Res 2016-077/approving an administrative services agreement with United Healthcare Services, Inc. for the provision of medical, pharmacy, dental, flexible spending accounts (fsa), retiree, online enrollment tool and cobra benefits administration in a tot

Home Browse Search

2.8 after receiving a written request from Covered Entity or an Individual, provide access to PHI in a Designated Record Set about an Individual, in accordance with the requirements of 45 C.F.R. 164.524. 2.9 after receiving a written request from Covered Entity or an Individual, make PHI in a Designated Record Set about an Individual available for amendment and incorporate any amendments to the PHI, all in accordance with 45 C.F.R. 164.526. 3. RESPONSIBILITIES OF COVERED ENTITY In addition to any other obligations set forth in the Agreement, including in this BAA, Covered Entity: 3.1 shall provide to Business Associate only the minimum PHI necessary to accomplish the Services. 3.2 shall notify Business Associate of any limitations in the notice of privacy practices of Covered Entity under 45 C.F.R. 164.520, to the extent that such limitation may affect Business Associate's use or disclosure of PHI. 3.3 shall notify Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI. 3.4 shall notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 C.F.R. 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of PHI. 3.5 In the event Covered Entity takes action as described in this Section, Business Associate shall decide which restrictions or limitations it will administer only to the extent discretion is permitted in implementing restrictions or limitations pursuant to HIPAA or applicable regulations. In addition, if those limitations or revisions materially increase Business Associate's cost of providing Services under the Agreement, including this BAA, Covered Entity shall reimburse Business Associate for such increase in cost only if the limitation or revision is discretionary and not required by HIPAA or applicable regulations and only after providing written notice to Covered Entity. 4. PERMITTED USES AND DISCLOSURES OF PHI Unless otherwise limited in this BAA, in addition to any other uses and/or disclosures permitted or required by this BAA or the Agreement, Business Associate may: 4.1 make any and all uses and disclosures of PHI necessary to provide the Services to Covered Entity. 4.2 use and disclose PHI, if necessary, for proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided that the disclosures are Required by Law or any third party to which Business Associate discloses PHI for those purposes provides written assurances in advance that (i) the information will be held confidentially and used or further disclosed only for the purpose for which it was disclosed to the third party or as Required by Law, and (ii) the third party promptly will notify Business Associate of any instances of which it becomes aware in which the confidentiality of the information has been breached. 4.3 de- identify PHI received or created by Business Associate under this BAA in accordance with the Privacy Rule. 4.4 provide Data Aggregation services relating to the Health Care Operations of the Covered Entity in accordance with the Privacy Rule. 4.5 use and disclose PHI and data as permitted in 45 C.F.R 164.512 in accordance with the Privacy Rule. 4.6 use PHI to create, use and disclose a Limited Data Set in accordance with the Privacy Rule. 5. TERMINATION 5.1 Term. The Term of this BAA shall coincide with the Term of the Agreement. This BAA shall be terminated if the Agreement is terminated pursuant to the provisions of the Agreement or pursuant to section 5.2 of this BAA. 44