Business MSA BAA Agreement

MASTER SERVICES AGREEMENT AND BUSINESS ASSOCIATE AGREEMENT

This Master Services Agreement and Business Associate Agreement (the Agreement) is entered into as of Effective Date: by and between Provider Name: , with principal place of business at , and Client Name: , with principal place of business at .

RECITALS

WHEREAS, Provider is in the business of providing services described herein and certain administrative, technical and professional services that may require access to Protected Health Information as defined below; and

WHEREAS, Client is a Covered Entity under applicable health information privacy law and desires to engage Provider to perform services and to permit Provider to create, receive, maintain or transmit Protected Health Information on Client’s behalf; and

WHEREAS, the parties intend to establish the terms under which Provider will perform services and will handle Protected Health Information, and to allocate rights, duties, and liabilities between them.

NOW, THEREFORE, in consideration of the mutual covenants and promises set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:

1. DEFINITIONS

For purposes of this Agreement, the following terms shall have the meanings set forth below. Terms not otherwise defined in this Agreement shall have the meanings given to them under applicable law.

"Services" means the services to be provided by Provider to Client as described in a Statement of Work executed by the parties. A description of the initial Services is set forth below:

"Protected Health Information" or "PHI" shall have the meaning ascribed under applicable health information privacy law and includes any information created, received, maintained or transmitted by Provider on behalf of Client that relates to the past, present or future physical or mental health of an individual, the provision of health care, or payment for health care.

2. SERVICES; STATEMENT OF WORK

Provider shall perform the Services in accordance with the terms of this Agreement and any Statement of Work executed by the parties. Each Statement of Work shall reference this Agreement and shall describe the scope, deliverables, schedule, fees and performance standards applicable to the Services described therein.

3. TERM AND TERMINATION

The term of this Agreement shall commence on the Effective Date and continue for an initial term of months, unless earlier terminated as provided herein. Thereafter this Agreement shall automatically renew for successive one-year periods unless either party provides written notice of non-renewal at least days prior to the end of the then-current term.

Either party may terminate this Agreement for material breach by the other party if such breach is not cured within days after receipt of written notice specifying the breach. Client may terminate immediately if Provider commits an unremediable breach of the obligations applicable to PHI under this Agreement.

4. FEES AND PAYMENT

Client shall pay Provider the fees set forth in each applicable Statement of Work. Unless otherwise agreed, invoices are due and payable within days of invoice receipt. Overdue amounts shall bear interest at the lesser of 1.5% per month or the maximum rate permitted by law.

5. CONFIDENTIALITY

Each party agrees to maintain the confidentiality of Confidential Information disclosed by the other party and to use such information only to perform its obligations under this Agreement. "Confidential Information" includes all non-public business or technical information, and PHI to the extent applicable, disclosed by one party to the other. The receiving party shall use at least the same degree of care to protect Confidential Information as it uses to protect its own confidential information, but in no event less than reasonable care.

6. BUSINESS ASSOCIATE OBLIGATIONS (PHI)

Provider acknowledges that it is a Business Associate of Client with respect to PHI created, received, maintained or transmitted on behalf of Client. Provider agrees:

1. To use or disclose PHI only as permitted by this Agreement and as required by law, and to limit uses and disclosures to the minimum necessary to accomplish the permitted purpose.
2. To implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of PHI, including, at a minimum, the measures described below and any additional safeguards set forth in applicable Statement(s) of Work.
3. To report to Client any use or disclosure of PHI not permitted by this Agreement, including any security incident or breach of unsecured PHI, within calendar days of discovery, providing sufficient information to enable Client to meet its obligations under law.
4. To ensure that any subcontractor or agent to whom Provider delegates functions involving PHI agrees in writing to implement safeguards and comply with the same restrictions and conditions that apply to Provider under this Agreement.

Provider shall permit access by Client or an authorized auditor to records and facilities reasonably necessary to verify Provider’s compliance with this Agreement, subject to reasonable confidentiality protections for Provider’s other confidential information.

7. PERMITTED USES AND DISCLOSURES

Provider may use PHI only to perform the Services specified in this Agreement and as otherwise permitted by law. Provider shall not use PHI for its own independent operations, marketing, data aggregation or any other purpose not expressly authorized by Client in writing.

8. SECURITY AND DATA PROTECTION

Provider represents that it maintains administrative, physical and technical safeguards appropriate to the size and complexity of Provider’s operations and the nature of the PHI, including but not limited to encryption of PHI in transit and at rest, access controls, audit logs, vulnerability management and incident response procedures.

Provider will notify Client promptly upon becoming aware of any security incident involving PHI and will cooperate in good faith with Client to investigate, remediate and provide required notices to affected individuals and regulators as appropriate.

9. SUBCONTRACTORS

Provider may engage subcontractors to perform functions on its behalf that involve PHI only with Client’s prior written consent. Provider shall obtain satisfactory assurances from each subcontractor by written contract that the subcontractor will comply with the same restrictions and conditions that apply to Provider under this Agreement.

Subcontractors authorized by Client (list names or indicate none):

10. REPRESENTATIONS AND WARRANTIES

Each party represents and warrants that it has the full power and authority to enter into this Agreement and to perform its obligations hereunder, and that its performance will not violate any agreement or legal obligation applicable to it. Provider further warrants that it will perform Services in a professional and workmanlike manner in accordance with industry standards.

11. INDEMNIFICATION

Each party shall indemnify, defend and hold harmless the other party from and against any third-party claims, damages, losses and expenses (including reasonable attorneys’ fees) arising out of the indemnifying party’s breach of this Agreement, negligence, willful misconduct or violation of law, provided that the indemnified party gives prompt written notice of any claim and cooperates in the defense.

12. LIMITATION OF LIABILITY

Except for liability arising from breaches of confidentiality, intentional misconduct, gross negligence, or indemnification obligations, neither party shall be liable to the other for consequential, incidental, special or punitive damages, and aggregate liability for direct damages shall be limited to the total fees paid by Client to Provider under the applicable Statement of Work in the twelve (12) months preceding the event giving rise to the claim.

13. INSURANCE

Provider shall maintain commercially reasonable insurance coverage, including general liability, professional liability and cyber liability insurance as appropriate to the services provided. Upon request, Provider shall provide certificates of insurance evidencing the required coverage.

14. NOTICES

All notices required or permitted under this Agreement shall be in writing and shall be delivered to the addresses set forth below or to such other address as a party may designate by notice in accordance with this Section.

15. AUDIT AND RECORDKEEPING

Provider shall maintain records sufficient to demonstrate compliance with this Agreement and applicable law. Provider shall make such records available to Client or its designee for inspection and copying upon reasonable notice, and shall cooperate with audits related to PHI and security compliance.

16. GOVERNING LAW; VENUE

This Agreement shall be governed by and construed in accordance with the laws of the state identified below without regard to its conflicts of law principles. The parties submit to the exclusive jurisdiction of the state and federal courts located in that state for any dispute arising under this Agreement.

Governing State:

17. ENTIRE AGREEMENT; SEVERABILITY; AMENDMENTS

This Agreement, together with any Statements of Work and exhibits expressly incorporated herein, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements and understandings, whether written or oral. If any provision of this Agreement is held invalid or unenforceable, the remaining provisions shall remain in full force and effect. No amendment to this Agreement shall be effective unless in writing and signed by authorized representatives of both parties.

18. WAIVER; COUNTERPARTS

No failure or delay by either party in exercising any right under this Agreement shall constitute a waiver of that right. This Agreement may be executed in counterparts, each of which shall be deemed an original, and all of which together shall constitute one and the same instrument. Electronically transmitted signatures shall have the same force and effect as original signatures.

19. SURVIVAL

The obligations of the parties under Sections relating to Confidentiality, PHI handling, indemnification, limitation of liability and any other provisions that by their nature should survive termination shall survive expiration or termination of this Agreement for the period required by law or as otherwise stated herein.

20. CONTACTS FOR SECURITY BREACH AND HIPAA MATTERS

21. MISCELLANEOUS PROVISIONS

The parties acknowledge that Provider may develop or utilize generalized methodologies, processes, know-how and software that are not specific to Client’s Confidential Information and that such items shall remain the sole property of Provider. Any preexisting materials, inventions or tools owned by a party remain the property of that party.

Sign Now