Attachment A
Protected Health Information
A. General. It is recognized by each party to this Agreement that certain
information that is proprietary and non-public may be disclosed to the
other party pursuant to this Agreement, including protected health
information of Facility residents (“PHI”) which is regulated by the Health
Insurance Portability and Accountability Act healthcare privacy regulations
(“HIPAA”). Facility and College agree that confidential information will only
be available to officers, employees, or agents of the parties who may be
required to have access to such confidential information in order to
perform their duties under this Agreement and that confidential information
of the other party will not be disclosed to any other person, firm, or entity
without obtaining the prior written consent of the other party.
B. Permitted Uses. College is permitted to use the PHI only as necessary to
perform the Services set forth in this Agreement (“Permitted Uses”).
C. Duties of College to Protect PHI. College shall:
i. not use or further disclose any PHI other than as permitted or
required by this Amendment;
ii. not use or further disclose any PHI in a manner that would violate
the requirements of applicable law, including, but not limited to
HIPAA
iii. implement a policy and procedure that incorporates appropriate
safeguards to prevent the use or disclosure of such PHI other than
as provided for by this Amendment and provide a copy of such
policy and procedure to Facility upon request;
iv. immediately report to Facility any use or disclosure of such PHI not
provided for by this Amendment of which College becomes aware;
v. ensure that any subcontractor or agent to whom College provides
such PHI agrees, in a writing substantially similar to this
Amendment, to the same restrictions and conditions that apply to
College with respect to such information under this Amendment;
provided, however, that College shall not provide any PHI to any
subcontractor or agent without the prior written consent of Facility;
vi. make such PHI available for inspection and copying by the subjects
thereof in accordance with applicable law, including, but not limited
to HIPAA;
vii. incorporate any amendments or corrections to such PHI when
notified by Facility; and
viii. make available to Facility any information required to provide an
accounting of the College’s disclosures of PHI during the six-year
period prior to the date on which the accounting is requested;
provided that this information need not be maintained for
disclosures that occur in the course of treatment, payment and
operations transactions or disclosures to members of their PHI in
accordance with HIPAA.
D. Investigations. College shall makes its internal practices, books and
records relating to the use and disclosure of such PHI available to the
Secretary of the United States Department of Health and Human Services
(the “Secretary”) for purposes of determining Facility’s compliance with
applicable law, including, but not limited to HIPAA. College shall
7