ALLIANT - Laserfiche WebLink

Business Associate Agreement Page 4 of 7 (B) Impermissible Uses or Disclosures. Business Associate may not use or disclose PHI in a manner that would violate 45 CFR Part 164, Subpart E, if done by Covered Entity except for the specific uses and disclosures set forth in Sections IV(A)(1)-(5), if applicable. (C) Minimum Necessary. Business Associate agrees to use or disclose the minimum amount of PHI necessary for a permitted purpose pursuant to this Section IV, Covered Entity’s policies and procedures, and 45 CFR § 164.502(b). V. Obligations and Duties of Covered Entity. (A) Notice of Privacy Practices. Covered Entity shall notify Business Associate of any limitation(s) in its notice of privacy practices in accordance with 45 C.F.R. § 164.520, to the extent that such limitation(s), if any, may affect Business Associate's use or disclosure of PHI. Covered Entity may satisfy this requirement by providing Business Associate with the notice of privacy practices that it delivers in accordance with 45 C.F.R. § 164.520, as well as any changes to such notice. (B) Notice of Individual Permission. Covered Entity shall notify Business Associate of any changes in, or revocation of, permission by Individual to use or disclose PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI. (C) Notice of Other Restrictions. Covered Entity shall notify Business Associate of any restriction to the use or disclosure of PHI to which Covered Entity has agreed in accordance with 45 C.F.R. § 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of PHI. (D) Impermissible Requests. Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Privacy Rule if done by Covered Entity. VI. Term and Termination. Unless otherwise agreed in writing by the Parties, this Agreement shall be effective as of the date executed by the Parties and shall continue until terminated as provided below. (A) Termination. This Agreement shall terminate on the date the Covered Services Agreement or BOR, as applicable, is terminated for any reason. In addition, this Agreement may be terminated earlier as follows: (1) Covered Entity may terminate this Agreement without cause upon sixty (60) days’ prior written notice to Business Associate. (2) Covered Entity may terminate this Agreement upon thirty (30) days’ prior notice if Covered Entity determines that Business Associate or any subcontractor has violated the HIPAA Rules, a material term of this Agreement, or otherwise engaged in conduct that may compromise the PHI. Subject to Section VI(A)(3), Business Associate shall have the opportunity to cure the breach or violation within the 30-day notice period. If Business Associate fails to cure the breach or violation within the 30-day notice period, Covered Entity may immediately terminate this Agreement. (3) Notwithstanding Section VI(A)(2), Covered Entity may terminate this Agreement immediately if Business Associate or any subcontractor engages in any conduct that Covered Entity reasonably believes may result in adverse action against Covered Entity by any governmental agency or third party. (B) Termination of Services Agreement. Notwithstanding anything in the Covered Services Agreement to the contrary, Covered Entity shall have the right to terminate the Covered Services Agreement immediately if Business Associate’s creation, maintenance, use, transmission or disclosure of PHI is a material purpose of the Covered Service Agreement and this Agreement is terminated for any reason. Docusign Envelope ID: 59F6B981-5F1A-449B-900F-594D12FCBB6B