Benefit Plans Administrative Services 12/26/2018

18IPage Associate on behalf of, Covered Entity available to the Secretary for purposes of the Secretary determining Covered Entity's compliance with HIPAA. Disclosure Documentation. Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR Section 164.528. Business Associate agrees to provide to Covered Entity or an Individual information collected in accordance with this subsection to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR Section 164.528. j. Training. Business Associate agrees to train its employees who handle Covered Entity's Protected Health Information about the Business Associate's obligations and permitted uses and disclosures under this Agreement. k. Compliance with the HITECH Act. To the extent not already referenced in this Agreement, the requirements applicable to Business Associate under the HITECH Act are hereby incorporated by reference into the Agreement. Business Associate agrees to comply, as of the applicable effective dates of each such HIPAA obligation under the HITECH Act applicable to Business Associate, with the requirements imposed by the HITECH Act, including any applicable guidance issued by the Department of Health and Human Services relating to the HITECH Act and HIPAA. Delegated Obligations. To the extent Business Associate is to carry out one or more of Covered Entity's obligations under Subpart E of 45 CFR Part 164, Business Associate agrees to comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligations. 3. PERMITTED USES BY BUSINESS ASSOCIATE. a. Service Agreement. Except as otherwise limited in this Agreement, Business Associate may use or disclose Protected Health Information to perform functions, activities, or services for, or on behalf of, Covered Entity as specified in the Service Agreement, provided that such use or disclosure would not violate the Privacy Rule if done by Covered Entity or the minimum necessary policies and procedures of the Covered Entity. b. Other Permitted Usage. Except as otherwise limited in this Agreement, Business Associate may use Protected Health Information for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. In addition, Business Associate may use Protected Health Information to provide Data Aggregation services as permitted by 45 CFR Section 164.504(e)(2)(i)(B). 4. OBLIGATIONS OF COVERED ENTITY. a. Change in Privacy Practices. Covered Entity shall notify Business Associate of any limitation(s) in its notice of privacy practices of Covered Entity in accordance with 45 CFR Section 164.520, to the extent that such limitation may affect Business Associate's use or disclosure of Protected Health Information. Additionally, Covered Entity shall notify Business Associate of any limitation(s) or restriction(s) in its security practices to the extent that such limitation may affect Business Associate's use or disclosure of Protected Health Information. VEBA Administrative Service Agreement (405512)