided by Business Associate to or on behalf of Covered Entity described in this Agreement and the service agreement, Covered Entity may disclose PHI to Business Associate in connection to any products and/or services rendered by Peak1 Administration LLC. B. Obligations of Business Associate. Business Associate represents warrants and covenants that: (1) Use and Disclosure of Protected Health Information. a) Business Associate, its directors, officers, subcontractors, employees, affiliates, agents, and representatives (collectively, “Representatives”): (i) will limit the use, transmission or disclosure of PHI and Confidential Personal Information to the minimum necessary consistent with the Covered Entity’s policies and procedures to perform its duties and obligations under this Agreement and the agreement for services between the Covered Entity and the Business Associate (“Service Agreement”). The phrase “minimum necessary” will be interpreted in accordance with the Health Information Technology for Economic and Clinical Health Act (“HITECH”), HIPAA Rules and government guidance on the definition (i.e., that only PHI that is the minimum necessary to accomplish the intended purpose of the use, disclosure, or request is used or disclosed; and, the use of limited data sets when possible); (ii) will not use or disclose PHI other than as permitted or required by this Agreement, the Service Agreement, or as Required by Law; and (iii) will not use or disclose PHI in any manner that violates applicable laws or would violate such laws if used or disclosed in such manner by the Covered Entity.