Business Associate Agreement

This Business Associate Agreement (the “Agreement”) is entered into by and between the parties identified above pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and the regulations promulgated thereunder, including the Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Parts 160 and 164 (collectively, the “HIPAA Rules”). Covered Entity has engaged Business Associate to provide virtual medical administration and clinical workflow support services, and in performing those services Business Associate may create, receive, maintain, or transmit Protected Health Information on behalf of Covered Entity.

This Agreement remains in effect for the duration of the underlying Service Agreement between the parties and survives as set forth in Section 12.

01Definitions

Capitalized terms used but not otherwise defined in this Agreement have the meanings assigned to them in the HIPAA Rules. For clarity:

• Protected Health Information (“PHI”) has the meaning given at 45 C.F.R. § 160.103, limited to information Business Associate creates, receives, maintains, or transmits for or on behalf of Covered Entity.
• Electronic PHI (“ePHI”) means PHI transmitted by or maintained in electronic media.
• Breach, Designated Record Set, Individual, Required by Law, Secretary, Security Incident, Subcontractor, and Unsecured PHI have the meanings given in the HIPAA Rules.
• Service Agreement means the services agreement, statement of work, or retainer agreement in effect between the parties, as amended from time to time.

02Purpose and Scope

This Agreement sets forth the terms under which Business Associate may create, receive, maintain, transmit, use, or disclose PHI from or on behalf of Covered Entity in the course of providing services. In the event of a conflict between this Agreement and the Service Agreement with respect to the handling of PHI, this Agreement controls.

03Permitted Uses and Disclosures

Business Associate may use or disclose PHI only as necessary to perform the services described in the Service Agreement, as permitted or required by this Agreement, or as Required by Law. Business Associate may additionally:

• Use PHI for the proper management and administration of Business Associate or to carry out its legal responsibilities.
• Disclose PHI for the proper management and administration of Business Associate, provided the disclosure is Required by Law or Business Associate obtains reasonable written assurances from the recipient that the information will be held confidentially, used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the recipient will notify Business Associate of any breach of confidentiality.
• Use PHI to provide Data Aggregation services relating to the health care operations of Covered Entity, if requested.
• De-identify PHI in accordance with 45 C.F.R. § 164.514(a)–(c), where necessary to perform the services.

04Prohibited Uses and Minimum Necessary

Business Associate shall not use or disclose PHI in any manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except as expressly permitted in Section 3. Business Associate shall not sell PHI or use or disclose PHI for marketing or fundraising purposes. Business Associate shall limit each use, disclosure, and request for PHI to the minimum necessary to accomplish the intended purpose, consistent with 45 C.F.R. § 164.502(b).

05Safeguards

Business Associate shall implement and maintain appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of PHI, and shall comply with Subpart C of 45 C.F.R. Part 164 (the Security Rule) with respect to ePHI. Business Associate shall use appropriate safeguards to prevent any use or disclosure of PHI not permitted by this Agreement, and shall train its workforce and Subcontractors on the handling of PHI.

06Reporting, Breach Notification, and Mitigation

a. Reporting

Business Associate shall report to Covered Entity any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, any Security Incident with respect to ePHI, and any Breach of Unsecured PHI, without unreasonable delay and in no case later than five (5) business days after discovery.

b. Content of Notification

To the extent known at the time of notification, and supplemented promptly thereafter, the report shall identify the nature of the incident, the types of PHI involved, the Individuals whose PHI was or is reasonably believed to have been affected, the date of the incident and date of discovery, and the steps Business Associate has taken or will take to investigate, mitigate harm, and prevent recurrence.

c. Mitigation and Cooperation

Business Associate shall take reasonable steps to mitigate any harmful effect known to it of a use or disclosure of PHI in violation of this Agreement, and shall cooperate with Covered Entity in investigating and responding to the incident, including providing information and documentation reasonably necessary for Covered Entity to meet its own notification obligations under 45 C.F.R. §§ 164.400–414.

07Subcontractors

Business Associate shall ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to restrictions and conditions at least as protective as those that apply to Business Associate under this Agreement, in accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2). Business Associate remains responsible to Covered Entity for the performance of its Subcontractors under this Agreement.

08Individual Rights

a. Access

To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate shall make such PHI available to Covered Entity, or to an Individual as directed by Covered Entity, within ten (10) business days of request, to enable Covered Entity to meet its obligations under 45 C.F.R. § 164.524.

b. Amendment

Business Associate shall make any amendment to PHI in a Designated Record Set as directed by or agreed to by Covered Entity pursuant to 45 C.F.R. § 164.526, within ten (10) business days of request.

c. Accounting of Disclosures

Business Associate shall document disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request for an accounting under 45 C.F.R. § 164.528, and shall provide such information to Covered Entity within twenty (20) business days of request.

d. Restrictions and Confidential Communications

Business Associate shall comply with any restriction on the use or disclosure of PHI, any request for confidential communications, and any revocation of authorization, that Covered Entity communicates to Business Associate in writing and that is applicable to Business Associate’s services.

09Availability to the Secretary

Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining Covered Entity’s compliance with the HIPAA Rules. Business Associate shall notify Covered Entity of any such request as promptly as practicable, unless prohibited by law.

10Obligations of Covered Entity

Covered Entity shall notify Business Associate of any limitation in its Notice of Privacy Practices, of any changes in or revocation of an Individual’s permission to use or disclose PHI, and any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by, to the extent any of these affect Business Associate’s permitted uses or disclosures. Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Covered Entity.

11Term and Termination

a. Term

This Agreement takes effect on the Effective Date and continues until the Service Agreement terminates and all PHI is returned or destroyed in accordance with Section 12, or until otherwise terminated as provided below.

b. Termination for Cause

If either party becomes aware of a material breach of this Agreement by the other, the non-breaching party may provide written notice of the breach and afford the breaching party a reasonable opportunity, not to exceed thirty (30) days, to cure. If the breach is not cured within that period, the non-breaching party may terminate this Agreement and the Service Agreement. If cure is not feasible and termination is not feasible, the matter shall be reported to the Secretary.

12Return or Destruction of PHI

Upon termination of this Agreement, Business Associate shall return or securely destroy all PHI received from, or created or received on behalf of, Covered Entity that Business Associate or its Subcontractors maintain, and shall retain no copies. Where return or destruction is not feasible, Business Associate shall extend the protections of this Agreement to the retained PHI and limit further uses and disclosures to those purposes that make return or destruction infeasible, for so long as the PHI is retained. The obligations of this Section survive termination of this Agreement.

13Responsibility and Limitation of Liability

Business Associate is responsible for Breaches and violations resulting from its own acts, omissions, negligence, failure to comply with this Agreement, or violation of applicable law, including those of its Subcontractors. Covered Entity is not responsible for Breaches caused by Business Associate’s acts or omissions. Except where prohibited by law, and except in cases of gross negligence or intentional misconduct, neither party shall be liable to the other for indirect, incidental, consequential, or punitive damages arising out of a Breach. Nothing in this Section limits either party’s obligations under the HIPAA Rules.

14Miscellaneous

Regulatory References & Amendment. A reference to a section of the HIPAA Rules means the section as in effect or as amended. The parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with the HIPAA Rules. Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits compliance with the HIPAA Rules. Governing Law. This Agreement is governed by the HIPAA Rules and, to the extent not preempted, the laws of the State of Florida. No Third-Party Beneficiaries. Nothing in this Agreement confers any rights on any person other than the parties. Counterparts & Electronic Signature. This Agreement may be executed in counterparts and delivered electronically; electronic signatures have the same effect as original signatures. Severability. If any provision is held unenforceable, the remaining provisions remain in full force.