19.1. Basic Privacy Obligation: Each party will have a “Basic Privacy Obligation” in respect of information that (1) is obtained from or processed for another party and (2) identifies or is identified with an individual ("personal information"). Any party having a Basic Privacy Obligation will do the following:

(a) implement and maintain appropriate technical and other protections for the personal information.

(b) not use, disclose, or transfer personal information across borders except as necessary to perform its obligations under this Agreement.

(c) comply with all applicable privacy laws and regulations.

(d) expeditiously report to the other party any breaches of protection of personal information in the complying party's possession.

(e) cooperate with the other party's requests for access to, correction of, or destruction of personal information in the complying party's possession.

(f) to the extent required by applicable law, provide reasonable cooperation with any requests for relevant information by regulatory authorities having jurisdiction.

---

19.2. [OPT] Gramm-Leach-Bliley Act: As used in this Agreement, the term “Gramm-Leach-Bliley Compliance Obligation” has to do with "nonpublic personal information" of or about a "consumer" (as the quoted terms are defined in the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq., and the applicable implementing regulations), where the nonpublic personal information is disclosed to a receiving party by or on behalf of a disclosing party. When a party has a Gramm-Leach-Bliley Compliance Obligation, it means the following:

(a) The receiving party will maintain the confidentiality of the nonpublic personal information and will not use it other than to carry out the purposes for which it was disclosed to the receiving party under this Agreement, or as permitted by any applicable exception under the Act and/or applicable governmental regulations.

(b) The receiving party will not, directly or through its affiliate, disclose such nonpublic personal information to any other person that is a nonaffiliated third party of both the disclosing party and the receiving party, unless such disclosure would be lawful if made directly to such other person by the disclosing party.

(c) The receiving party will implement and maintain a security program designed to protect nonpublic personal information against unauthorized access, use, or disclosure.

(d) The disclosing party will have the right, upon reasonable advance notice and during normal business hours, to inspect the receiving party's policies and practices for preserving the security of information disclosed under this Agreement. The receiving party will cooperate with the disclosing party in a reasonable manner in any such inspection. The receiving party's policies and practices will be deemed its confidential information, and in respect thereof the disclosing party will abide by the provisions of this Agreement.

(e) The receiving party will promptly notify the disclosing party of (1) any actual or suspected unauthorized access, use, or disclosure of nonpublic personal information provided by the disclosing party, and (2) any request for access to such information by a governmental- or nongovernmental third party.

(f) The receiving party will cooperate with the disclosing party in a reasonable manner in case of any actual or anticipated litigation or regulatory inquiry or action concerning the nonpublic personal information provided by the disclosing party.

19.3. [OPT] HIPAA: As used in this Agreement, the term “HIPAA Compliance Obligation” relates to "protected health information" (as defined in the Health Insurance Portability and Accountability Act of 1996, or "HIPAA") disclosed by a disclosing party to a receiving party. When a party has a HIPAA Compliance Obligation, it means the following:

(a) The receiving party will not use or further disclose protected health information other than as permitted or required by this Agreement or as required by law.

(b) The receiving party will use appropriate safeguards to prevent use or disclosure of protected health information other than as provided for by this Agreement.

(c) The receiving party will report to the disclosing party any use or disclosure of protected health information not provided for by this Agreement of which it becomes aware.

(d) The receiving party will ensure that any agents, including for example a subcontractor to whom the receiving party provides protected health information received from the disclosing party, or created or received by the receiving party on the disclosing party’s behalf, agree to the same restrictions and conditions that apply to us with respect to such protected health information.

(e) The receiving party will make protected health information available for amendment, and will incorporate any amendments, in accordance with 45 CFR § 164.526.

(f) The receiving party will make protected health information available as required to provide an accounting of disclosures in accordance with 45 CFR § 164.528.

(g) The receiving party will make its internal practices, books, and records to the extent that they relate to the use and disclosure of PHI received from the disclosing party, or created or received by the receiving party on the disclosing party’s behalf, available to the secretary of the Department of Health and Human Services for the purpose of determining the disclosing party’s compliance with the HIPAA privacy rule.

(h) If the disclosing party determines that the receiving party has breached this clause, the disclosing party may terminate this Agreement, effective immediately upon notice of termination (or such other time as stated in such notice), in accordance with the notice- and termination provisions of this Agreement.

(i) The receiving party will, at any termination of this Agreement, if feasible, return or destroy all protected health information received from the disclosing party, or created or received by the receiving party on the disclosing party’s behalf, that the receiving party still maintains in any form and retain no copies of such information; or, if such return or destruction is not feasible, extend the protections of this Agreement to protected health information and limit further uses and disclosures to those purposes that make the return or destruction of protected health information infeasible.