A written contract between an insured entity and a counterparty must determine: 1) the use and disclosure of protected health information authorized and necessary by the counterparty; (2) provide that the counterparty will not use the information or disclose it any more than is authorized or necessary under the contract, or as required by law; (3) require the counterparty to put in place appropriate security measures to prevent the unauthorized use or disclosure of information, including the requirements for the implementation of the HIPAA security rule with respect to electronically protected health information; (4) require the counterparty to notify the entity concerned of the use or disclosure of information that is not included in its contract, including incidents that constitute violations of unsecured protected health information; (5) require the counterparty to disclose protected health information in accordance with its contract in order to comply with the obligation on a covered company to submit copies of their protected health information for individual requests for protected health data, as well as to provide protected health information for any modifications (and, if applicable, modifications) and accounting; (6) to the extent that the counterparty must meet the obligation of a company insured under the data protection rule, compel the counterparty to meet the requirements of the undertaking; (7) require HHS to provide its internal practices, books and records relating to the use and disclosure of protected health information obtained or established by the company bound by the company insured for HHS purposes, in order to determine compliance with the HIPAA data protection rule by the target company; (8) in the event of termination of the contract, where possible, require the consideration to return or destroy any protected health information received or created or received by the partner on behalf of the insured company; (9) require the counterparty to ensure that all subcontractors it can exercise on its behalf and have access to protected health information accept the same restrictions and conditions as those that apply to the counterpart with respect to that information; and (10) to authorize the termination of the contract by the covered entity if the consideration violates a significant clause of the contract.