Business Associate Agreement Page 5
ADVERTISEMENT
1
2
3
4
5
6
7
83.2
Specific Use and Disclosure Provisions.
(a)
Except as otherwise limited in this BA Contract, Business Associate may use Protected
Health Information for the proper management and administration of Business Associate
or to carry out the legal responsibilities of Business Associate.
(b)
Except as otherwise limited in this BA Contract, Business Associate may disclose
Protected Health Information for the proper management and administration of Business
Associate, provided that disclosures are Required By Law, or Business Associate obtains
reasonable assurances from the person to whom the information is disclosed that it will
remain confidential and used or further disclosed only as Required By Law or for the
purpose for which it was disclosed to the person, and the person notifies Business
Associate of any instances of which it is aware in which the confidentiality of the
information has been breached.
(c)
Except as otherwise limited in this BA Contract, Business Associate may use Protected
Health Information to provide Data Aggregation services to Covered Entity as permitted
by 45 CFR § 164.504(e)(2)(i)(B).
(d)
Business Associate may use Protected Health Information to report violations of law to
appropriate Federal and State authorities, consistent with 45 CFR § 164.502(j)(1).
IV.
Obligations of Covered Entity
4.1
Provisions for Covered Entity to Inform Business Associate of Privacy Practices and Restrictions.
(a)
Covered Entity shall notify Business Associate of any limitation(s) in its notice of privacy
practices of Covered Entity in accordance with 45 CFR § 164.520, to the extent that such
limitation may affect Business Associate's use or disclosure of Protected Health
Information.
(b)
Covered Entity shall notify Business Associate of any changes in, or revocation of,
permission by an Individual to use or disclose Protected Health Information, to the extent
that such changes may affect Business Associate's use or disclosure of Protected Health
Information.
(c)
Covered Entity shall notify Business Associate of any restriction to the use or disclosure
of Protected Health Information that Covered Entity has agreed to in accordance with 45
CFR § 164.522, to the extent that such restriction may affect Business Associate's use or
disclosure of Protected Health Information. Covered Entity shall not agree to any
restrictions without the written consent of Business Associate except with respect to a
restriction where (1) the disclosure is to a health plan for purposes of carrying out
payment or health care operations, and (2) the Protected Health Information pertains
solely to a health care item or service for which the health care provider involved has
been paid in full out of pocket.
4.2
Permissible Requests by Covered Entity.
Covered Entity shall not request Business Associate to use or disclose Protected Health Information in
any manner that would not be permissible under the Privacy Rule if done by Covered Entity, except that
Business Associate may use or disclose Protected Health Information for purposes of data aggregation.
Page 5 of 8
ADVERTISEMENT
0 votes
Related Articles
Related forms
Related Categories
Parent category: Business