BBL (or its suppliers) is a covered entity as defined in the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”). BBL is providing the Purchaser with a Limited Data Set of Protected Health Information (“PHI”) as defined in 45 C.F.R. §164.514(e)(2) (the “Limited Data Set”). Both BBL and the Purchaser agree to the provisions of this DUA in order to address the requirements of HIPAA and to protect the interest of both parties.
The Purchaser shall have the right to use all PHI provided to it by BBL for research purposes only. The Purchaser agrees that it will not use or further disclose the PHI other than as permitted by this DUA, or as otherwise required by law or regulation. The Purchaser shall use appropriate safeguards to protect the PHI from misuse or inappropriate disclosure and to prevent any use or disclosure of the PHI.
The Purchaser will have the right to disclose non-individually identifiable information regarding the Data in a summary form that aggregates more than one individual’s clinical information for scientific journal publication and regulatory filing purposes, in all events to the extent permitted under applicable law (provided, however, that any such disclosures for patent filing purposes need not be on an aggregate basis if such information so disclosed is de-identified and such disclosures abide by applicable law). The Purchaser shall report to BBL any use or disclosure of the PHI that is not provided for in this DUA of which the Purchaser becomes aware. Purchaser will take reasonable steps to limit any further such use or disclosure.
Term. The Term of this DUA shall be effective as of the receipt of the Data by the Purchaser, and shall terminate when all the PHI provided by BBL to Purchaser is destroyed or returned, or, if it is infeasible to return or destroy PHI, protections are extended to such information, in accordance with this DUA.
Termination. Should the Purchaser commit a material breach of this DUA, which is not cured within ten (10) days after the Purchaser receives notice of such breach from BBL, then BBL will discontinue disclosure of PHI. Within ten (10) days upon termination of this DUA, the Purchaser shall return or destroy all PHI received from BBL. Purchaser shall retain no copies of the PHI. In the event that that Purchaser determines that returning or destroying the PHI is infeasible and upon mutual agreement of both parties, the Purchaser shall extend the protections of this DUA to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Purchaser maintains PHI.
The parties agree that any ambiguity in this DUA shall be resolved in favor of a meaning that complies and is consistent with applicable law protecting the privacy, security and confidentiality of PHI and the Limited Data Set, including, but not limited to HIPAA.
