Res 2018-113/approving a contract between the City and the Texas Department of State Health Services, Vital Statistics Unit, for the provision of on-line vital statistic computer services for the City

Home Browse Search

System Agency Contract No.HHSREV 100001023 (D) Contractor will not, without prior written approval of System Agency, disclose or provide access to any Confidential Information on the basis that such act is Required by Law without notifying System Agency so that System Agency may have the opportunity to object to the disclosure or access and seek appropriate relief. If System Agency objects to such disclosure or access, Contractor will refrain from disclosing or providing access to the Confidential Information until System Agency has exhausted all alternatives for relief. 45 CFR 164.504(e)(2)(ii)(A) (E) Contractor will not attempt to re -identify or further identify Confidential Information or De -identified Information, or attempt to contact any Individuals whose records are contained in the Confidential Information, except for an Authorized Purpose, without express written authorization from System Agency or as expressly permitted by the Base Contract. 45 CFR 164.502(d)(2)(i) and (ii) Contractor will not engage in prohibited marketing or sale of Confidential Information. 45 CFR 164.501, 164.508(a)(3) and (4); Texas Health & Safety Code Ch. 181.002 (F) Contractor will not permit, or enter into any agreement with a Subcontractor to, create, receive, maintain, use, disclose, have access to or transmit Confidential Information, on behalf of Contractor without requiring that Subcontractor first execute the Form Subcontractor Agreement, Attachment 1, which ensures that the Subcontractor will comply with the identical terms, conditions, safeguards and restrictions as contained in this DUA for PHI and any other relevant Confidential Information and which permits more strict limitations; and 45 CFR 164.502(e)(1)(1)(ii); 164.504(e)(1)(i) and (2) (G) Contractor is directly responsible for compliance with, and enforcement of, all conditions for creation, maintenance, use, disclosure, transmission and Destruction of Confidential Information and the acts or omissions of Subcontractors as may be reasonably necessary to prevent unauthorized use. 45 CFR 164.504(e) (5); 42 CFR 431.300, et seq. (H) If Contractor maintains PHI in a Designated Record Set, Contractor will make PHI available to System Agency in a Designated Record Set or, as directed by System Agency, provide PHI to the Individual, or Legally Authorized Representative of the Individual who is requesting PHI in compliance with the requirements of the HIPAA Privacy Regulations. Contractor will make other Confidential Information in Contractor's possession available pursuant to the requirements of HIPAA or other applicable law upon a determination of a Breach of Unsecured PHI as defined in HIPAA. 45 CFR 164.524an d 164.504(e) (2) (ii) (E) (I) Contractor will make PHI as required by HIPAA available to System Agency for amendment and incorporate any amendments to this information that System Agency directs or agrees to pursuant to the HIPAA. 45 CFR 164 504(e)(2)(ii)(E) and (F) (J) Contractor will document and make available to System Agency the PHI required to provide access, an accounting of disclosures or amendment in compliance with the requirements of the HIPAA Privacy Regulations. 45 CFR 164.504(e)(2)(ii)(G) and 164.528 (K) If Contractor receives a request for access, amendment or accounting of PHI by any Individual subject to this DUA, it will promptly forward the request to System Agency; however, if it would violate HIPAA to forward the request, Contractor will promptly notify of the request and of Contractor's response. Unless Contractor is prohibited by law from forwarding a request, System Agency will respond to all such requests, unless System Agency has given prior written consent for Contractor to respond to and account for all such requests. 45 CFR 164.504(e)(2) (L) Contractor will provide, and will cause its Subcontractors and agents to provide, to System Agency periodic written certifications of compliance with controls and provisions relating to information privacy, security and breach notification, including without limitation information related to System Agency Data Use Agreement V.8.3 HIPAA Omnibus Compliant April 1, 2015 Page 3 of 11