US Privacy Terms: Site Business Associate Agreement

This Business Associate Agreement (this “BAA”) is entered into as of the Effective Date by and between Reify Health, Inc. (hereinafter referred to as “Business Associate”) and the Customer as identified in the Underlying Services Agreement (hereinafter referred to as “Covered Entity”), each individually a “Party” and collectively, the “Parties.”

WHEREAS, the Parties have entered into one or more arrangements pursuant to which Business Associate accesses, receives, maintains, creates, or transmits Personal Health Information (as defined below) for or on behalf of Covered Entity in connection with the provision of services described in the Underlying Services Agreement or in the performance of Business Associate’s obligations under such agreement (“Underlying Services Agreement”);

WHEREAS, both Parties are committed to complying with the Privacy Regulations and the Security Regulations (as such terms are defined below) under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations and guidance issued by the Secretary (as defined below), all as amended from time to time (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act, as incorporated in the American Recovery and Reinvestment Act of 2009, and its implementing regulations and guidance issued by the Secretary, all as amended from time to time (“HITECH Act”) (hereinafter the “HIPAA Standards”); and

WHEREAS, this BAA sets forth the terms and conditions pursuant to which Protected Health Information that is accessed, received, maintained, created, or transmitted by Business Associate from or on behalf of Covered Entity will be handled between Business Associate, and Covered Entity, including third parties, during the term of the Underlying Services Agreement and thereafter.

A. Breach. “Breach” shall mean the acquisition, access, use, or disclosure of unsecured Protected Health Information in a manner not permitted under 45 CFR Part 164 Subpart E which compromises the security or privacy of the Protected Health Information.

B. Business Associate. “Business Associate” shall generally have the same meaning as the term “business associate” at 45 CFR §160.103, and in reference to the party to BAA, shall mean Reify.

C. Covered Entity. “Covered Entity” shall generally have the same meaning as the term “covered entity” at 45 CFR §160.103, and in reference to the party to BAA, shall mean Users (as defined in the Underlying Services Agreement).

D. Individual. "Individual" shall have the same meaning as the term "individual" in 45 CFR § 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR §164.502(g).

E. Privacy Rule "Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR Part 160 and Part 164, Subparts A and E.

F. Protected Health Information "Protected Health Information" shall have the same meaning as the term "protected health information" in 45 CFR §160.103, but shall be limited to the information created or received by Business Associate from or on behalf of Covered Entity.

G. Required By Law. "Required By Law" shall have the same meaning as the term "required by law" in 45 CFR §164.103.

H. Secretary. "Secretary" shall mean the Secretary of the Department of Health and Human Services or his/her designee.

I. Security incident. “Security incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

2. Obligations and Activities of Business Associate

A. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by the Agreement or as Required by Law.

B. To the extent the Business Associate is to carry out, pursuant to the Underlying Services Agreement, a Covered Entity's obligation under this subpart, the Business Associate shall comply with the requirements of 45 CFR Part 164 Subpart E that apply to the Covered Entity in the performance of such obligation.

C. Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by BAA.

D. Business Associate agrees to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic Protected Health Information that it creates, receives, maintains, or transmits on behalf of the Covered Entity, in accordance with the requirements of 45 CFR Part 164 Subpart C, to the extent applicable to Business Associate.  

E. Business Associate is hereby authorized to use Protected Health Information to de-identify the information in accordance with 45 CFR §164.514(a)-(c).

F. Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by BAA of which it becomes aware, including Breaches of unsecured Protected Health Information as required by 45 CFR §164.410 and any Security Incident of which it becomes aware.

G. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity agrees to the same restrictions and conditions that apply through BAA to Business Associate with respect to such information, and that any subcontractors that create, receive, maintain, or transmit electronic protected health information on behalf of the Business Associate agree to comply with the applicable requirements of BAA by entering into a contract or other arrangement that complies with 45 CFR §164.314 and §164.504.

H. Business Associate agrees to provide reasonable access, at the request of Covered Entity, to Protected Health Information in a Designated Record Set, to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR §164.524.

I. Business Associate agrees to make any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR §164.526 at the request of Covered Entity or an Individual or to take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR §164.526.

J. Business Associate agrees to make its internal practices, books, and records, including policies and procedures, relating to its use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity available to the Secretary, in a time and manner designated by the Secretary, for purposes of the Secretary determining Covered Entity's compliance with 45 CFR Parts 160 and 164 and other applicable regulations.

K. Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR §164.528.

L. Business Associate agrees to reasonably provide to Covered Entity or an Individual information collected in accordance with Section 2(k) of BAA, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR §164.528.

3. Permitted Uses and Disclosures by Business Associate

Except as otherwise limited in BAA, Business Associate may use or disclose Protected Health Information as necessary to perform functions, activities, or services for, or on behalf of, Covered Entity as set forth in the Underlying Services Agreement, provided that such use or disclosure would not violate the Privacy Rule if done by Covered Entity or the minimum necessary policies and procedures of the Covered Entity.

4. Specific Use and Disclosure Provisions

A. Except as otherwise limited in BAA, Business Associate may use Protected Health Information for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate.

B. Except as otherwise limited in BAA, Business Associate may disclose Protected Health Information for the proper management and administration of the Business Associate, provided that disclosures are Required By Law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as Required by Law or for the purpose for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

C. Except as otherwise limited in BAA, Business Associate may use Protected Health Information to provide Data Aggregation services to Covered Entity as permitted by 45 CFR §164.504(e)(2)(i)(B).

D. Business Associate may use or disclose Protected Health Information as required by law or to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR §164.502(j)(1).

5. Obligations of Covered Entity

A. Covered Entity shall notify Business Associate of any limitation(s) or changes in its notice of privacy practices of Covered Entity in accordance with 45 CFR §164.520, to the extent that such limitation may affect Business Associate's use or disclosure of Protected Health Information.

B. Covered Entity shall notify Business Associate of any changes in, or revocation of, permission by Individual to use or disclose Protected Health Information, to the extent that such changes or revocation may affect Business Associate's use or disclosure of Protected Health Information.

C. Covered Entity shall notify Business Associate of any restriction to the use or disclosure of Protected Health Information that Covered Entity has agreed to in accordance with 45 CFR §164.522, to the extent that such restriction may affect Business Associate's use or disclosure of Protected Health Information.

D. Covered Entity shall bear any incremental costs of Business Associate’s compliance with any limitations, changes, revocations, or restrictions described in this Section 5 of BAA.

6. Permissible Requests by Covered Entity

Covered Entity shall not request Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under the HIPAA Standards if done by Covered Entity except that this shall not preclude Business Associate from performing the following activities as set forth in Section 4 of BAA: (i) Data Aggregation services as defined at 45 CFR 164.501, (ii) proper management and administration, and (iii) legal responsibilities of the Business Associate.

7. Term and Termination

Covered Entity shall not request Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under the HIPAA Standards if done by Covered Entity except that this shall not preclude Business Associate from performing the following activities as set forth in Section 4 of BAA: (i) Data Aggregation services as defined at 45 CFR 164.501, (ii) proper management and administration, and (iii) legal responsibilities of the Business Associate.

A. Term. The Term of BAA shall commence upon the Effective Date of the Underlying Services Agreement and shall terminate when all of the Protected Health Information provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or, if it is infeasible to return or destroy Protected Health Information, protections are extended to such information, in accordance with the termination provisions in this Section.

8. Miscellaneous

A. Regulatory References. A reference in BAA to a section in the HIPAA Standards means the sections in effect or as amended.

B. Amendment. The Parties agree to take such action as is necessary to amend BAA from time to time as is necessary for compliance with the requirements of the HIPAA Standards and any other applicable law.

C. Reporting of Security Incidents. Consistent with Section 2(f) of BAA, the Parties acknowledge that Business Associate hereby gives notice to Covered Entity of Security Incidents that constitute unsuccessful attempts at unauthorized access, use, disclosure, modification, or destruction of Protected Health Information, such as the interception of encrypted Protected Health Information where the key is not compromised. No additional notice or reporting will be provided by Business Associate for such unsuccessful attempts.

D. Survival. The respective rights and obligations of Business Associate under Section 7(c) of BAA shall survive the termination of BAA.

E. Interpretation. The provisions of BAA shall prevail over any provisions in the Underlying Services Agreement that may conflict or appear inconsistent with regards to the Parties’ compliance obligations under the HIPAA Standards. Any further ambiguity in BAA shall be resolved to facilitate the Parties’ compliance with their respective obligations under the HIPAA Standards.