2018/03/28 Council Agenda Packet

4 and services to the County, provided that such use or disclosure would not violate the HIPAA privacy regulations if done by the County. B. Specific Use and Disclosure Provisions. 1. Except as otherwise limited in this Agreement, the Agency may use PHI for the proper management and administration of any Contract or to carry out the legal responsibilities of the Agency. 2. Except as otherwise limited in this Agreement, the Agency may disclose PHI: a. For the proper management and administration of the Agency, provided , that disclosures are required by law; or b. Agency obtains reasonable assurances from the person to whom the information is disclosed that it will: i. Remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person; and ii. The person notifies the Agency of any instances of which it is aware in which the confidentiality of the information has been breached. 3. Except as otherwise limited in this Agreement, the Agency may use PHI to provide data aggregation services to the County as permitted by 42 CFR § 164.504(e)(2)(i)(B), if applicable. 4. The Agency may use PHI to report violations of law to appropriate federal and state authorities, consistent with 45 CFR § 164.5020)(1). V. OBLIGATION OF COUNTY The County shall notify the Agency of any known future restrictions or limitations on the use of PHI that would affect Agency's performance of services under the Agreement, and Agency shall thereafter restrict or limit its uses and disclosures accordingly. VI. TERMINATION FOR CAUSE A. In addition to and notwithstanding the termination provisions in any Contract, upon the County's discovery of a material breach by Agency of the provisions of this Agreement, the County may: Business Associate Agreement BAA-2018-101-198 City of Everett Page 5 of 13 61