Healthcare MIS Agreement

HEALTHCARE MIS AGREEMENT

Agreement Date:

This Healthcare MIS Agreement (the Agreement) is entered into by and between:

Healthcare Provider (Covered Entity):    Address:

MIS Vendor (Business Associate):    Address:

RECITALS

WHEREAS, Provider maintains protected health information (PHI) in electronic and tangible form and requires electronic management, storage, reporting and related information technology services; and

WHEREAS, Vendor provides Management Information System services (MIS Services) and will have access to PHI and other confidential information in connection with performing the services described herein; and

NOW, THEREFORE, in consideration of the mutual covenants set forth below, the parties agree as follows:

DEFINITIONS

"Protected Health Information" or "PHI" means individually identifiable health information, as defined under applicable law and federal privacy rules, whether electronic, oral or written, created or received by Vendor on behalf of Provider.

"Services" means the MIS Services described in Section: Scope of Services and any related technical, administrative, or support services performed by Vendor that involve access to PHI.

SCOPE OF SERVICES

DATA ACCESS, USE AND DISCLOSURE

Vendor shall access, use and disclose PHI only as necessary to perform the Services specified in this Agreement, consistent with Provider's written instructions and in compliance with applicable privacy laws. Vendor shall not use PHI for its own purposes, marketing, sale, or other activities not expressly authorized by Provider.

SECURITY AND TECHNICAL SAFEGUARDS

Vendor shall implement and maintain administrative, physical and technical safeguards sufficient to protect the confidentiality, integrity and availability of PHI as required by applicable law.

  Access controls and role-based authentication
  Encryption of PHI in transit and at rest
  Audit logging and access monitoring
  Vulnerability management and patching program

HIPAA COMPLIANCE AND BREACH NOTIFICATION

Vendor, to the extent it constitutes a Business Associate under applicable law, agrees to comply with all Business Associate obligations, including but not limited to: implementing policies required by federal privacy and security regulations, entering into appropriate agreements with subcontractors, and reporting Security Incidents and Breaches.

Upon discovery of a Breach or Security Incident affecting Provider PHI, Vendor shall notify Provider without unreasonable delay and in no event later than the timeframe stated above. Notification shall include the nature of the event, PHI affected, corrective actions taken, and mitigation steps.

DATA RETENTION, RETURN AND DESTRUCTION

Vendor shall retain PHI only for the period necessary to perform the Services or as required by law. Upon termination or expiration of this Agreement, Vendor shall return all PHI to Provider or, at Provider's election, securely destroy PHI and certify destruction in writing.

AUDIT RIGHTS AND REPORTING

Provider has the right to audit Vendor's compliance with the terms of this Agreement, including technical controls and policies. Audits shall be conducted upon reasonable notice and in a manner that minimizes disruption to Vendor operations. Vendor shall provide reasonable access to logs, policies, and personnel.

CONFIDENTIALITY, OWNERSHIP AND USE OF DATA

All PHI and Provider confidential information shall remain Provider property. Vendor acquires no rights in PHI, and any aggregated, de-identified data derived from PHI may not be used in a manner that permits re-identification unless expressly permitted in writing by Provider and in compliance with law.

INDEMNIFICATION AND LIMITATION OF LIABILITY

Each party shall indemnify, defend and hold harmless the other party from claims arising from its breach of this Agreement or its gross negligence. Vendor's aggregate liability for direct damages arising from a breach of this Agreement shall be limited to the greater of actual direct damages or the total fees paid by Provider to Vendor under this Agreement in the preceding 12 months; neither party shall be liable for special, incidental, punitive or consequential damages.

TERM AND TERMINATION

This Agreement shall commence on the Agreement Date and continue for the term set forth below, unless earlier terminated for material breach or as otherwise provided herein.

FEES AND PAYMENT

NOTICES

MISCELLANEOUS

Governing Law: The internal laws of the state specified below shall govern this Agreement without regard to conflict of laws provisions.

Authorization Expiration Date (if applicable):

AUTHORIZED CONTACTS

ATTESTATIONS

Vendor attests that it will: (a) implement safeguards required by applicable law; (b) ensure that any subcontractor to which it discloses PHI agrees in writing to the same restrictions and conditions that apply to Vendor; and (c) make available information necessary for Provider to comply with individual rights requests and oversight obligations.

  Vendor will obtain written agreements from subcontractors that include Business Associate obligations substantially similar to this Agreement.

Sign Now