2.1 Permitted Uses and Disclosures of Protected Health Information.

2.1.1 Uses and Disclosures on Behalf of Covered Entity. The Business Associate shall be permitted to use and disclose Protected Health Information, and Electronic Protected Health Information (collectively, “Protected Health Information”) for services Business Associate is providing to Covered Entity pursuant to the Services Arrangement, which may include but not be limited to Treatment, Payment activities and/or Health Care Operations, and as otherwise required to perform its obligations under this Agreement and the Services Arrangement.

2.1.2 Other Permitted Uses and Disclosures. In addition to the uses and disclosures set forth in Section 2.1.1, Business Associate may use or disclose Protected Health Information received from, or created or received on behalf of, Covered Entity under the following circumstances:

2.1.2.1 Use of Protected Health Information for Management, Administration, and Legal Responsibilities. Business Associate is permitted to use Protected Health Information if necessary for the proper management and administration of Business Associate or to carry out its legal responsibilities.

2.1.2.2 Disclosure of Protected Health Information for Management, Administration, and Legal Responsibilities. Business Associate is permitted to disclose Protected Health Information if necessary for the proper management and administration of Business Associate, or to carry out its legal responsibilities, provided that the disclosure is required by law, or Business Associate obtains reasonable assurances from the person to whom the Protected Health Information is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, the person will use appropriate safeguards to prevent use or disclosure of the information, and the person will notify Business Associate immediately of any instance of which it is aware in which the confidentiality of the Protected Health Information has been breached.

2.1.2.3 Data Aggregation Services. Business Associate is also permitted to use or disclose Protected Health Information to provide data aggregation services, as that term is defined by 45 CFR 164.504, relating to the health care operations of Covered Entity.

2.1.2.4 Commercial Purposes. Business Associate is only permitted to receive direct or indirect remuneration for any exchange of PHI not otherwise authorized under HITECH without individual authorization, if (i) specifically required for the provision of services under the underlying Services Arrangement; (ii) for treatment purposes; (iii) providing the individual with a copy of the individual’s Protected Health Information; or (iv) otherwise determined by the Secretary in regulations.

2.1.3 Further Uses Prohibited. Except as provided in Sections 2.1.1 and Section 2.1.2, Business Associate is prohibited from further using or disclosing any information received from Covered Entity, or from any other Business Associate of Covered Entity, for any commercial purposes of Business Associate, including, for example, “data mining.” Business Associate shall not engage in any sale (as defined in HIPAA Rules) of Protected Health Information.

2.2 Minimum Necessary. Business Associate shall only request, use, and disclose the minimum amount of Protected Health Information necessary to accomplish the purposes of the request, use, or disclosure. Business Associate and Covered Entity acknowledge that the phrase “minimum necessary” shall be interpreted in accordance with HITECH and the HIPAA Rules. 2.3 Prohibited, Unlawful, or Unauthorized Use and Disclosure of Protected Health Information. Business Associate shall not use or further disclose any Protected Health Information received from, or created or received on behalf of, Covered Entity, in a manner that would violate the requirements of the Privacy Rule if done by Covered Entity. 2.4 Required Privacy Safeguards. Business Associate will develop, implement, maintain, and use appropriate safeguards to prevent use or disclosure of Protected Health Information received from, or created or received on behalf of, Covered Entity or other than as provided for in this Agreement or as required by law, including adopting policies and procedures regarding the safeguarding of Protected Health Information; and providing training to relevant employees, independent contractors, and subcontractors on such policies and procedures to prevent the improper use or disclosure of Protected Health Information. To the extent Business Associate will carry out one or more of Covered Entity’s obligations under the Privacy Rule, the Business Associate will comply with the requirements of the Privacy Rules that apply to the Covered Entity in the performance of such obligations. Business Associate further agrees that it shall not use, transfer, process, or disclose Protected Health Information outside the United States of America. 2.5 Mitigation of Improper Uses or Disclosures. Business Associate shall mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. 2.6 Reporting of Unauthorized Uses and Disclosures. Business Associate shall promptly report in writing to Covered Entity any use or disclosure of Protected Health Information not provided for under this Agreement, of which Business Associate becomes aware, but in no event later than ten (10) business days of first learning of any such use or disclosure. Business Associate agrees that if any of its employees, agents, subcontractors or representatives use or disclose Protected Health Information received from, or created or received on behalf of, Covered Entity, or any derivative De-identified Information in a manner not provided for in this Agreement, Business Associate shall ensure that such employees, agents, subcontractors and representatives shall receive training on Business Associate’s procedures for compliance with the HIPAA Rules, or shall be sanctioned or prevented from accessing any Protected Health Information Business Associate receives from, or creates or receives on behalf of, Covered Entity. Continued use of Protected Health Information in a manner contrary to the terms of this Agreement shall constitute a material breach of this Agreement. 2.7 Security Rule.

2.7.1 Security Safeguards. Business Associate agrees to implement administrative, physical, and technical safeguards set forth in the Security Rule that reasonably and appropriately protect the confidentiality, integrity, and availability of the Electronic Protected Health Information that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity.

2.7.2 Security Incidents. Business Associate agrees to report to Covered Entity any unauthorized access, use, disclosure, modification, or destruction of information or interference with information system operations which affect Electronic Protected Health Information created, received, maintained, or transmitted on behalf of Covered Entity of which Business Associate becomes aware. Business Associate agrees to also report to Covered Entity any attempted unauthorized access affecting Electronic Protected Health Information created, received, maintained, or transmitted on behalf of Covered Entity of which Business Associate becomes aware; provided that Business Associate determines that the attempted access was material and credible.

2.8 Breach Incident Notifications. Business Associate agrees to notify the applicable Covered Entity of any disclosure of Unsecured Protected Health Information that may constitute a Breach (a “Breach Incident”) within 15 days from the date of discovery.

2.8.1 Information About Breach Incident. Business Associate shall provide a report to Covered Entity within 15 days of discovery of a Breach Incident except when despite all reasonable efforts by Business Associate to obtain the information required, circumstances beyond the control of the Business Associate necessitate additional time. Under such circumstances Business Associate shall provide to Covered Entity the required information as soon as possible and without unreasonable delay, but in no event later than 30 calendar days from the date of discovery of a Breach Incident. A Breach Incident will be treated as discovered in accordance with 45 CFR §164.410. The Business Associate’s report shall include: (i) the date of the Breach Incident; (ii) the date of discovery of the Breach Incident; (iii) a list of each individual whose Unsecured Protected Health Information has been or is reasonably believed to have been used, accessed, acquired, or disclosed during the Breach Incident; (iv) a description of the type of Unsecured Protected Health Information involved; (v) the identity of who made the non-permitted use or disclosure and who received the non-permitted disclosure (if known); and (vi) any other details necessary to complete an assessment of the risk of harm to the affected individual.

2.8.2 Notification to Individual and Others. Unless otherwise agreed between Covered Entity and Business Associate, if Covered Entity determines that the disclosure of Unsecured Protected Health Information constitutes a Breach, Covered Entity shall be responsible to provide notification to individuals whose Unsecured Protected Health Information has been disclosed, as well as the Secretary of Health and Human Services and the media, as required by 45 CFR 164 Subpart D.

2.8.3 Investigation and New Procedures. Business Associate agrees to investigate the Breach Incident and to establish procedures to mitigate losses and protect against future Breach Incidents, and to provide a description of these procedures and the specific findings of the investigation to Covered Entity in the time and manner reasonably requested by Covered Entity.

2.9 Individual Requests. Covered Entity and Business Associate acknowledge that Individuals have certain rights under the Privacy Rule to access, amend and receive an accounting of certain disclosures of their Protected Health Information. A request by an Individual or such Individual’s personal representative made in accordance with such policies and procedures to access, amend or receive an accounting of disclosures of the Individual’s Protected Health Information is referred to herein as a “Formal HIPAA Request.”

2.9.1 Access to Protected Health Information. Within 10 days of Covered Entity’s request on behalf of an Individual, Business Associate agrees to make available to Covered Entity any relevant Protected Health Information in a Designated Record Set received from, or created or received on behalf of, Covered Entity in accordance with the Privacy Rule. If Business Associate receives, directly or indirectly, a request from an individual requesting Protected Health Information, Business Associate shall notify Covered Entity in writing promptly of such request no later than 10 business days of receiving such request. If Covered Entity requests an electronic copy of Protected Health Information that is maintained electronically in a Designated Record Set in the Business Associate’s custody or control, Business Associate will provide an electronic copy in the form and format specified by Covered Entity if it is readily producible in such format; if it is not readily producible in such format, Business Associate will work with Covered Entity to determine an alternative form and format that enables Covered Entity to meet its electronic access obligations under 45 CFR §164.524.

2.9.2 Amendment of Protected Health Information. Within 10 days of Covered Entity’s request, Business Associate agrees to make available to Covered Entity any relevant Protected Health Information in a Designated Record Set received from, or created or received on behalf of, Covered Entity so Covered Entity may fulfill its obligations to amend such Protected Health Information pursuant to the Privacy Rule. Business Associate shall incorporate any amendments to Protected Health Information into any and all Protected Health Information Business Associate maintains. If Business Associate receives, directly or indirectly, a request from an Individual requesting Protected Health Information, Business Associate shall notify Covered Entity in writing promptly of such request no later than 5 business days of receiving such request. Covered Entity shall have full discretion to determine whether the requested amendment shall occur.

2.9.3 Accounting of Disclosures. Business Associate shall maintain, beginning as of the date Business Associate first receives Protected Health Information from Covered Entity, an accounting of those disclosures of Protected Health Information it receives from, or creates or receives on behalf of, Covered Entity which are not excepted from disclosure accounting under the Privacy Rule. Within 10 days of Covered Entity’s request, Business Associate shall make available to Covered Entity the information required to provide an accounting of disclosures in accordance with 45 CFR § 164.528. If Business Associate receives, directly or indirectly, a request from an individual requesting an accounting of disclosures of Protected Health Information, Business Associate shall notify Covered Entity in writing promptly of such request no later than 5 business days of receiving such a request. Business Associate shall provide such an accounting based on an Individual’s Formal HIPAA Request to the Covered Entity. Covered Entity shall have full discretion to determine whether the requested accounting shall be provided to the requesting Individual. Business Associate will maintain the disclosure information for at least 6 years following the date of the accountable disclosure to which the disclosure information relates.

2.10 Restrictions and Confidential Communications. Business Associate shall, upon notice from Covered Entity in accordance with Section 3.3, accommodate any restriction to the use or disclosure of Protected Health Information and any request for confidential communications to which Covered Entity has agreed or is required to abide by in accordance with the Privacy Rule. 2.11 Subcontractors. Business Associate will require any of its Subcontractors to whom it provides Protected Health Information received from, or created or received on behalf of, Covered Entity to agree, in a written agreement with Business Associate, to comply with the Security Rule, and to agree to all of the same restrictions and conditions contained in this Agreement or the Privacy and Security Rules that apply to Business Associate with respect to such information. Business Associate shall not assign any of its rights or obligations under this Agreement without the prior written consent of Covered Entity. Business Associate shall provide Covered Entity for approval a copy of any agreement with any agent or subcontractor to whom Business Associate provides Protected Health Information received from, or created or received on behalf of, Covered Entity prior to its execution. 2.12 Data Transmission. The parties agree that Business Associate shall, on behalf of Covered Entity, transmit data for transactions that are required to be conducted in standardized format under the HIPAA Rules. Electronic Protected Health Information that is transmitted over an electronic communications network will be protected against unauthorized access to, or modification of, electronic protected health information. When electronic protected health information is transmitted from one point to another, it will be protected in a manner commensurate with the associated risk. This includes, but is not limited to, transmission through mobile devices and smart phones.

2.12.1 Standardized Format. Business Associate shall comply with the HIPAA Rules for all transactions conducted on behalf of Covered Entity that are required to be in standardized format.

2.12.2 Subcontractors. Business Associate shall ensure that any of its subcontractors to whom it delegates any of its duties under its contract with Covered Entity, agrees to conduct and agrees to require its agents or subcontractors to comply with the HIPAA Rules for all transactions conducted on behalf of Covered Entity that are required to be in standardized format.

2.13 Audit. Audit by Secretary of Health and Human Services. Business Associate shall make its internal practices, books, and records relating to the use and disclosure of Protected Health Information received from, or created or received on behalf of, Covered Entity available to the Secretary of Health and Human Services upon request for purposes of determining compliance by Covered Entity with the Privacy and Security Rules. 2.14 Offshore Restriction. Business Associate represents that neither Business Associate, nor its agents, subcontractors, or affiliates may access or process any PHI from or transfer or transmit PHI to offshore locations outside the United States or United States Territories.