(iii) Any restriction to the use or disclosure of Protected Health Information that the
Health Plan has agreed to in accordance with 45 CFR 164.522, to the extent that
such restriction may affect PDA's use or disclosure of Protected Health
Information.
J. Disclosure to CMS for Part D Program
Pursuant to 42 CFR 423.884(b) and notwithstanding any provision herein to the contrary, the
Health Plan agrees that the Health Plan, the Health Plan Administrator or PDA (on behalf of the
Health Plan) may disclose Protected Health Information to the Center for Medicare and Medicaid
Services (CMS) to the extent necessary to comply with Subpart R of 42 CFR Part 423 (relating to
Notices of Creditable and Non-Creditable Coverage and applications for drug subsidy payment to
the Plan Sponsor in connection with the prescription drug benefit under the Health Plan).
6. Security of Electronic Protected Health Information
(a) PDA has implemented administrative, physical, and technical safeguards that reasonably
and appropriately protect the security, confidentiality, integrity and availability of ePHI
that it creates, receives, maintains or transmits on behalf of the Health Plan as required
under the Security Standards.
(b) PDA agrees that it will ensure that agents or subcontractors to whom it provides ePHI
agree to implement the administrative, physical, and technical safeguards that reasonably
and appropriately protect its confidentiality, integrity and availability.
(c) PDA agrees to report to the Health Plan, as soon as reasonably practicable, any Security
Incident (as defined in 45 C.F.R. Part 164.304) of which it becomes aware.
(d) The Health Plan agrees and understands that the Health Plan is independently responsible
for the security of ePHI in its possession, whether it was created by the Health Plan or
received from outside sources (including PDA).
7. Term and Termination
(a) Term. The term of this Agreement shall be for a period commencing as of the effective
date of the Service Agreement and ending when all of the Protected Health Information
provided by the Health Plan to PDA, or created or received by PDA on behalf of the
Health Plan, is destroyed, returned to the Health Plan or further protected in accordance
with the termination provisions in this Section 7.
(b) Termination for Cause. Upon the Health Plan Administrator’s knowledge of a Significant
Breach of PDA’s obligation under this Agreement and subject to Section 7(c) hereof, the
Health Plan Administrator may commence termination of this Agreement by providing a
notice of termination to PDA. Notwithstanding the foregoing, this Agreement shall be
considered to have been terminated pursuant to this Section 7(b) only if, prior to such
notice of termination:
(i) The Health Plan Administrator shall have given to PDA written notice
describing with specificity the Significant Breach;
City of Nashua 6 BAA Revised October 2013
