Business Associate Agreement

Recitals

WHEREAS, the Covered Entity is engaged in providing healthcare services and is classified as a "Covered Entity" under HIPAA.

WHEREAS, the Business Associate may create, receive, maintain, or transmit Protected Health Information ("PHI") on behalf of the Covered Entity in connection with services provided to the Covered Entity.

WHEREAS, the Business Associate is considered a "Business Associate" as defined by HIPAA when handling such PHI.

Definitions

Unless otherwise specified, all capitalized terms used in this Agreement shall have the meanings assigned to them under HIPAA, the HITECH Act, and the Regulations.

Business Associate Obligations

The Business Associate agrees to:

• Use or disclose PHI solely for performing services for the Covered Entity, in compliance with the requirements of HIPAA and as permitted or required under this Agreement;
• Report any use or disclosure of PHI not provided for by this Agreement to the Covered Entity without undue delay;
• Employ appropriate safeguards and comply with the Security Rule with respect to electronic PHI to prevent unauthorized use or disclosure;
• Ensure that any subcontractors or agents that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree in writing to the same restrictions and conditions that apply to the Business Associate;
• Upon becoming aware of a security incident involving electronic PHI, report such incident to the Covered Entity.

Permitted Uses

The Business Associate is authorized to make any use or disclosure of PHI necessary to fulfill its duties under this Agreement, to the extent that such use or disclosure would be permissible by the Covered Entity under the Privacy Rule.

Privacy Practices

The Covered Entity shall notify the Business Associate of any limitation(s) in its notice of privacy practices, to the extent that such limitation may affect the Business Associate’s use or disclosure of PHI.

The Covered Entity shall notify the Business Associate of any changes in, or revocation of, the permission by an individual to use or disclose his or her PHI, to the extent that such changes may affect the Business Associate’s use or disclosure of PHI.

Term & Termination

Term: This Agreement will commence on the Effective Date and will remain in effect until terminated by either party as set forth below.

Termination for Cause: Upon the Covered Entity’s knowledge of a material breach by the Business Associate, the Covered Entity shall provide an opportunity for the Business Associate to cure the breach or end the violation within thirty (30) days. If the Business Associate does not cure the breach or end the violation within that time period, the Covered Entity may terminate this Agreement.

Effect of Termination: Upon termination of this Agreement for any reason, the Business Associate, with respect to PHI received from the Covered Entity, or created, maintained, or received by the Business Associate on behalf of the Covered Entity, shall either return or destroy all such PHI, if feasible. If return or destruction is not feasible, the Business Associate shall extend any protections of the Agreement to the PHI and limit further uses and disclosures to those purposes that make the return or destruction of the PHI infeasible.

Miscellaneous

Amendments: The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with the requirements of HIPAA, the HITECH Act, and the Regulations.

Interpretation: Any ambiguity in this Agreement shall be interpreted to permit compliance with HIPAA, the HITECH Act, and the Regulations.