2.1 not use and/or further disclose PHI except as necessary to provide the Services, as permitted or required by this Exhibit, and in compliance with each applicable requirement of 45 C.F.R. § 164.504(e), or as otherwise Required by Law; provided that, to the extent Vendor is to carry out a Covered Entity’s obligations under the Privacy Rule, Vendor will comply with the requirements of the Privacy Rule that apply to that Covered Entity in the performance of those obligations.
2.2 implement and use appropriate administrative, physical and technical safeguards and, as of the Compliance Date, comply with applicable Security Rule requirements with respect to ePHI, to prevent use or disclosure of PHI other than as provided for by this Exhibit, including at a minimum, but in any event not limited to, any safeguards set forth in the Agreement or other applicable contracts or agreements between the parties. For the avoidance of doubt, the requirements set forth in the Agreement or other applicable contracts or agreements between the parties do not limit in any way whatsoever Vendor’s obligations under this Section 2.2 to comply with applicable Security Rule requirements.
2.3 without unreasonable delay, and in any event on or before forty-eight (48) hours after its discovery by Vendor, report to Customer in writing: (i) any use or disclosure of PHI not provided for by this Exhibit of which it becomes aware in accordance with 45 C.F.R. § 164.504(e)(2)(ii)(C); and/or (ii) any Security Incident of which Vendor becomes aware in accordance with 45 C.F.R. § 164.314(a)(2)(i)(C).
2.4 without unreasonable delay, and in any event on or before forty-eight (48) hours after its Discovery by Vendor, notify Customer of any incident that involves an unauthorized acquisition, access, use or disclosure of PHI, even if Vendor believes the incident will not rise to the level of a Breach. The notification shall include, to the extent possible, and shall be supplemented on an ongoing basis with: (i) the identification of all individuals whose Unsecured PHI was or is believed to have been involved; (ii) all other information required for or requested by Customer (or the applicable Covered Entity) to perform a risk assessment in accordance with 45 C.F.R. § 164.402 with respect to the incident to determine whether a Breach of Unsecured PHI occurred; and (iii) all other information reasonably necessary to provide notice to the applicable Covered Entities individuals, HHS and/or the media, all in accordance with the Breach Rule. Notwithstanding the foregoing, in Customer’s sole discretion and in accordance with its directions, and without limiting in any way any other remedy available to Customer at law, equity or contract, including but not limited to any rights or remedies the Customer may have under the Agreement, Vendor (i) shall conduct, or pay the costs of conducting, an investigation of any incident required to be reported under this Section 2.4, (ii) shall reimburse and pay Customer for all expenses and costs incurred by Customer that arise from an investigation of any incident required to be reported under this Section 2.4 and (iii) shall provide, and/or pay the costs of providing, the required notices as set forth in this Section 2.4.
2.5 in accordance with 45 C.F.R. § 164.502(e)(1)(ii) and 45 C.F.R. § 164.308(b)(2), ensure that any subcontractors of Vendor that create, receive, maintain or transmit PHI on behalf of Vendor agree, in writing, to the same or materially similar restrictions and conditions on the use and/or disclosure of PHI that apply to Vendor with respect to that PHI, including complying with the applicable Security Rule requirements with respect to ePHI; provided that, in any event Vendor shall require its subcontractors (and shall require those subcontractors to require their subcontractors) to report to Vendor any use or disclosure of PHI or Security Incident required to be reported under Sections 2.3 and 2.4 five (5) days after its discovery by any of those subcontractors.
2.6 make available its internal practices, books and records relating to the use and disclosure of PHI to the Secretary for purposes of determining the applicable Covered Entity’s compliance with the Privacy Rule.
2.7 document, and within thirty (30) days after receiving a written request from Customer, make available to Customer information necessary for Customer or its applicable Covered Entity customer to make an accounting of disclosures of PHI about an Individual or, when and as requested by Customer, make that information available directly to an Individual, all in accordance with 45 C.F.R. § 164.528 and, as of the later of the date compliance is required by final regulations or the effective date of the Agreement, 42 U.S.C. § 17935(c).
2.8 provide access to Customer, within fifteen (15) days after receiving a written request from Customer, to PHI in a Designated Record Set about an Individual, or when and as requested by Customer, provide that access directly to an Individual, all in accordance with the requirements of 45 C.F.R. § 164.524, including as of the Compliance Date, providing or sending a copy to a designated third party and providing or sending a copy in electronic format in accordance with 45 C.F.R. § 164.524.
2.9 to the extent that the PHI in Vendor’s possession constitutes a Designated Record Set, make available, within thirty (30) days after a written request by Customer, PHI for amendment and incorporate any amendments to the PHI as requested by Customer, all in accordance with 45 C.F.R. § 164.526.
2.10 accommodate reasonable requests for confidential communications in accordance with 45 C.F.R. § 164.522(b), as requested by Customer or as directed by the Individual to whom the PHI relates.
2.11 notify Customer in writing within three (3) days after Vendor’s receipt directly from an Individual of any request for an accounting of disclosures, access to or amendment of PHI or for confidential communications as contemplated in Sections 2.7-2.10.
2.12 request, use and/or disclose only the minimum amount of PHI necessary to accomplish the purpose of the request, use or disclosure; provided, that Vendor shall comply with 45 C.F.R. §§ 164.502(b) and 164.514(d) as of the Compliance Date.
2.13 not directly or indirectly receive remuneration in exchange for any PHI as prohibited by 45 C.F.R. § 164.502(a)(5)(ii) as of the Compliance Date.
2.14 not make or cause to be made any communication about a product or service that is prohibited by 45 C.F.R. §§ 164.501 and 164.508(a)(3) as of the Compliance Date.
2.15 not make or cause to be made any written fundraising communication that is prohibited by 45 C.F.R. § 164.514(f) as of the Compliance Date.
2.16 mitigate, to the extent practicable, any harmful effect that is known to Vendor of a use or disclosure of PHI by Vendor that is not permitted by the requirements of this Exhibit.
2.17 comply with all applicable federal, state and local laws and regulations.
2.18 not use, transfer, transmit or otherwise send or make available, any PHI outside of the geographic confines of the United States of America without Customer’s advance written consent.
2.19 Government Program Requirements. To the extent that Vendor receives, uses or discloses PHI pertaining to Individuals enrolled in managed care plans through which Customer or one or more of its affiliates participate in government funded health care programs, receipt, use and disclosure of the PHI pertaining to those individuals shall comply with the applicable program requirements.
2.20 Privacy and Safeguards for NPI. Vendor understands and acknowledges that to the extent it is a nonaffiliated third party under GLBA that creates or receives NPI from or on behalf of Customer or an Affiliate, Vendor and its authorized representatives: (i) shall not use or disclose NPI for any purpose other than to perform its obligations under the Agreement; (ii) shall implement appropriate administrative, technical, and physical safeguards designed to ensure the security and confidentiality of the NPI, protect against any anticipated threats or hazards to the security or integrity of the NPI and protect against unauthorized access to or use of the NPI that could result in substantial harm or inconvenience to any consumer; and (iii) shall, for as long as Vendor has NPI, provide and maintain appropriate safeguards for the NPI in compliance with this Exhibit and the GLBA.
2.21 Substance Use Disorder Information. Some of the PHI provided to Vendor by a Customer or an Affiliate may be substance use disorder information subject to the confidentiality requirements set forth in 42 C.F.R. Part 2 (“Part 2 Records”). Customer or an Affiliate hereby report, and Vendors hereby acknowledges, that: (i) Customer or an Affiliate may act as a lawful holder of PHI that includes Part 2 Records; (ii) Customer or an Affiliate may disclose Part 2 Records to Vendors for payment and/or health care operations activities; (iii) upon receipt of Part 2 Records, the Vendors are fully bound by the requirements of 42 C.F.R. Part 2 if applicable; (iv) 42 C.F.R. Part 2 prohibits unauthorized disclosure of Part 2 Records; and (v) this notice satisfies the requirements of 42 C.F.R. § 2.32 with respect to the Part 2 Records until such time as further guidance from the Secretary indicates otherwise. To the extent Vendor receives Part 2 Records from Customer or an Affiliate, the following more restrictive terms also apply:
a. Vendor shall not re-disclose Part 2 Records to a third party unless the third party is an agent or a contractor of the Vendor who: (i) has agreed to be fully bound by 42 C.F.R. Part 2 upon receipt of Part 2 Records; (ii) is helping the Vendor to carry out the requirements described in this Restated Agreement (iii) has received notice that 42 C.F.R. Part 2 prohibits unauthorized disclosure of Part 2 Records; and (iv) has agreed to only further disclose the Part 2 Records: (a) to its subcontractors who have agreed to be fully bound by 42 C.F.R. Part 2 upon receipt of Part 2 Records; and (b) back to the Vendor or the Customer or an Affiliate from which the Part 2 Records originated.
