This Business Associate Agreement (“BAA”) is entered into effective this _ day of ____, 2023 (“Effective Date”) by and between __________ (“Covered Entity”) and OhMD, Inc. (“Business Associate”) (each a “Party” and collectively, the “Parties”).
WHEREAS, Business Associate performs certain services for or on behalf of Covered Entity, and in performing said services, Business Associate creates, receives, maintains, or transmits Protected Health Information (“PHI”);
WHEREAS, the Parties intend to protect the privacy and provide for the security of the PHI Disclosed (as defined below) by Covered Entity to Business Associate, or created, received, maintained, or transmitted by Business Associate, when providing services. Such PHI will be protected in compliance with the Health Insurance Portability and Accountability Act (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (Public Law 111-005) (the “HITECH Act”) and its implementing regulations and guidance issued by the Secretary of the U.S. Department of Health and Human Services (“Secretary”) (collectively, the “HIPAA Regulations”); and
WHEREAS, Covered Entity is required under the HIPAA Regulations to enter into a Business Associate Agreement that meets certain requirements with respect to the Use (as defined below) and Disclosure of PHI, which are met by this BAA. Accordingly, to the extent Business Associate is functioning as a “business associate” as defined in the HIPAA Regulations, Business Associate agrees to comply with this BAA.
In consideration of the Recitals and for other good and valuable consideration, the receipt and adequacy of which is hereby acknowledged, the Parties agree as follows:
The following terms shall have the respective meanings set forth below. Capitalized terms used in this BAA and not otherwise defined shall have the meanings ascribed to them in the HIPAA Regulations.
1.1. “Breach” shall have the meaning given to such term under 45 C.F.R. § 164.402.
1.2. “Designated Record Set” shall have the meaning given to such term under 45 C.F.R. § 164.501.
1.3. “Disclose” and “Disclosure” mean, with respect to PHI, the release, transfer, provision of access to, or divulging in any other manner of PHI outside of Business Associate or to other than members of its workforce, as set forth in 45 C.F.R. § 160.103.
1.4. “Electronic PHI” or “e-PHI” means PHI that is transmitted or maintained in electronic media, as set forth in 45 C.F.R. § 160.103.
1.5. “Protected Health Information” and “PHI” mean any information, whether oral or recorded in any form or medium, provided by Covered Entity to Business Associate, that: (a) relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual, or the past, present or future payment for the provision of health care to an individual; (b) identifies the individual (or for which there is a reasonable basis for believing that the information can be used to identify the individual); and (c) shall have the meaning given to such term under 45 C.F.R. § 160.103. Protected Health Information includes e-PHI.
1.6. “Required by Law” shall have the meaning given to such term under 45 C.F.R. § 164.103.
1.7. “Security Incident” shall have the meaning given to such term under 45 C.F.R. § 164.304.
1.8. “Services” shall mean the services or functions performed by Business Associate for or on behalf of Covered Entity pursuant to any service agreement(s) between Covered Entity and Business Associate which may be in effect now or from time to time (“Underlying Agreement”), or, if no such agreement is in effect, the services or functions performed by Business Associate that constitute a “business associate” relationship, as set forth in 45 C.F.R. § 160.103.
1.9. “Unsecured PHI” shall have the meaning given to such term under 42 U.S.C. § 17932(h), 45 C.F.R. § 164.402, and guidance issued pursuant to the HITECH Act including, but not limited to the guidance issued on April 17, 2009 and published in 74 Federal Register 19006 (April 27, 2009) by the Secretary.
1.10. “Use” or “Uses” mean, with respect to PHI, the sharing, employment, application, utilization, examination or analysis of such PHI within Business Associate’s internal operations, as set forth in 45 C.F.R. § 160.103.
OBLIGATIONS OF BUSINESS ASSOCIATE
2.1. Permitted Uses and Disclosures of PHI. Business Associate shall not Use or Disclose PHI created, received, maintained, or transmitted for or on behalf of Covered Entity except to perform the Services required by the Underlying Agreement, or as permitted by this BAA or Required by Law. Business Associate shall not Use or Disclose PHI in any manner that would constitute a violation of the HIPAA Regulations if so Used or Disclosed by Covered Entity. Without limiting the generality of the foregoing, Business Associate is permitted to (i) Use and Disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided that with respect to any such Disclosure either: (a) the Disclosure is Required by Law; or (b) Business Associate obtains agreement from the person to whom the PHI is to be Disclosed that such person will hold the PHI in confidence and will not Use or further Disclose such PHI except as Required by Law and for the purpose(s) for which it was Disclosed by Business Associate to such person, and that such person will notify Business Associate of any instances of which it is aware in which the confidentiality of the PHI has been breached; (ii) Use PHI for Data Aggregation purposes in connection with the Health Care Operations of Covered Entity; and (iii) Use PHI to create de-identified information in accordance with the requirements outlined in the HIPAA Regulations. Data that has been de-identified will no longer be subject to the terms of this BAA.
2.2. Adequate Safeguards of PHI. Business Associate agrees to use appropriate safeguards and comply, where applicable, with Subpart C of 45 C.F.R. Part 164 with respect to e-PHI, to prevent use or disclosure of the information other than as provided for by this BAA.
2.3. Mitigation. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in violation of the requirements of this BAA.
2.4. Reporting Breaches, Security Incidents, and Non-Permitted Uses or Disclosures. Business Associate shall notify Covered Entity of any Use or Disclosure by Business Associate or its Subcontractors that is not permitted by this BAA and each Security Incident, including Breaches of Unsecured PHI, within five (5) business days of discovery. Notwithstanding the foregoing, Business Associate and Covered Entity acknowledge the ongoing existence and occurrence of attempted but ineffective Security Incidents that are trivial in nature, such as pings and other broadcast service attacks, and Covered Entity acknowledges and agrees that no additional notification to Covered Entity of such ineffective Security Incidents is required, as long as no such incident results in unauthorized access, Use or Disclosure of PHI. If Business Associate determines that a Breach of Unsecured PHI has occurred, Business Associate shall provide a written report to Covered Entity without unreasonable delay and no later than thirty (30) calendar days after discovery of the Breach. To the extent that information is available to Business Associate, Business Associate’s written report to Covered Entity shall be in accordance with 45 C.F.R. § 164.410(c).
2.5. Delegated Responsibilities. To the extent that Business Associate carries out one or more of Covered Entity’s obligations under Subpart E of 45 C.F.R. Part 164, Business Associate must comply with the requirements of Subpart E that apply to Covered Entities in the performance of such obligations.
2.6. Availability of Internal Practices, Books, and Records to Government. Business Associate agrees to make its internal practices, books and records relating to the Use and Disclosure of Covered Entity’s PHI available to the Secretary for purposes of determining Covered Entity’s compliance with the HIPAA Regulations.
2.7. Access to and Amendment of Protected Health Information. To the extent that Business Associate maintains a Designated Record Set on behalf of Covered Entity, Business Associate shall (i) make the PHI it maintains (or which is maintained by its Subcontractors) in such Designated Record Set available to Covered Entity for inspection and copying to enable Covered Entity to fulfill its obligations under 45 C.F.R. § 164.524 within fifteen (15) business days of a written request by Covered Entity; and (ii) amend the PHI it maintains (or which is maintained by its Subcontractors) in such Designated Record Sets to enable the Covered Entity to fulfill its obligations under 45 C.F.R. § 164.526 within fifteen (15) business days of a written request by Covered Entity.
2.8. Accounting. Business Associate agrees to document such disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528. Business Associate shall provide to Covered Entity or, at the request of Covered Entity directly to an individual, in the time and manner designated by Covered Entity, but in no event longer than fifteen (15) days after Business Associate’s receipt of a written request from Covered Entity, information collected in accordance this Section 2.8 of this BAA, to permit Covered Entity to respond to a request by an individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528.
2.9. Use of Subcontractors. Business Associate shall require each of its Subcontractors that creates, receives, maintains, or transmits PHI on behalf of Business Associate, to execute a written agreement that includes substantially the same restrictions and conditions that apply to Business Associate under this BAA with respect to PHI.
2.10. Minimum Necessary. Business Associate (and its Subcontractors) shall, to the extent practicable, limit its request, Use, or Disclosure of PHI to the minimum amount of PHI necessary to accomplish the purpose of the request, Use or Disclosure, in accordance with 42 U.S.C. § 17935(b) and 45 C.F.R. § 164.502(b)(1) or any other guidance issued thereunder.
TERM AND TERMINATION
3.1. Term. The term of this BAA shall be effective as of the Effective Date and shall remain in effect until all of the PHI provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or, if it is infeasible to return or destroy PHI, protections are extended to such information, in accordance with Section 3.3.
3.2. Termination for Cause. In addition to and notwithstanding the termination provisions set forth in any Underlying Agreement, upon Covered Entity’s or Business Associate’s knowledge of a material breach or violation of this BAA by the other Party, the non-breaching Party shall notify the breaching Party of the breach in writing, and provide an opportunity for the breaching Party to cure the breach or end the violation within thirty (30) days of such notification; provided that if the breaching Party fails to cure the breach or end the violation within such time period to the satisfaction of the non-breaching Party, the non-breaching Party may immediately terminate this BAA upon written notice to the breaching Party.
3.3. Disposition of PHI Upon Termination. Upon termination or expiration of this BAA, Business Associate shall either return or destroy all PHI received from, or created or received by Business Associate on behalf of Covered Entity, that Business Associate still maintains in any form and retain no copies of such PHI. If return or destruction is not feasible, Business Associate shall continue to extend the protections of this BAA to the PHI for as long as Business Associate retains the PHI and limit further Uses and Disclosures of such PHI to those purposes that make the return or destruction of the PHI infeasible.
4.1. Covered Entity’s Obligations. Covered Entity shall notify Business Associate in writing of any of the following, to the extent that such limitation, change, revocation, or restriction may affect Business Associate’s Use or Disclosure of PHI: (i) any limitation(s) in Covered Entity’s notice of privacy practices; (ii) any changes in, or revocation of, permission by an individual to Use or Disclose PHI; or (iii) any restriction to the Use or Disclosure of PHI that Covered Entity has agreed to in accordance with 45 C.F.R. § 164.522. Covered Entity will obtain any consent or authorization that may be required by the HIPAA Regulations or other applicable law for Business Associate to provide the Services prior to furnishing Business Associate with PHI.
4.2. Amendment to Comply with Law. To the extent applicable, amendments or modification to the HIPAA Regulations may require amendments to certain provisions of this BAA. Amendments shall only be effective if executed in writing and signed by a duly authorized representative of each Party.
4.3. Relationship to Underlying Agreement Provisions. In the event that a provision of this BAA is contrary to a provision of an Underlying Agreement, the provision of this BAA shall control. Otherwise, this BAA shall be construed under, and in accordance with, the terms of such Underlying Agreement, and shall be considered an amendment of and supplement to such Underlying Agreement.
4.4. Notices. Any notices or communications hereunder shall be (i) if provided to Business Associate, made via email to firstname.lastname@example.org; or (ii) if made to Covered Entity, made in accordance with the notice provisions of any Underlying Agreement.
4.5. Relationship of Parties. Notwithstanding anything to the contrary in any Underlying Agreement, Business Associate is an independent contractor and not an agent of Covered Entity under this BAA. Business Associate has the sole right and obligation to supervise, manage, contract, direct, procure, perform or cause to be performed all Business Associate obligations under this BAA.
4.6. Interpretation. This BAA shall be interpreted as broadly as necessary to implement and comply with the HIPAA Regulations. The Parties agree that any ambiguity in this BAA shall be resolved in favor of a meaning that complies and is consistent with such laws and regulations.
4.7. Regulatory References. A reference in this BAA to a section in the HIPAA Regulations means the section as in effect or as amended, and for which compliance is required.
4.8. No Third Party Beneficiaries. Nothing express or implied in this BAA is intended to confer, nor shall anything herein confer, upon any person other than the Parties and the respective successors or assigns of the Parties, any rights, remedies, obligations, or liabilities whatsoever.
4.9. Counterparts; Electronic Signatures. This BAA may be executed in one or more counterparts, all of which together shall constitute only one agreement. If any signature is delivered by facsimile or email or is signed in any electronic format, such signature shall create a valid and binding obligation with the same force and effect as if such signature were handwritten.
The Parties hereto have executed this BAA as of the Effective Date.
By: Ethan Bechtel
Dated: May 15, 2023
For COVERED ENTITY: _____________