HIPAA and BAAs — Permitted uses & disclosures

Business Associate may use or disclose PHI only: (a) to provide, maintain and support the Services for Covered Entity, consistent with the minimum-necessary standard; (b) as Required by Law; (c) for the proper management and administration of Business Associate and to carry out its legal responsibilities, provided that any disclosure for those purposes is either Required by Law or made under reasonable written assurances from the recipient that the PHI will be held confidentially, used only as disclosed, and that breaches of confidentiality will be reported to Business Associate; and (d) as otherwise permitted by the executed copy of this Agreement or directed by Covered Entity in writing, to the extent such use or disclosure would be permissible under HIPAA if made by Covered Entity. Business Associate will not use or disclose PHI in any manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except as expressly permitted by paragraph (c).