164.504(e)(2)

Uses and disclosures: Organizational requirements : business associate contract must provide that business associate will not redisclose personal health information.