Common use of Uses and Disclosures of PHI Clause in Contracts

Uses and Disclosures of PHI. 4.1 Business Associate may use and disclose PHI for the purposes of performing the Services, as stated in the Agreement, including all Exhibits, Attachments and Amendments thereto, or for any purpose required by applicable law. 4.2 Business Associate may disclose PHI for the purpose of management and administration of its respective business or to carry out its legal responsibilities; provided (i) that the disclosures are Required by Law or that Business Associate obtains reasonable assurances from the person or entity to which the information is disclosed that the information shall remain confidential and be used or further disclosed only as Required by Law or for the purposes for which it was disclosed to the person or entity, and (ii) that the person or entity to whom the information is disclosed agrees to notify Business Associate within five (5) days of becoming aware of any instance in which the confidentiality of the information has been breached. 4.3 As permitted by 45 C.F.R. § 164.504(e)(2)(i)(B), Business Associate is permitted to perform data aggregation services relating to the health care operations of Covered Entities, including but not limited to combining Data from OHA Participating Facilities with Data of other Covered Entities to create a combined multistate database of aggregate data. Covered Entity understands and agrees that OHA will subcontract with HIDI, which may in turn subcontract such data aggregation services to a third party, including any related company of HIDI or the Missouri Hospital Association. 4.4 Business Associate may use PHI for public health activities or research purposes on behalf of Participating Facilities, consistent with the provisions of 45 C.F.R. § 164.512(b) and 45 C.F.R. § 164.512(i). 4.5 Business Associate may use PHI to assist the Covered Entity and other Participating Facilities in carrying out treatment, payment or health care operations consistent with the authorization requirements of 45 C.F.R. § 164.508 and/or 45 C.F.R. § 164.510. 4.6 Business Associate may use or disclose PHI in the form of Limited Data Sets for the purposes of research, public health or health care operations as permitted by and in compliance with 45 C.F.R. 164.514(e). 4.7 Business Associate may use or disclose data that has been de-identified in accordance with 45 C.F.R. § 164.514(a) and (b). 4.8 Business Associate may use or disclose PHI in its possession as directed in writing by the Covered Entity 4.9 Business Associate may use or disclose PHI pursuant to collaborative initiatives entered into by and between Business Associate and such other parties. Business Associate and the Covered Entity understand and acknowledge that additional written agreements may be required under HIPAA or other laws to participate in such initiatives or arrangements. 4.10 Business Associate may disclose the minimum necessary PHI to a subcontractor engaged to perform or assist in the performance of any of Business Associates’ obligations to Covered Entity.