Business Associate Agreement

Business Associate Agreement. The Business Associate agrees to: (a) not use or disclose Protected Health Information (PHI) other than as permitted or required by this Agreement or as required by law; (b) use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this Agreement; (c) report to the Covered Entity any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, including any breach of unsecured PHI as required by 45 CFR 164.410; (d) in accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree in writing to the same restrictions, conditions, and requirements that apply to the Business Associate under this Agreement; (e) make available PHI as necessary to satisfy the Covered Entity's obligations to provide individuals with access to their PHI pursuant to 45 CFR 164.524; (f) make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the Department of Health and Human Services for purposes of determining the Covered Entity's compliance with the HIPAA Rules.