Healthcare Managed Azure Services Addendum

HEALTHCARE MANAGED AZURE SERVICES ADDENDUM

Parties and Effective Date

This Addendum is entered into as of Effective Date: by and between Client Name: (hereafter "Client" or "Covered Entity"), and Provider Name: (hereafter "Provider" or "Business Associate").

Recitals

WHEREAS, Client and Provider are parties to a Services Agreement under which Provider provides cloud infrastructure and managed services; and

WHEREAS, the parties desire that Provider deliver Managed Azure Services supporting Client's healthcare operations and Protected Health Information ("PHI") in compliance with applicable law and the terms of this Addendum.

Definitions

For purposes of this Addendum, the following terms have the following meanings:

"PHI" means individually identifiable health information created, received, maintained or transmitted by Client that is protected under HIPAA; "ePHI" means PHI in electronic form; "Azure Services" means cloud infrastructure, platform and managed services provided by Provider on Microsoft Azure infrastructure as described in Scope of Services.

Scope of Services

Security, Privacy and HIPAA Compliance

Provider shall implement and maintain administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of ePHI in accordance with HIPAA, the HIPAA Security Rule, and all Applicable Law. Provider's obligations include, at minimum, the measures described below.

Provider will ensure encryption of ePHI at rest and in transit using industry-standard cryptographic protocols. Encryption-at-rest standard:

Provider will enforce least-privilege access, role-based access control, multi-factor authentication where supported, and maintain an access log. MFA required: Yes

Backup frequency:   Retention period (days):

Business Associate Obligations

Provider acknowledges it is a Business Associate with respect to PHI and agrees to comply with the following obligations: use or disclose PHI only as permitted by this Addendum or agreement; implement safeguards; report security incidents; assist Client with patient access requests; and ensure that any subcontractors agree in writing to the same restrictions and conditions.

Incident Response and Breach Notification

Provider shall notify Client of any Security Incident or unauthorized disclosure of PHI without unreasonable delay and, in any event, within hours of discovery. Notification shall include nature of the incident, PHI involved, actions taken, and remediation steps.

Provider will investigate, mitigate and remediate incidents at Provider's expense and will cooperate with Client in notification and regulatory compliance. Provider shall indemnify Client for costs arising from Provider's breach of obligations to protect PHI as set forth below.

Audit Rights and Recordkeeping

Client may audit Provider's controls and compliance with respect to PHI subject to reasonable notice. Audit notice period (days): Provider shall maintain records sufficient to demonstrate compliance for a period of

Service Levels and Availability

Provider will use commercially reasonable efforts to meet the following service levels for Azure Services: Uptime Target: . Service credits, measurement and exclusions shall be as set forth in the Services Agreement and this Addendum.

Fees and Invoicing

Term, Termination and Transition

Term of this Addendum shall coincide with the Services Agreement term unless earlier terminated according to that Agreement or as set forth below. Upon termination, Provider shall, at Client's election, return all PHI in a structured and commonly used electronic format or securely destroy such PHI within days and certify destruction.

Representations, Warranties, Indemnity and Insurance

Provider represents and warrants that it will perform services in a professional manner and in compliance with Applicable Law. Provider shall indemnify and hold harmless Client from liabilities arising from Provider's negligent or willful failure to safeguard PHI or to comply with this Addendum. Provider shall maintain cyber and professional liability insurance with limits of not less than .

Limitation of Liability

Except for indemnification obligations or breaches involving unauthorized disclosure of PHI, the parties' liability is limited as set forth in the Services Agreement. Notwithstanding anything to the contrary, neither party excludes liability for gross negligence or willful misconduct.

Data Ownership and Use Restrictions

Client retains ownership of all PHI and other Client Data. Provider will not use, access, process, or disclose Client Data except to provide the Services or as required by law, and only upon prior notice to Client when legally permissible.

Notices

Governing Law and Dispute Resolution

This Addendum shall be governed by the laws of the state of , without regard to choice of law rules. Parties will attempt resolution through good faith negotiation prior to litigation.

Miscellaneous

This Addendum supplements and is incorporated into the Services Agreement. To the extent of any conflict between this Addendum and the Services Agreement with respect to PHI, the terms of this Addendum control. Any amendments must be in writing and signed by authorized representatives of both parties.

Acknowledgments

The undersigned represent and warrant that they are duly authorized to execute this Addendum on behalf of the party for which they sign.

Sign Now