Business Associate Contract

BUSINESS ASSOCIATE CONTRACT

This Business Associate Contract (the Agreement) is entered into as of Effective Date: by and between Covered Entity: with principal place of business at and Business Associate: with principal place of business at (each a Party and collectively the Parties).

RECITALS

WHEREAS, Covered Entity creates, receives, maintains or transmits individually identifiable health information that is protected under applicable federal and state privacy and security laws (Protected Health Information); and

WHEREAS, Business Associate provides certain services to Covered Entity and, in connection with those services, will create, receive, maintain or transmit Protected Health Information on Covered Entity’s behalf; and

WHEREAS, the Parties intend to comply with applicable privacy and security requirements and to set forth the Parties’ respective rights and obligations with respect to Protected Health Information.

NOW, THEREFORE, in consideration of the mutual promises and covenants contained herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

1. DEFINITIONS

1.1 "Protected Health Information" or "PHI" means individually identifiable health information that is created, received, maintained or transmitted by Business Associate on behalf of Covered Entity, as defined under applicable law.

1.2 "HIPAA Rules" means the standards and requirements of applicable privacy, security and breach notification laws and regulations, as they may be amended from time to time.

1.3 Terms used but not otherwise defined in this Agreement shall have the meanings given them in the HIPAA Rules.

2. PERMITTED USES AND DISCLOSURES

2.1 Business Associate may use or disclose PHI only as necessary to perform the services set forth in the underlying services agreement between the Parties (the Services) or as required by law. Business Associate shall not use or disclose PHI in a manner that would violate the HIPAA Rules if done by Covered Entity.

2.2 Business Associate may de-identify PHI in accordance with the HIPAA Rules and may use and disclose de-identified information without restriction; provided that Business Associate shall not attempt to re-identify de-identified information.

3. OBLIGATIONS OF BUSINESS ASSOCIATE

3.1 Business Associate shall implement and maintain administrative, physical and technical safeguards appropriate to the size and complexity of its operations and the nature of the PHI, to protect against reasonably anticipated threats to the security or integrity of PHI and to prevent unauthorized uses or disclosures.

3.2 Business Associate shall ensure that any agent, including a subcontractor, to whom it provides PHI agrees in writing to the same restrictions and conditions that apply to Business Associate under this Agreement.

3.3 Business Associate shall, without unreasonable delay and in no event later than days after discovery, report to Covered Entity any Security Incident, actual breach of Unsecured PHI, or other unauthorized use or disclosure of PHI. Such report shall include available details to enable Covered Entity to meet its obligations under applicable law.

4. OBLIGATIONS OF COVERED ENTITY

4.1 Covered Entity shall notify Business Associate of any limitations in the notice of privacy practices, restrictions on uses and disclosures of PHI, or revocation of authorization to the extent such limitations may affect Business Associate’s use or disclosure of PHI.

5. SUBCONTRACTORS

Business Associate shall require that any subcontractor that creates, receives, maintains or transmits PHI on behalf of Business Associate agree in writing to the same restrictions, terms and conditions that apply to Business Associate under this Agreement. Business Associate shall remain liable for the acts and omissions of its subcontractors to the same extent Business Associate would be liable for its own acts and omissions.

6. SECURITY AND RISK MANAGEMENT

Business Associate shall (a) implement reasonable and appropriate policies and procedures to address encryption, access controls, authentication, logging and audit trails; (b) conduct periodic risk assessments; and (c) mitigate, to the extent practicable, any harmful effect known to Business Associate resulting from a use or disclosure of PHI in violation of this Agreement.

7. BREACH RESPONSE AND COOPERATION

7.1 Upon discovery of any unauthorized use or disclosure of PHI, Business Associate shall: (a) take immediate steps to contain and mitigate the unauthorized use or disclosure; (b) conduct an investigation and provide Covered Entity with a written report of findings and corrective actions; and (c) reasonably cooperate with Covered Entity in fulfilling Covered Entity’s legal obligations to notify affected individuals and regulators.

8. TERM AND TERMINATION

8.1 Term. This Agreement shall commence on the Effective Date and shall continue for the duration of the Services or until terminated as provided herein.

8.2 Termination for Cause. Covered Entity may terminate this Agreement upon written notice if Covered Entity determines that Business Associate has materially breached a material provision of this Agreement and such breach is not cured within thirty (30) days of written notice.

8.3 Effect of Termination. Upon termination, Business Associate shall return or destroy all PHI received from Covered Entity that Business Associate still maintains in any form. If return or destruction is not feasible, Business Associate shall extend all protections of this Agreement to the PHI and limit further uses and disclosures to those purposes that make the return or destruction infeasible.

9. AUDIT; ACCESS TO RECORDS

Business Associate shall make its internal practices, books and records relating to the use and disclosure of PHI available to Covered Entity and to any government authority for purposes of determining compliance with applicable law, subject to confidentiality protections for Business Associate’s proprietary information.

10. INDEMNIFICATION; INSURANCE

10.1 Indemnification. Business Associate shall indemnify, defend and hold harmless Covered Entity from and against any losses, liabilities, damages, costs and expenses (including reasonable attorneys' fees) arising out of Business Associate’s breach of this Agreement or its negligent or willful misconduct.

10.2 Insurance. Business Associate shall maintain, at its own expense, commercially reasonable liability insurance, including cyber liability coverage appropriate to its size and scope of services, and shall provide evidence of such insurance upon Covered Entity’s request.

11. LIMITATION OF LIABILITY

Except as provided in Section 10.1, neither Party shall be liable to the other for incidental, consequential, special or punitive damages arising out of or related to this Agreement, whether in contract, tort or otherwise, except to the extent such limitation is prohibited by applicable law.

12. NOTICES

Notices shall be in writing and delivered by personal delivery, nationally recognized overnight courier, or registered mail, and shall be effective upon receipt.

13. AMENDMENT; WAIVER; COUNTERPARTS

This Agreement may be amended only by a writing signed by both Parties. The failure of either Party to enforce any provision shall not constitute a waiver of future enforcement. This Agreement may be executed in counterparts, each of which shall be deemed an original.

14. GOVERNING LAW; ENTIRE AGREEMENT; SEVERABILITY

This Agreement shall be governed by and construed in accordance with the laws of the State of without regard to its conflict of laws principles. This Agreement, together with any referenced exhibits or schedules, constitutes the entire agreement between the Parties with respect to the subject matter hereof. If any provision is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.

15. MISCELLANEOUS

15.1 Interpretation. Headings are for convenience only and shall not affect interpretation. The singular includes the plural and vice versa.

15.2 Survival. The respective rights and obligations of the Parties under Sections 3, 7, 8.3, 9, 10 and 14 shall survive termination of this Agreement.

Sign Now