Benefit Plans Administrative Services 12/26/2018

16IPaue f. "Health Care Operations" shall have the same meaning as the term "Health Care Operations" in 45 CFR Section 164.501. g. "HITECH ACT" shall mean the provisions of Title XIII, Subtitle D of the American Recovery and Reinvestment Act of 2009. Any reference to the HITECH Act shall also include any related regulations issued by the Department of Health and Human Services. h. "Individual" shall have the same meaning as the term "individual" in 45 CFR Section 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR Section 164.502(g). "Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health Information that is codified at 45 CFR Parts 160 and 164, subparts A and E. j. "Protected Health Information" or"PHI" shall mean any information, whether oral or recorded in any form or medium: (i)that relates to the past, present or future physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and (ii)that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual, and shall have the meaning given to such term under 45 CFR Section 160.103. Protected Health Information shall be limited to the information created or received by Business Associate from or on behalf of Client. k. "Required By Law" shall have the same meaning as the term "required by law" in 45 CFR Section 164.103. "Secretary" shall mean the Secretary of the Department of Health and Human Services or his or her designee. m. "Security Rule" shall mean the Security Standards for the Protection of Electronic Protected Health Information under HIPAA that is codified at 45 CFR Parts 160 and 164, subparts A and C. n. "Unsecured PHI" shall mean Protected Health Information that is not secured through the use of a technology or methodology that renders such Protected Health Information unusable, unreadable or indecipherable to unauthorized individuals, as specified in guidance issued pursuant to Section 13402(h) of the HITECH Act, including the Breach Notification Rule. 2. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE. a. Permitted Uses and Disclosures. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By Law. Business Associate recognizes that the Protected Health Information is and shall remain the Covered Entity's property except as set forth in the Service Agreement. Business Associate agrees that it acquires no title or rights to the Protected Health Information as a result of this Agreement. To the extent required by the Privacy Rule, Business Associate shall only request, use and/or disclose the minimum amount of Protected Health Information necessary to accomplish the purpose of the request, use and/or disclosure. The determination of what constitutes the minimum necessary amount of Protected Health Information shall be determined in accordance VEBA Administrative Service Agreement (405512)