This Business Associate Agreement ("BAA") is entered into between Abasure LLC ("Business Associate") and the customer entity ("Covered Entity") that has executed the Main Services Agreement, Order Form, or other service agreement ("Agreement") with Business Associate.
This BAA is effective as of the Effective Date of the Agreement and is incorporated into the Agreement by reference.
WHEREAS, Covered Entity is a "Covered Entity" and Business Associate is a "Business Associate" as those terms are defined under the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), and their implementing regulations (45 C.F.R. Parts 160 and 164), (collectively, "HIPAA");
WHEREAS, in connection with the services provided by Business Associate to Covered Entity pursuant to the Agreement (the "Services"), Business Associate may create, receive, maintain, or transmit Protected Health Information ("PHI") on behalf of Covered Entity; and
WHEREAS, the parties intend to protect the privacy and provide for the security of PHI disclosed to Business Associate in compliance with HIPAA.
NOW, THEREFORE, in consideration of the mutual promises below and the exchange of information, the parties agree as follows:
Capitalized terms used but not otherwise defined in this BAA shall have the meanings ascribed to them in HIPAA.
Business Associate shall only use and disclose PHI as necessary to perform the Services, as set forth in the Agreement, or as otherwise permitted or required by this BAA or as Required By Law. Business Associate shall not use or further disclose PHI other than as permitted or required by this BAA or as Required By Law.
Business Associate may also use and disclose PHI for its own proper management and administration and to carry out its legal responsibilities, provided that: (a) Any disclosure for such purposes is Required By Law; or (b) Business Associate obtains reasonable assurances from the person to whom the PHI is disclosed that the PHI will remain confidential, be used or further disclosed only as Required By Law or for the purpose for which it was disclosed, and that the person will notify Business Associate of any instances of which it is aware in which the confidentiality of the PHI has been breached.
Business Associate shall implement and maintain appropriate administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic PHI that it creates, receives, maintains, or transmits on behalf of Covered Entity, in accordance with the Security Rule (45 C.F.R. Part 164, Subpart C).
Business Associate shall report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which it becomes aware, including any Security Incident. Business Associate shall report any Breach of Unsecured PHI to Covered Entity without unreasonable delay and in no case later than sixty (60) calendar days after discovery of the Breach, in accordance with 45 C.F.R. § 164.410(c).
Notwithstanding the foregoing, the parties acknowledge and agree that this Section 2.3 constitutes notice by Business Associate to Covered Entity of the ongoing existence and occurrence of unsuccessful attempts to penetrate Business Associate's computer networks and/or information systems, including but not limited to pings and other broadcast attacks on a firewall, denial of service attacks, port scans, unsuccessful log-on attempts, or interception of encrypted information where the encryption key is not compromised ("Unsuccessful Security Incidents"). Business Associate shall have no further obligation to report Unsuccessful Security Incidents to Covered Entity unless such Unsuccessful Security Incidents result in a Security Incident or a Breach.
Business Associate shall ensure that any subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such PHI (including the requirements of 45 C.F.R. § 164.504(e)(5)).
Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of this BAA.
To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate shall, within ten (10) business days of a request from Covered Entity, make available such PHI as is necessary for Covered Entity to respond to an Individual's request for access to their PHI in accordance with 45 C.F.R. § 164.524.
To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate shall, within fifteen (15) business days of a request from Covered Entity, make such PHI available for amendment and incorporate any amendments to PHI as directed by Covered Entity in accordance with 45 C.F.R. § 164.526.
Business Associate shall maintain and make available to Covered Entity, within twenty (20) business days of a request, the information required to provide an accounting of disclosures of PHI with respect to an Individual, in accordance with 45 C.F.R. § 164.528.
Covered Entity shall notify Business Associate of any limitation(s) in its notice of privacy practices, any changes in or revocation of permission by an Individual to use or disclose PHI, or any restriction on the use or disclosure of PHI that Covered Entity has agreed to, to the extent that such limitation, change, or restriction may affect Business Associate's use or disclosure of PHI.
Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining Covered Entity's compliance with HIPAA.
Upon reasonable prior written request by Covered Entity, and no more than once in any twelve (12) month period, Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to Covered Entity (or its designated auditors) for the purpose of determining compliance with this BAA. Such audit shall be conducted during normal business hours, in a manner that does not unreasonably interfere with Business Associate's business operations, and shall be at the sole cost and expense of Covered Entity. Covered Entity shall ensure that its auditors treat all information reviewed during such inspection as confidential information of the Business Associate.
This BAA shall be effective as of the Effective Date of the Agreement and shall remain in effect until all obligations of the parties have been met under this BAA and the Agreement.
Upon Covered Entity's knowledge of a material breach of this BAA by Business Associate, Covered Entity shall provide Business Associate with written notice of the breach and an opportunity to cure the breach within thirty (30) days. If Business Associate fails to cure the breach within such period, Covered Entity may terminate this BAA and, at its discretion, the Agreement.
(a) Upon termination of this BAA for any reason, Business Associate shall, if feasible, return to Covered Entity or destroy all PHI received from, or created or received by Business Associate on behalf of, Covered Entity that Business Associate still maintains in any form. Business Associate shall retain no copies of such PHI.
(b) If Business Associate determines that such return or destruction is not feasible, Business Associate shall notify Covered Entity in writing of the reasons for such determination. Business Associate shall extend the protections of this BAA to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such PHI.
The parties agree that Business Associate is an independent contractor and not an agent of Covered Entity. Nothing in this BAA shall be construed to give Covered Entity control over the operational activities of Business Associate.
Any ambiguity in this BAA shall be interpreted to permit compliance with HIPAA. In the event of an inconsistency between this BAA and the Agreement, the terms of this BAA shall prevail. In the event of an inconsistency between this BAA and mandatory provisions of HIPAA, the provisions of HIPAA shall prevail.
The respective rights and obligations of Business Associate under Section 6.3 (Effect of Termination) of this BAA shall survive the termination of this BAA.