02/17/2015 (2) - Laserfiche WebLink

Home Browse Search

ARTICLE I DEFINITIONS 1.1 "Minimum Necessary" means the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure, or request or the amount of PHI described and defined by HHS from time to time as the "minimum necessary, " and in any event shall not include any direct identifiers of individuals such as names, street addresses, phone numbers or social security number, except for a unique identifier assigned by Client as necessary for the strategic analysis. 1.2 Other terms. All other terms not specifically defined in this Agreement shall have the meanings attributed to them under HIPAA. ARTICLE II PRIVACY OF PROTECTED HEALTH INFORMATION 2.1 Permitted Uses & Disclosures. (a) Except as otherwise limited by this Agreement, Service Provider may access, use or disclose PHI on behalf of, or to provide the Service Provider Services to Client pursuant to the Service Provider Agreement, if such use or disclosure of PHI would not violate HIPAA or the terms of this Agreement. Service Provider may use PHI for the proper management and administration of Service Provider's business or to provide data aggregation services relating to the health care operations of the Client. (b) Notwithstanding the foregoing, Service Provider shall not disclose PHI unless: (i) required by law; or (ii) Service Provider obtains written assurance from the person to whom the PHI is disclosed that it will be kept confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person agrees to notify Service Provider of any instances of which it is aware in which the confidentiality of the information has been breached as required under 45 C.F.R. 164.504(e)(4). If Service Provider discloses PHI to a subcontractor or agent, Service Provider shall comply with Section 2.3 of this Agreement. 2.2 Safeguards for the Protection of PHI. Gehring Group and Service Provider shall implement and maintain the administrative, physical and technical safeguards required by HIPAA to protect the confidentiality, integrity and availability of electronic PHI and to ensure that PHI disclosed by and between Service Provider and Gehring Group is not used or disclosed by either Party, or by any of its subcontractors, affiliates, or associates, except as provided in this Agreement. 2.3 Reporting of Unauthorized Uses or Disclosures and Unauthorized Attempts to Use or Disclose. (a) Service Provider shall notify Client and Gehring Group in writing, within ten (10) business days, of any use or disclosure of PHI of which Service Provider becomes aware 2 17670672v.2 80