Business Associate Agreement
Effective Date: March 9th, 2018
No Third Party Beneficiaries.
A reference in this Addendum to a section in HIPAA means the section as it may be amended from time-to-time.
OBLIGATIONS OF THE COMPANYUse and Disclosure of PHI.
a. Company may use PHI internally for Company’s proper management and administration or to carry out its legal responsibilities.
b. Company may disclose PHI to a third party for Company’s proper management and administration, provided that the disclosure is Required by Law or Company obtains reasonable assurances from the third party to whom the PHI is to be disclosed that the third party will (1) protect the confidentiality of the PHI, (2) only use or further disclose the PHI as Required by Law or for the purpose for which the PHI was disclosed to the third party and (3) notify Company of any instances of which the third party is aware in which the confidentiality of the PHI has been breached.
Company may use PHI to create de-identified health information in accordance with the HIPAA de-identification requirements. Company may disclose de-identified health information for any purpose permitted by law.
Company shall use appropriate safeguards to prevent the use or disclosure of PHI other than as permitted or required by this Addendum. In addition, Company shall implement Administrative Safeguards, Physical Safeguards and Technical Safeguards that reasonably and appropriately protect the Confidentiality, Integrity and Availability of PHI transmitted or maintained in Electronic Media (“EPHI”) that it creates, receives, maintains or transmits on behalf of Provider. Company shall comply with the HIPAA Security Rule with respect to EPHI.
Minimum Necessary Standard.
To the extent required by the “minimum necessary” requirements of HIPAA, Company shall only request, use and disclose the minimum amount of PHI necessary to accomplish the purpose of the request, use or disclosure.
Company shall take reasonable steps to mitigate, to the extent practicable, any harmful effect (that is known to Company) of a use or disclosure of PHI by Company in violation of this Addendum.
Subcontractors. Company shall enter into a written agreement meeting the requirements of 45 C.F.R. §§ 164.504(e) and 164.314(a)(2) with each Subcontractor (including, without limitation, a Subcontractor that is an agent under applicable law) that creates, receives, maintains or transmits PHI on behalf of Company. Company shall ensure that the written agreement with each Subcontractor obligates the Subcontractor to comply with restrictions and conditions that are at least as restrictive as the restrictions and conditions that apply to Company under this Addendum.
Company shall report any Security Incident involving EPHI of which it becomes aware in the following manner: (a) any actual, successful Security Incident will be reported to Provider in writing without unreasonable delay, and (b) any attempted, unsuccessful Security Incident of which Company becomes aware will be reported to Provider orally or in writing on a reasonable basis, as requested by Provider. Notwithstanding the preceding, the parties acknowledge and agree that this section constitutes notice by Company to Provider of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined below) for which no additional notice to Provider shall be required. “Unsuccessful Security Incidents” shall include, but not be limited to, pings and other broadcast attacks on Company’s firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as no such incident results in unauthorized access, use or disclosure of EPHI.
Company shall, following the discovery of a Breach of Unsecured PHI, notify Provider of the Breach in accordance with 45 C.F.R. § 164.410 without unreasonable delay and in no case later than 60 days after discovery of the Breach.
Access to PHI.
Within 15 business days of a request by Provider for access to PHI about an Individual contained in any Designated Record Set of Provider maintained by Company, Company shall make available to Provider such PHI for so long as Company maintains such information in the Designated Record Set. If Company receives a request for access to PHI directly from an Individual, Company shall forward such request to Provider within ten business days. Provider shall have the sole responsibility to make decisions regarding whether to approve a request for access to PHI.
Availability of PHI for Amendment.
Within 15 business days of receipt of a request from Provider for the amendment of an Individual’s PHI contained in any Designated Record Set of Provider maintained by Company, Company shall provide such information to Provider for amendment and incorporate any such amendments in the PHI (for so long as Company maintain such information in the Designated Record Set) as required by 45 C.F.R. § 164.526. If Company receives a request for amendment to PHI directly from an Individual, Company shall forward such request to Provider within ten business days. Provider shall have the sole responsibility to make decisions regarding whether to approve a request for an amendment to PHI.
Accounting of Disclosures.
Within 15 business days of notice by Provider to Company that it has received a request for an accounting of disclosures of PHI (other than disclosures to which an exception to the accounting requirement applies), Company shall make available to Provider such information as is in Company’s possession and is required for Provider to make the accounting required by 45 C.F.R. § 164.528. If Company receives a request for an accounting directly from an Individual, Company shall forward such request to Provider within ten business days. Provider shall have the sole responsibility to provide an accounting of disclosures to the Individual.
Availability of Books and Records.
Company shall make its internal practices, books and records relating to the use and disclosure of PHI received from, or created or received by Company on behalf of, Provider available to the Secretary for purposes of determining Provider’s and Company’s compliance with HIPAA.
Obligations of ProviderPermissible Requests.
Provider shall not request Company to use or disclose PHI in any manner that would not be permissible under HIPAA if done directly by Provider (except as provided in Sections 2.1(a), (b) and (c) of this Addendum).
Minimum Necessary PHI.
When Provider discloses PHI to Company, Provider shall provide the minimum amount of PHI necessary for the accomplishment of Company’s purpose.
LIMITATION OF LIABILITY Limitation of Liability.
Exclusion of Consequential and Related Damages. In no event shall Company or its present and former affiliates, directors, officers, employees, or agents have any liability to Provider or any third party for any lost profits, loss of data, loss of use, costs of procurement of substitute good or services, or for any indirect, special, incidental, punitive, or consequential damages however caused and, whether in contract, tort, or under any other theory of liability whether or not Company has been advised of the possibility of such damage. Because some states or jurisdictions do not allow the exclusion or the limitation of liability for consequential or incidental damages, in such states or jurisdictions, Company’s and its present and former subsidiaries’, affiliates’, directors’, officers’, employees’, and agents’ liability shall be limited to the maximum extent permitted by law.