HITRUST Healthcare Addendum

HITRUST HEALTHCARE ADDENDUM

This HITRUST Healthcare Addendum (the Addendum) is entered into by and between Covered Entity Name: and Business Associate Name: . Effective Date:

RECITALS

WHEREAS, Covered Entity and Business Associate are parties to an agreement governing the handling of protected health information; and

WHEREAS, the parties desire to impose additional information security and privacy obligations consistent with HITRUST requirements and applicable law to protect the confidentiality, integrity and availability of Protected Health Information (PHI).

DEFINITIONS

For purposes of this Addendum, terms shall have the meanings set forth in the underlying agreement. In addition:

"HITRUST" means the HITRUST Common Security Framework and associated certification requirements. "PHI" means protected health information as defined by applicable law.

SCOPE OF ADDENDUM

This Addendum supplements the parties' underlying agreement and applies to all PHI accessed, created, received, maintained, transmitted, or stored by Business Associate on behalf of Covered Entity in connection with services provided under the underlying agreement.

PATIENT INFORMATION (IF APPLICABLE)

INSURANCE INFORMATION

MEDICAL HISTORY

DATA SECURITY AND HITRUST REQUIREMENTS

Business Associate shall implement and maintain administrative, physical and technical safeguards consistent with HITRUST requirements and applicable law to protect PHI. Business Associate shall, at minimum:

• Maintain risk assessments and remediation plans, including regular vulnerability scanning and penetration testing;
• Implement role-based access controls, multifactor authentication for privileged access, and logging sufficient to support incident investigations;
• Encrypt PHI in transit and at rest where technically feasible;
• Maintain an incident response program that includes notification procedures to Covered Entity;
• Apply secure change management and patching practices to systems that store or process PHI.

BREACH NOTIFICATION AND REMEDIATION

Business Associate shall notify Covered Entity of any actual, suspected, or reasonably suspected breach or security incident affecting PHI without unreasonable delay and in no event later than 72 hours after discovery of the incident. Notification shall include available information regarding scope, affected data elements, remediation steps taken, and corrective actions planned.

SUBCONTRACTORS AND FLOW-DOWN

Business Associate shall require any subcontractor creating, receiving, maintaining, or transmitting PHI on its behalf to agree in writing to the same restrictions and obligations that apply to Business Associate under this Addendum, including HITRUST-related obligations where applicable.

Business Associate must provide Covered Entity with a list of subcontractors processing PHI upon request and shall remain liable for the acts and omissions of such subcontractors.

AUDIT RIGHTS AND REPORTING

Covered Entity or its authorized representative shall have the right to assess Business Associate's compliance with this Addendum, including review of relevant policies, procedures and audit reports, subject to reasonable notice and protection of Business Associate's confidential information. Business Associate shall promptly provide evidence of HITRUST status and relevant audit reports upon request.

TERMINATION; RETURN AND DESTRUCTION OF PHI

Upon termination or expiration of the underlying agreement, Business Associate shall return or destroy PHI in accordance with Covered Entity's written instructions. If return or destruction is infeasible, Business Associate shall continue to protect PHI and shall limit further uses and disclosures to those purposes that make the return infeasible.

MISCELLANEOUS

This Addendum shall be governed by the laws selected in the underlying agreement. In the event of any conflict between this Addendum and the underlying agreement, the provisions that are more protective of PHI and consistent with applicable law shall govern.

HIPAA / PRIVACY ACKNOWLEDGMENT

Both parties acknowledge their respective obligations under HIPAA and agree to comply with applicable privacy and security rules. Covered Entity acknowledges that Business Associate's safeguards are described in this Addendum and that Covered Entity shall limit disclosures of PHI to the minimum necessary for the permitted purpose.

Covered Entity and Business Associate each acknowledge they are subject to HIPAA obligations and have read and accept the obligations set forth in this Addendum.

ADDITIONAL PROVISIONS

Sign Now