2025/04/09 Council Agenda Packet

11 (b) Privacy of Protected Health Information (“PHI”). (i) Permitted Uses and Disclosures of PHI. Business Associate agrees to create, receive, use, disclose, maintain, or transmit PHI only in a manner that is consistent with this BAA or the HIPAA Requirements and only in connection with providing the services to Covered Entity identified in the Agreement. Accordingly, in providing services to or for the Covered Entity, Business Associate, for example, shall be permitted to use and disclose PHI for “Treatment, Payment, and Health Care Operations,” as those terms are defined in the HIPAA Requirements. Business Associate further agrees that to the extent it is carrying out one or more of the Covered Entity’s obligations under the Privacy Rule (Subpart E of 45 C.F.R. Part 164), it shall comply with the requirements of the Privacy Rule that apply to the Covered Entity in the performance of such obligations. (ii) Reporting Obligations. Business Associate shall report to Covered Entity any use or disclosure of PHI that is not provided for in this BAA, including reporting Breaches of Unsecured Protected Health Information as required by 45 C.F.R. § 164.410 and required by this Business Associate Agreement. (iii) Minimum Necessary Standard and Creation of Limited Data Set. Business Associate’s use, disclosure, or request of PHI shall utilize a Limited Data Set if practicable. Otherwise, in performing the functions and activities as specified in the Agreement and this BAA, Business Associate agrees to use, disclose, or request only the minimum necessary PHI to accomplish the intended purpose of the use, disclosure, or request. (iv) Access. In accordance with 45 C.F.R. § 164.524 of the HIPAA Requirements, Business Associate shall make available to the Covered Entity (or as directed by the Covered Entity, to those individuals who are the subject of the PHI (or their designees)), their PHI in the Designated Record Set. Business Associate shall make such information available in an electronic format where directed by the Covered Entity. (v) Disclosure Accounting. Business Associate shall make available the information necessary to provide an accounting of disclosures of PHI as provided for in 45 C.F.R. § 164.528 of the HIPAA Requirements by making such information available to the Covered Entity or (at the direction of the Covered Entity) making such information available directly to the individual. (vi) Amendment. Business Associate shall make PHI in a Designated Record Set available for amendment and, as directed by the Covered Entity, incorporate any amendment to PHI in accordance with 45 C.F.R. § 164.526 of the HIPAA Requirements.