ALLIANT - Laserfiche WebLink

Business Associate Agreement Page 3 of 7 defined in guidance issued by the DHHS) unless: (i) Business Associate has entered into an agreement with such tracking technology vendor in accordance with this Section; and (ii) such disclosure is permitted or required under the Privacy Rule and this Agreement. (G) Reproductive Health Information. Business Associate shall comply with all requirements imposed on business associates under the HIPAA Privacy Rule to Support Reproductive Health Care Privacy promulgated by DHHS, including, but not limited to, the attestation requirement under 45 C.F.R. § 164.509. (H) Substance Use Disorder Information. The parties acknowledge and agree that records subject to 42 C.F.R. Part 2 ("Part 2") may be used and disclosed only as permitted under Part 2. (I) Within fifteen (15) days following Covered Entity’s request, make available to Covered Entity any PHI in Business Associate’s control as necessary to enable Covered Entity to satisfy its obligations to provide an Individual with access to PHI under 45 CFR § 164.524. (J) Within fifteen (15) days following Covered Entity’s request, make available to Covered Entity any PHI for amendment and incorporate any amendments to PHI as necessary to enable Covered Entity to satisfy its obligations under 45 CFR § 164.526. (K) Maintain information concerning Business Associate’s or subcontractors’ disclosures of PHI as required by 45 CFR § 164.528(a)-(b) and, within fifteen (15) days following Covered Entity’s request, make such information available to Covered Entity as necessary to enable Covered Entity to render an accounting of disclosures pursuant to 45 CFR § 164.528. (L) To the extent Business Associate is to carry out Covered Entity’s obligations under 45 CFR Part 164, Subpart E, comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligations. (M) Make Business Associate’s internal practices, books, and records relating to the use and disclosure of Protected Heath Information received from, or created or received by, Business Associate on behalf of Covered Entity, available to the Secretary for purposes of determining Covered Entity’s compliance with the HIPAA Rules. IV. Uses and Disclosures by Business Associate. (A) Permissible Uses and Disclosures. Business Associate may use or disclose PHI only as follows: (1) As necessary to perform the services set forth in the Service Agreement. (2) To de-identify PHI in accordance with 45 CFR § 164.514(a)-(c). (3) As required by law. (4) For the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided that any disclosures for these purposes (a) are required by law, or (b)(i) Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and (b)(ii) the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached. (5) To provide data aggregation services relating to the health care operations of Covered Entity as defined in 45 CFR § 164.501. Docusign Envelope ID: 59F6B981-5F1A-449B-900F-594D12FCBB6B