information as may be required by good professional practice as authorized by law, and otherwise providing good information management practices regarding all health and financial information.

(OR - Use this confidentiality clause when the DHMH unit is a covered entity and the vendor is not a business associate.)

34. Compliance With HIPAA And State Confidentiality Law

34.1 The Contractor acknowledges its duty to become familiar with and comply, to the extent applicable, with all requirements of the federal Health Insurance Portability and Accountability Act (HIPAA), 42 U.S.C. § 1320d et seq. and implementing regulations including 45 CFR Parts 160 and 164. The contractor also agrees to comply with the Maryland Confidentiality of Medical Records Act (Md. Code Ann. Health-General §§4-301 et seq., MCMRA). This obligation includes:

(a) As necessary, adhering to the privacy and security requirements for protected health information and medical records under federal HIPAA and State MCMRA and making the transmission of all electronic information compatible with the federal HIPAA requirements;

(b) Providing training and information to employees regarding confidentiality obligations as to health and financial information and securing acknowledgement of these obligations from employees to be involved in the contract; and

(c) Otherwise providing good information management practices regarding all health information and medical records.

34.2 If in connection with the procurement or at any time during the term of the contract, the Department determines that functions to be performed in accordance with the Services to Be Performed set forth in Part I constitute business associate functions as defined in HIPAA, the Contractor acknowledges its obligation to execute a business associate agreement as required by HIPAA regulations at 45 CFR §164.501.

34.3 Protected Health Information as defined in the HIPAA regulations at 45 CFR 160.103 and 164.501, means information transmitted as defined in the regulations, that is individually identifiable; that is created or received by a healthcare provider, health plan, public health authority, employer, life insurer, school or university, or healthcare clearinghouse; and that is related to the past, present, or future physical or mental health or condition of an individual, to the provision of healthcare to an individual, or to the past, present, or future payment for the provision of healthcare to an individual. The definition excludes certain education records as well as employment records held by a covered entity in its role as employer.

(OR - Use this confidentiality clause when the DHMH unit is a covered entity and the vendor is a business associate.)

######## 34. Compliance with Federal HIPAA and State Confidentiality Law

34.1 The Contractor acknowledges its duty to become familiar with and comply, to the extent applicable, with all requirements of the federal Health Insurance Portability and Accountability Act (HIPAA), 42 U.S.C. § 1320d et seq. and implementing regulations including 45 CFR Parts 160 and 164. The contractor also agrees to comply with the Maryland Confidentiality of Medical Records Act (Md. Code Ann. Health-General §§4-301 et seq., MCMRA). This obligation includes:

49