Healthcare Networking TSA

HEALTHCARE NETWORKING TECHNOLOGY SERVICES AGREEMENT (TSA)

This Technology Services Agreement ("Agreement") is entered into between Healthcare Provider Name: (referred to as "Provider") and Network Service Provider Name: (referred to as "Network Provider") effective on Agreement Date: .

RECITALS

WHEREAS, Provider operates healthcare facilities and systems that create, maintain and transmit protected health information ("PHI"); and WHEREAS, Network Provider will provide network connectivity, managed networking services, and related technical services that may permit access to systems containing PHI; and WHEREAS, the parties desire to set forth their respective obligations with respect to the provision, security, and permitted uses of network services and any PHI accessible in connection with those services.

DEFINITIONS

For purposes of this Agreement: "PHI" means individually identifiable health information as defined under applicable law. "Services" means the network design, installation, monitoring, maintenance, and related managed services described in the Scope of Services. "Business Associate" means Network Provider with respect to any PHI to which Network Provider has access under this Agreement.

SCOPE OF SERVICES

Network Provider shall provide the Services described below. Services shall include all labor, hardware, software configuration, documentation, testing and training necessary to deliver operational connectivity and secure exchange of data between Provider systems and authorized third parties.

SECURITY, PRIVACY AND HIPAA COMPLIANCE

The parties acknowledge that Network Provider, as a Business Associate, must implement administrative, physical and technical safeguards to protect the confidentiality, integrity and availability of PHI in accordance with applicable law.

Network Provider shall: (a) use industry-standard encryption for data in transit and at rest when storing or transmitting PHI; (b) maintain role-based access controls and logging; (c) promptly apply security patches; and (d) make available audit logs and evidence of compliance upon Provider request, subject to reasonable notice and confidentiality protections.

DATA USE, OWNERSHIP, AND DE-IDENTIFICATION

Provider retains ownership of all PHI and other patient data. Network Provider may only use and disclose PHI as necessary to perform Services or as otherwise required by law. Unless expressly authorized in writing, Network Provider shall not de-identify, aggregate or otherwise use PHI for any other purpose.

BREACH NOTIFICATION AND REMEDIATION

Network Provider shall notify Provider without unreasonable delay and no later than 72 hours after discovery of any security incident or unauthorized access to PHI. Notification shall include a description of the incident, affected data elements, remediation steps taken, and plans for preventing recurrence. Network Provider shall cooperate with Provider in breach response, mitigation, regulatory reporting and notification to individuals when required.

AUDIT, MONITORING AND INSPECTION

Provider may, upon reasonable notice and during normal business hours, audit Network Provider's policies, procedures and facilities to verify compliance with this Agreement. Network Provider shall provide documentation, log exports, and reasonable access to facilities and personnel to permit such audits while preserving confidentiality and security of other customers' information.

FEES, INVOICING AND PAYMENT

Provider shall pay Network Provider fees for Services as set forth in a separate Statement of Work or fee schedule incorporated by reference. Unless otherwise agreed, invoices are due within thirty (30) days of receipt. Disputed charges shall be promptly notified in writing and the parties shall cooperate to resolve disputes in good faith.

TERM, TERMINATION, AND TRANSITION

This Agreement commences on the effective date and continues for the initial term specified in the applicable Statement of Work. Either party may terminate for material breach if the breach remains uncured thirty (30) days after written notice. Upon termination, Network Provider shall return or destroy PHI at Provider's direction and provide a final export of data in a mutually agreed machine-readable format, subject to payment of outstanding charges.

INDEMNIFICATION, LIMITATION OF LIABILITY, AND INSURANCE

Each party shall indemnify the other for third-party claims arising from its negligence or willful misconduct. Network Provider shall maintain insurance coverages appropriate for provision of the Services, including cyber liability and professional liability insurance, and shall provide certificates upon request. Neither party shall be liable to the other for consequential damages except for claims relating to unauthorized disclosure of PHI or willful misconduct.

GOVERNING LAW; DISPUTE RESOLUTION

This Agreement shall be governed by the laws specified by Provider State or jurisdiction: , without regard to conflict of law principles. The parties shall attempt to resolve disputes by good faith negotiation before pursuing arbitration or litigation.

NOTICES

PATIENT DATA ACCESS, TESTING AND AUTHORIZATIONS

Provider may designate limited patient data or synthetic/de-identified records for network testing. Network Provider shall not use live PHI for testing except with explicit written authorization and appropriate safeguards. The following fields identify a designated test or liaison contact for purposes of network onboarding and testing.

Provider affirms that any patient data provided for testing and onboarding has been de-identified in accordance with applicable law and that Provider has the authority to supply such data.

REPRESENTATIONS AND WARRANTIES

Each party represents that it has the full right, power and authority to enter into this Agreement and to perform its obligations. Network Provider warrants that Services shall be performed in a professional manner in accordance with industry standards and applicable legal requirements relating to privacy and security of PHI.

CONFIDENTIALITY

Each party shall protect the other's confidential information, including PHI and security controls, and shall not disclose such information except as required to perform Services or as required by law. Confidential information shall be protected using at least the same degree of care as the receiving party uses to protect its own confidential information, but in no event less than a reasonable standard of care.

MISCELLANEOUS

This Agreement, together with any Statements of Work and exhibits, constitutes the entire agreement between the parties with respect to the subject matter and supersedes prior agreements. Amendments must be in writing and signed by authorized representatives of both parties.

Sign Now