DTCC BUSINESS ASSOCIATE AGREEMENT
This Business Associate Agreement (“BAA” or “Agreement”) is an agreement that applies to theprocessing of Protected Health Information between National Securities Clearing Corporation(“NSCC”) in providing services to NSCC members who are Covered Entities.
1. Definitions
The following terms and other capitalized terms used in this Agreement that are not otherwise definedin this Agreement shall have the same meaning as those terms in the Health Insurance Portability andAccountability Act (“HIPAA”) Rules (as defined below): Breach, Data Aggregation, DesignatedRecord Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy
Practices, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected HealthInformation, and Use.
(a) Business Associate. “Business Associate” shall generally have the same meaning as the term
“Business Associate” at 45 CFR 160.103, and in reference to the party to this agreement, shallmean NSCC.
(b) Covered Entity. “Covered Entity” shall generally have the same meaning as the term “CoveredEntity” at 45 CFR 160.103, and in reference to the party to this agreement, shall mean eachmember of NSCC that is a Covered Entity and for which NSCC is receiving PHI.
(c) HIPAA Rules. “HIPAA Rules” shall mean the Privacy, Security, Breach Notification, andEnforcement Rules at 45 CFR Part 160 and Part 164.
(d) Protected Health Information. “Protected Health Information” or “PHI” shall have the same
meaning as the term “Protected Health Information” at 45 C.F.R. 160.103, limited to that protected
health information NSCC creates, receives, maintains or transmits in order to provide a businessassociate service to, or perform a business associate function for or on behalf of, Covered Entity.
2. Obligations and Activities of Business Associate
Business Associate agrees to:(a) Limit Uses and Disclosures. Not Use or Disclose PHI other than as permitted or required by theAgreement or as Required by Law. Such Use, Disclosure or request of PHI shall be limited to theminimum necessary requirements.
(b) Safeguard PHI. Use appropriate administrative, physical, and technical safeguards, and comply
with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent Use or Disclosure ofPHI other than as provided for by the Agreement;(c) Report Unauthorized Uses and Disclosures. Report to Covered Entity any Use or Disclosure of
PHI not provided for by the Agreement of which it becomes aware, including Breaches ofUnsecured PHI as required at 45 CFR 164.410, and any Security Incident of which it becomesaware within a reasonable period of time from discovery. Any such report shall include theidentification (if known) of each Individual whose Unsecured PHI has been, or is reasonably
believed by the Business Associate to have been accessed, acquired, Used or Disclosed inconnection with such Breach and any other information required by the HIPAA Rules.
Notwithstanding the foregoing, Covered Entity acknowledges that Business Associate routinelyexperiences unsuccessful Security Incidents that do not result in a Breach of Unsecured PHI, suchas pings, port scans, phishing attempts and other unsuccessful Security Incidents. BusinessAugust 2020

DTCC Public (White)

Associate hereby notifies Covered Entity of such unsuccessful Security Incidents, and the Parties
acknowledge and agree that no further notice shall be required of such unsuccessful Security
Incidents;(d) Subcontractors. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable,ensure that any Subcontractors that create, receive, maintain, or transmit PHI on behalf of theBusiness Associate agree to no less restrictive restrictions, and conditions that apply to theBusiness Associate with respect to such information;(e) Access to PHI. To the extent that Business Associate maintains PHI in a Designated Record Set,
Business Associate will make PHI in a Designated Record Set available to the Covered Entity asnecessary to satisfy Covered Entity’s obligations under 45 CFR 164.524;(f) Amendment to PHI. To the extent that Business Associate maintains PHI in a Designated RecordSet, Business Associate will make any amendment(s) to PHI in a Designated Record Set as
directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures asnecessary to satisfy Covered Entity’s obligations under 45 CFR 164.526;(g) Accounting of Disclosures. When required by applicable law and requested by Covered Entity,
Business Associate will make available the information required to provide an accounting ofDisclosures, of which Business Associate is aware, to the Covered Entity as necessary to satisfy
Covered Entity’s obligations under 45 CFR 164.528;(h) Individual Requests. To the extent Business Associate receives a request directly from an
Individual to access, amend or receive an accounting of disclosures of PHI about the Individual,
Business Associate shall promptly forward such request to the Covered Entity.
(i) Internal Books and Records. Make its internal practices, books, and records relating to the Useand Disclosure of PHI available to the Secretary of the U.S. Department of Health and HumanServices (“HHS”) for purposes of determining the Covered Entity’s compliance with the HIPAA
Rules.
(j) Business Associate’s Operations. Business Associate may Use or Disclose PHI for its own proper
management, administration, and legal responsibilities. Business Associate may Disclose
Protected Health Information for the proper management and administration of Business Associate
or to carry out the legal responsibilities of the Business Associate, provided the Disclosures areRequired by Law, or Business Associate obtains reasonable assurances from the person to whom
the information is disclosed that the information will remain confidential and Used or further
Disclosed only as Required by Law or for the purposes for which it was Disclosed to the person,
and the person notifies Business Associate of any instances of which it is aware in which theconfidentiality of the information has been breached.
(k) Data Aggregation and De-Identification. Business Associate may use PHI to provide DataAggregation Services related to the Covered Entity’s Health Care Operations. Business Associate
may also de-identify PHI it obtains or creates in the course of providing services to CoveredEntity.
(l) Other Uses and Disclosures of PHI. Business Associate is permitted to Use and/or Disclose PHI
as necessary to provide business associate services to, or perform business associate functions for,Covered Entity and as otherwise expressly permitted or required by this Agreement or Required byLaw.

August 2020

DTCC Public (White)

(m) Marketing. Business Associate shall not directly or indirectly receive payment for any Use or
Disclosure of PHI for marketing purposes except where permitted by this Agreement andconsistent with applicable law.
(n) Sale of PHI. Business Associate shall not directly or indirectly receive remuneration in exchange
for PHI except where permitted by the Agreement and consistent with applicable law.
3. Provisions for Covered Entity to Inform Business Associate of Privacy Practices andRestrictions(a) Covered Entity shall notify Business Associate of any limitation(s) in the notice of privacy
practices of Covered Entity under 45 CFR 164.520, to the extent that such limitation may affectBusiness Associate’s Use or Disclosure of PHI.
(b) Covered Entity shall notify Business Associate of any changes in, or revocation of, the permission
by an Individual to Use or Disclose his or her PHI, to the extent that such changes may affectBusiness Associate’s use or disclosure of PHI.
(c) Covered Entity shall notify Business Associate of any restriction on the use or disclosure of PHI
that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent
that such restriction may affect Business Associate’s Use or Disclosure of PHI.
4.

Termination(a) Termination for Cause. Business Associate authorizes termination of this Agreement by CoveredEntity, if Covered Entity determines Business Associate has violated a material term of theAgreement and Business Associate has not cured the breach or ended the violation in thereasonable time period specified by Covered Entity.
(b) Obligations of Business Associate Upon Termination. At termination of this Agreement,
Business Associate agrees, where feasible, to return or destroy all PHI received from, or created orreceived by Business Associate on behalf of, Covered Entity under this Agreement. If such returnor destruction of records is not feasible (for example, as in the case of Business Associate’s
document retention requirements), Business Associate will continue to extend the protections of
this Agreement to such PHI and limit any further Use or Disclosure of PHI to those purposes thatmake the return or destruction of the PHI infeasible.
(c) Survival. The obligations of Business Associate under this Section shall survive the termination ofthis Agreement.

August 2020

DTCC Public (White)