Healthcare CDA Vendor Agreement

HEALTHCARE CDA VENDOR AGREEMENT

Parties and Effective Date

This Healthcare CDA Vendor Agreement ("Agreement") is entered into between:

Effective Date:

Recitals and Definitions

WHEREAS, Provider is a health care entity that creates, maintains and exchanges clinical data in Clinical Document Architecture (CDA) format containing Protected Health Information ("PHI"); and

WHEREAS, Vendor provides services, software, or technology that will create, receive, transmit, transform, store or otherwise process CDA documents on behalf of Provider; and

The following definitions apply for capitalized terms used in this Agreement: "CDA" means Clinical Document Architecture formatted documents conforming to applicable HL7/CDA standards; "PHI" means individually identifiable health information protected under applicable privacy law; "Services" means the activities described in Section 3.

Scope of Services; CDA Specifications

Vendor shall accept, process, transform and return or forward CDA documents only as expressly authorized in writing by Provider. CDA documents provided by Provider shall conform to the CDA implementation guides identified in the technical appendix, and Vendor shall not alter clinical content except as required to perform the Services or as authorized in writing.

Protected Health Information and Permitted Uses

Vendor acknowledges that during performance of the Services it will create, receive, maintain or transmit PHI and agrees to use and disclose PHI only as permitted below and solely to perform the Services.

Safeguards, Security and Compliance

Vendor shall implement and maintain administrative, technical and physical safeguards appropriate to the size and complexity of its operations and the nature of the PHI to protect against reasonably anticipated threats, unauthorized uses or disclosures, and to ensure the confidentiality, integrity and availability of CDA data.

Breach Notification, Mitigation and Remedies

Vendor shall notify Provider without unreasonable delay and in no event later than hours after discovery of any unauthorized use or disclosure of PHI or any security incident affecting CDA data. Notification shall include the nature of the incident, affected records, remedial steps taken and contact information for Vendor's security lead.

Vendor shall cooperate with Provider in mitigation, notification to affected individuals if required, regulatory reporting and root cause analysis. Vendor agrees to indemnify and hold Provider harmless for Vendor's unauthorized acts or omissions related to PHI as provided in the Indemnification section.

Subcontractors and Use of Agents

Vendor may engage subcontractors or agents to perform parts of the Services only with Provider's prior written consent. Vendor shall require each subcontractor to comply with all applicable terms of this Agreement, including confidentiality, security and breach notification obligations.

Data Return and Destruction

Upon termination or expiration of this Agreement, Vendor shall return to Provider all PHI received from Provider, or securely destroy such PHI, at Provider's election. Vendor shall provide written certification of destruction or return within thirty (30) days of Provider's request. If return is infeasible, Vendor shall extend protections and limit further uses until destruction is feasible.

Audit Rights and Inspection

Provider or its designee shall have the right to inspect and audit Vendor's facilities, systems and documentation to verify compliance with this Agreement, subject to reasonable notice and mutually agreed security procedures. Vendor shall cooperate and provide access to logs, policies and personnel reasonably necessary to support such audits.

Insurance, Indemnification and Limitation of Liability

Vendor shall maintain cyber liability and professional liability insurance with limits sufficient for the scope of the Services. Vendor shall indemnify, defend and hold Provider harmless from third party claims arising from Vendor's negligent or willful acts with respect to PHI and CDA processing.

Except for Vendor's indemnification obligations for breaches of PHI, neither party's aggregate liability under this Agreement shall exceed $ unless otherwise required by applicable law.

Term, Termination and Survival

The initial term of this Agreement shall be year(s) and shall automatically renew for successive one-year terms unless either party provides written notice of non-renewal at least thirty (30) days prior to the end of the then-current term. Termination for cause may be effected upon material breach if the breaching party fails to cure within thirty (30) days of written notice.

Survival: Provisions concerning PHI, confidentiality, indemnification, limitation of liability and audit rights shall survive termination or expiration of this Agreement.

HIPAA and Privacy Acknowledgment

Vendor certifies that it will comply with all applicable provisions of federal and state privacy and security laws governing PHI, including requirements equivalent to those imposed on Business Associates. Vendor further certifies that it has policies in place for minimum necessary access, workforce training and breach response.

Notices and Designated Contacts

Authorization Expiration

Unless earlier terminated in accordance with this Agreement, the authorization for Vendor to access and process PHI shall expire on:

Miscellaneous

Governing Law: This Agreement shall be governed by and construed in accordance with the laws of without regard to conflict of law principles.

Amendment: This Agreement may be amended only by a written instrument executed by authorized representatives of both parties.

Additional Terms / Notes

Sign Now