Business Associate Agreement (Page 4 of 8) in pdf

(ii)

Except as otherwise limited in this Agreement, Business Associate may use PHI

to provide Data Aggregation services to Covered Entity as permitted by 45 CFR

§164.504(e)(2)(i)(B).

(iii)

Business Associate may use PHI to report violations of law to appropriate Federal

and State authorities, consistent with 45 CFR §164.502(j)(1).

IV.

OBLIGATIONS OF THE COVERED ENTITY

a. To Inform Business Associate. Covered Entity will inform Business Associate of its privacy

practices and any agreed restrictions on PHI as follows:

(i)

Covered Entity shall advise Business Associate of any limitations in the notice of

privacy practices that Covered Entity produces in accordance with 45 CFR

§164.520, to the extent that such limitation may affect Business Associate's use or

disclosure of PHI.

(ii)

Covered Entity shall notify Business Associate of any changes in, or revocation

of, permission by an Individual to use or disclose PHI, to the extent that such

changes affect Business Associate's use or disclosure of PHI.

(iii)

Covered Entity shall notify Business Associate of any restrictions on use or

disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR

§164.522, to the extent that such restrictions may affect Business Associate's use

or disclosure of PHI.

Permissible Requests by Covered Entity. Covered Entity shall not request Business

Associate to use or disclose PHI in any manner that would violate the Privacy Rule if

done by Covered Entity, except that Business Associate may in its discretion use or

disclose PHI for Data Aggregation and/or management and administrative activities of

Business Associate.

COMPLIANCE WITH HIPAA SECURITY REGULATIONS

Business Associate shall:

(i)

Implement administrative, physical, and technical safeguards that reasonably and

appropriately protect the confidentiality, integrity, and availability of the

electronic PHI it creates, receives, maintains or transmits on behalf of Covered

Entity as required to comply with HIPAA Security Regulations at 45 CFR Parts

160, 162 and 164.

(ii)

Ensure that any agents, including but not limited to contractors and

subcontractors, to which Business Associate provides PHI pertaining to Covered

Entity, agree to implement reasonable and appropriate safeguards to protect it.

4. BUSINESS ASSOC AGRMT IDICTATE AND QUICKTATE

Business Associate Agreement Page 4