OCR has developed a model that can be useful for registered entities if you respond to the request from the list of trading partners. Selected reviewers may, but are not necessary, use the following model. Instead, ask them to sign a confidentiality agreement. We insert these points into the confidentiality agreements we provide to our customers: [The agreement could also provide that the consideration could transmit protected health information to another counterparty of the company insured at the time of termination and/or add conditions regarding the obligations of a counterparty in order to obtain or guarantee protected health information established, received or managed by subcontractors.] (a) counterparties may not use or disclose protected health information as a written contract between a covered entity and a counterparty: (1) specifies the use and disclosure by the counterparty of protected health information that is authorized and necessary; (2) provide that the counterparty will not use the information or disclose it any more than is authorized or necessary under the contract, or as required by law; (3) require the counterparty to put in place appropriate security measures to prevent the unauthorized use or disclosure of information, including the requirements for the implementation of the HIPAA security rule with respect to electronically protected health information; (4) require the counterparty to notify the entity concerned of the use or disclosure of information that is not included in its contract, including incidents that constitute violations of unsecured protected health information; (5) require the counterparty to disclose protected health information in accordance with its contract in order to comply with the obligation on a covered company to submit copies of their protected health information for individual requests for protected health data, as well as to provide protected health information for any modifications (and, if applicable, modifications) and accounting; (6) to the extent that the counterparty must meet the obligation of a company insured under the data protection rule, compel the counterparty to meet the requirements of the undertaking; (7) require HHS to provide its internal practices, books and records relating to the use and disclosure of protected health information obtained or established by the company bound by the company insured for HHS purposes, in order to determine compliance with the HIPAA data protection rule by the target company; (8) in the event of termination of the contract, where possible, require the consideration to return or destroy any protected health information received or created or received by the partner on behalf of the insured company; (9) require the counterparty to ensure that all subcontractors it can exercise on its behalf and have access to protected health information accept the same restrictions and conditions as those that apply to the counterpart with respect to that information; and (10) to authorize the termination of the contract by the covered entity if the consideration violates a significant clause of the contract.