permitted or required by the contract or as required by law;
o Will use appropriate safeguards to prevent the use or
disclosure of Protected Information for any reason other than as provided by this Agreement. Contractor shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic PHI that it creates, receives, maintains or transmits on behalf of UTMB;
o Promptly notify UTMB of any use or disclosure of PHI not provided for in this Agreement of which it becomes aware. Contactor shall report to UTMB any instances, including security incidents, of which it is aware in which PHI is used or disclosed for a purpose that is not otherwise provided for in this Agreement or for a purpose not expressly permitted by the HIPAA Rules;
o Require any agents or subcontractors who receive PHI to be bound by the same restrictions and conditions outlined in this Agreement. Additionally, Contractor shall ensure that any agent, including a subcontractor, agrees to implement reasonable and appropriate safeguards to protect the confidentiality, integrity and availability of electronic PHI that Contractor creates, receives, maintains, or transmits on behalf of UTMB;
o Make available PHI in accordance with the UTMB policy on Patient Access to PHI.
o Make available PHI for amendment and incorporate any amendments to PHI in accordance with the UTMB policy on Patient’s Right to Amend or Correct PHI;
o Make available the information required to provide an accounting of disclosures in accordance with the UTMB policy on Accounting of PHI Disclosures;
o Make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created by, or on behalf of, UTMB, available to U. S. Department of Health & Human Services (HHS) for purposes of determining UTMB’s compliance; and
o At termination of the contract, if feasible, return or destroy
