American Home Shield 2010 Annual Report Download - page 345

2. Applicability. This Addendum shall be applicable to Protected Health Information (i) received by Business Associate from
the members of the Customer Group, (ii) created or received by Business Associate on behalf of the members of the Customer Group,
or (iii) or otherwise obtained by Business Associate in the course of providing the Services under the Agreement.
3. Scope of Use of Protected Health Information. Business Associate shall not use or disclose Protected Health Information
for any purpose other than:
(i) As permitted or required by the Agreement or to carry out the activities specified in the Agreement;
(ii) For management and administrative activities of Business Associate; and
(iii) As otherwise "Required by Law", as defined in 45 C.F.R. § 164.103.
4. Safeguards for the Protection of Protected Health Information. Business Associate shall process Protected Health
Information on behalf of the members of the Customer Group and in accordance with Customer's instructions. Business Associate
shall follow Customer's instructions by implementing and maintaining operational and technological safeguards mutually agreed to in
applicable statements of work or in comparable contract documents describing the services to be performed. Customer agrees that the
specified safeguards are appropriate for the Customer Group's requirements. Customer also confirms that Customer is solely
responsible for ensuring that specified processing and safeguarding instructions comply with data protection laws applicable to the
Customer Group.
5. Reporting of Unauthorized Uses or Disclosures. Business Associate shall immediately notify Customer of any use or
disclosure of Protected Health Information of which Business Associate becomes aware that is not provided for or permitted in the
Agreement, including this Addendum.
6. Use of Subcontractors. To the extent that Business Associate discloses Protected Health Information to one or more
subcontractors or agents, Business Associate shall cause each such subcontractor and agent to sign an agreement with Business
Associate containing provisions and conditions related to the protection and confidentiality of Protected Health Information (including
the obligation to notify Customer of unauthorized uses or disclosures of Protected Health information as set forth in Section 5, above)
at least as restrictive as those that apply to Business Associate under the Agreement and this Addendum. Business Associate shall
provide Customer with copies of such written agreements.
7. Authorized Access to and Amendment of Protected Health Information. Within twenty (20) days of any request by
Customer, Business Associate shall make available to Customer all Protected Health Information held