Res 2016-001/ (“WIC”) Program Contract with Texas Department of State Health Services

Home Browse Search

WIS Contract No. 20M-048775-001 (C) CONTRACTOR will establish, implement and maintain appropriate sanctions against any member of its Workforce or Subcontractor who fails to comply with this DUA, the Base Contract or applicable law. CONTRACTOR will maintain evidence of sanctions and produce it to HHS upon request.45 C.F.R. 164.308(a)(1)(ii)(C); 164.530(e); 164.410(b); 164.530(b)(1) (D) CONTRACTOR will not, without prior written approval of HHS, disclose or provide access to any Confidential Information on the basis that such act is Required by Law without notifying HHS so that HHS may have the opportunity to object to the disclosure or access and seek appropriate relief. If HHS objects to such disclosure or access, CONTRACTOR will refrain from disclosing or providing access to the Confidential Information until HHS has exhausted all alternatives for relief. 45 CFR 164.504(e)(2)(ii)(A) (E) CONTRACTOR will not attempt to re- identify or further identify Confidential Information or De- identified Information, or attempt to contact any Individuals whose records are contained in the Confidential Information, except for an Authorized Purpose, without express written authorization from HHS or as expressly permitted by the Base Contract. 45 CFR 164.502(d)(2)(i) and (ii) CONTRACTOR will not engage in prohibited marketing or sale of Confidential Information. 45 CFR 164.501, 164.508(a)(3) and (4); Texas Health & Safety Code Ch. 18L002 (F) CONTRACTOR will not permit, or enter into any agreement with a Subcontractor to, create, receive, maintain, use, disclose, have access to or transmit Confidential Information, on behalf of CONTRACTOR without requiring that Subcontractor first execute the Form Subcontractor Agreement, Attachment 1, which ensures that the Subcontractor will comply with the identical terms, conditions, safeguards and restrictions as contained in this DUA for PHI and any other relevant Confidential Information and which permits more strict limitations; and 45 CFR 164.502(e)(1)(1)(ii); 164.504(e)(1)(i) and (2) (G) CONTRACTOR is directly responsible for compliance with, and enforcement of, all conditions for creation, maintenance, use, disclosure, transmission and Destruction of Confidential Information and the acts or omissions of Subcontractors as may be reasonably necessary to prevent unauthorized use. 45 CFR 164.504(e)(5); 42 CFR 431.300, et seq. (H) If CONTRACTOR maintains PHI in a Designated Record Set, CONTRACTOR will make PHI available to HHS in a Designated Record Set or, as directed by HHS, provide PHI to the Individual, or Legally Authorized Representative of the Individual who is requesting PHI in compliance with the requirements of the HIPAA Privacy Regulations. CONTRACTOR will make other Confidential Information in CONTRACTOR's possession available pursuant to the requirements of HIPAA or other applicable law upon a determination of a Breach of Unsecured PHI as defined in HIPAA. 45 CFR 164.524and 164.504(e)(2)(ii)(E) (1) CONTRACTOR will make PHI as required by HIPAA available to HHS for amendment and incorporate any amendments to this information that HHS directs or agrees to pursuant to the HIPAA. 45 CFR 164.504(e)(2)(ii)(E) and (F) (J) CONTRACTOR will document and make available to HHS the PHI required to provide access, an accounting of disclosures or amendment in compliance with the requirements of the HIPAA Private Regulations. 45 CFR 164.504(e)(2)(ii)(G) and 164.528 (K) If CONTRACTOR receives a request for access, amendment or accounting of PHI by any Individual subject to this DUA, it will promptly forward the request to HHS; however, if it would violate HIPAA to forward the request, CONTRACTOR will promptly notify HHS of the request and of CONTRACTOR's response. Unless CONTRACTOR is prohibited by law from forwarding a request, HHS will respond to all such requests, unless HHS has given prior written consent for CONTRACTOR to respond to and account for all such requests. 45 CFR 164.504(e)(2) HHS Data Use Agreement V.8.3 HIPAA Omnibus Compliant April 1, 2015 Page 3 of 11