2023/11/29 Council Agenda Packet

7 C. Obligations of Covered Entity. (1) Use and Disclosure of Protected Health Information. Covered Entity, its employees, affiliates, agents, and representatives: (a) Will comply with the HIPAA Rules in its use or disclosure of PHI; (b) Will not use or disclose PHI in any manner that violates applicable federal and state laws; (c) Will not request Business Associate to use or disclose PHI in any manner that violates applicable federal and state laws if such use or disclosure were done by Covered Entity; (d) May request Business Associate to disclose PHI directly to another party only for the purposes allowed by the HIPAA Rules; (e) Will provide Business Associate with any changes in or revocation of permission by Individual to use or disclose PHI if these changes affect Business Associate’s permitted or required uses and disclosures; (f) Will notify Business Associate of any restrictions to the use or disclosure of PHI that Covered Entity has agreed to consistent with 45 CFR § 164.522; and (g) Will comply with the requirements of HITECH. SECTION 3 DISCLOSURE TO THIRD PARTIES A. Subcontractors and Agents. Business Associate will obtain and maintain a written agreement with each Representative that has or will receive, create, maintain, transmit or have access to PHI, on behalf of Business Associate, under which such Representative agrees to the same restrictions, requirements, and conditions that apply to Business Associate pursuant to this Agreement and applicable law. Business Associate will also: (1) obtain reasonable assurances from the person to whom the PHI and Confidential Personal Information is disclosed that it will be held confidentially and used or further disclosed only to the minimum amount necessary consistent with applicable state and federal law, as Required By Law, or for the authorized purpose for which it was disclosed, and (2) obligate such person to promptly notify Business Associate of any instances of which it becomes aware in which the confidentiality of the PHI has been breached. Business Associate will ensure that any Representative of Business Associate agrees to implement reasonable and appropriate safeguards to protect the confidentiality, integrity, and availability of the paper or electronic PHI and Confidential Personal Information that it creates, receives, maintains, or transmits on behalf of the Covered Entity. Business Associate will be liable to Covered Entity for any acts, failures or omissions of any of its Representatives in providing the services as if they were Business Associate’s own acts, failures or omissions, to the extent permitted by law. Business Associate will specifically advise its Representatives of, and require that its Representatives comply in all respects with the terms of this Agreement.