(d)
(e)
(f)
(g)
(h)
(i)
@)
(k)
(I)
(m)
“Individual” shall have the same meaning as the term “individual” in 45 CFR 160.103
and shall include a person who qualifies as a personal representative in accordance with
45 CFR 164.502(g).
“Health Plan Administrator” or “Plan Administrator” shall have the same meaning as
set forth in the Health Plan’s Plan Document or in the absence of such designation shall be
the Plan Sponsor.
“Privacy Rule” shall have the meaning as set forth in the RECITALS portion of this
Agreement.
“Protected Health Information” shall have the same meaning as the term “protected
health information” in 45 CFR 160.103, but limited to the information created, received,
transmitted or maintained by PDA from or on behalf of the Health Plan. “Protected Health
Information” includes electronic protected health information (as defined in 45 CFR
160.103) (“ePHY”) that PDA creates, receives, maintains or transmits on behalf of the
Health Plan.
“Required by Law” shall have the same meaning as the term “required by law” in 45
CFR 164.103 (and as further described in 70 Federal Register 4405 with regard to
compliance with the Center for Medicare and Medicaid Services’ requirement of
disclosure of Protected Health Information pursuant to 42 CFR 423.884(b)).
“Secretary” shall mean the Secretary of the Department of Health and Human Services
or his designee.
“Security Incident” shall have the same meaning as set forth in 45 CFR 164.304, and
which includes the attempted or successful unauthorized access, use, disclosure,
modification, or destruction of information or interference with system operations in an
Information System (as defined at 45 CFR 164.304).
“Security Standards” shall mean the Security Standards for the Protection of Electronic
Protected Health Information at 45 CFR Parts 160, 162, and 164, as amended from time to
time.
“Service Agreement” shall have the meaning as set forth in the RECITALS portion of
this Agreement.
“Significant Breach” shall mean a pattern of activity or practice that constitutes a
material breach or violation of this Agreement in the written opinion of legal counsel for
the Health Plan. For purposes hereof, a “pattern of activity or practice” shall consist of at
least three (3) discrete acts and/or omissions within a period of not more than 180
consecutive days.
2 Obligations of PDA
PDA agrees to:
(a)
City of Nashua
Not use or disclose Protected Health Information other than as permitted or required by
this Agreement, the Privacy Rule, the Security Standards, or as Required By Law;
2 BAA Revised October 2013
