Vera Whole Health 6/7/2019 - Laserfiche WebLink

III. OBLIGATIONS OF COVERED ENTITY 3.1 Covered Entity shall, upon request, provide Business Associate with its current notice of privacy practices("Privacy Notice")adopted in accordance with the Privacy Regulations. Covered Entity shall be responsible for maintaining and disseminating its Privacy Notice as required by the 45 CFR 164.520. The Covered Entity shall be responsible for modifying the Privacy Notice in the event that the Covered Entity or the Business Associate materially changes its privacy policies, procedures or practices that affect the Privacy Notice. The party necessitating the change to the Privacy Notice shall bear any reasonable costs associated with revising and distributing the Privacy Notice. The Covered Entity and the Business Associate will not institute such material change before the effective date of the Covered Entity's revised Privacy Notice. 3.2 Covered Entity shall not agree to any Requests regarding revocations, amendments or restrictions in the use or disclosure of PHI if such changes affect Business Associate's permitted or required uses and disclosure of PHI hereunder until Covered Entity discusses the Request with Business Associate as outlined in Section 2.7. 3.3 Covered Entity and Business Associate will make reasonable efforts to request from each other only the minimum amount of PHI necessary for its needed purpose. In addition, the Covered Entity and Business Associate will make reasonable efforts to only disclose to each other the minimum amount of PHI necessary for Business Associate to perform the services agreed to between the parties and other functions and activities referenced in this Agreement. Finally, Business Associate will make reasonable efforts to use, disclose, or request only the minimum amount of PHI necessary from any third party to perform the services agreed upon between the parties and other functions and activities referenced in this Agreement. IV. ADDITIONAL PERMITTED USES 4.1 Except as otherwise limited in this Agreement or the Services Agreement, Business Associate may use Protected Health Information for the following additional purposes: (a) Use of Information for Management,Administration and Legal Responsibilities. Business Associate may Use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate as required by law. (b) Disclosure of Information for Management,Administration and Legal Responsibilities. Business Associate may Disclose PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate, as required by law, provided that the disclosures are handled in accordance with Section 2.1 above. Schedule 4, Page 4