Business Associate Agreement (BAA)

This Business Associate Agreement (the “Agreement”) is made effective as of              (the “Effective Date”), between                      (“Covered Entity”) and Helix Tech LLC (“Business Associate”), each of whom is a party to a certain Master Services Agreement dated                      (the “Service Agreement”).  Business Associate and Covered Entity may each individually be referred to in this Agreement as “Party” or jointly as “Parties.”  Unless otherwise defined in this Agreement, all capitalized words, like Business Associate, Covered Entity and Protected Health Information (hereinafter “PHI”) have the meanings set forth in 45 C.F.R. Parts 160, 162 and 164, as modified from time to time.  “Services” means the specific services described in the Service Agreement.
WHEREAS, the Covered Entity possesses PHI that is protected under the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), the Health Information Technology for Economic and Clinical Health Act (Public Law 111-5) and the regulations promulgated thereunder by the United States Department of Health and Human Services, including the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Parts 160 and 164, each as amended by the final rule known as the Omnibus Rule (hereinafter collectively referred to as “HIPPA”);
WHEREAS, the Covered Entity is permitted to use or disclose PHI in accordance with HIPPA;
WHEREAS, the Business Associate may have access to and may receive and maintain PHI from Covered Entity in connection with its performance of its services to Covered Entity under the MSA; and
WHEREAS, the purpose of this Agreement is to satisfy the applicable standards and requirements of HIPPA in conjunction with that use and/or disclosure between the Parties;
NOW THEREFORE, in consideration of the mutual promises set forth in this Agreement and the business arrangements between the Parties pursuant to the MSA, and for other good and valuable consideration, the sufficiency and receipt of which are hereby severally acknowledged, the Parties agree as follows:
TERM
This Agreement shall remain valid for the duration of the MSA and shall apply to all Services and supplies made by the Business Associate in accordance with this Agreement.
COVERED ENTITY’S OBLIGATIONS
Covered Entity shall inform Business Associate of any restriction(s) in the Notice of Privacy Policies of Covered Entity (under 45 CFR 164.520) to the degree that such restriction may affect the use or disclosure of PHI by Business Associate.
Covered Entity shall inform Business Associate of any change in, or revocation of, an individual’s permission to use or disclose their PHI, to the degree that such change may affect the use or disclosure of PHI by the Business Associate.
Covered Entity shall inform Business Associate of any restriction on the use or disclosure of PHI that the Covered Entity has agreed to or is expected to comply with 45 CFR 164.522, to the degree that such restriction may affect the use or disclosure of PHI by Business Associate.
Covered Entity shall not request the use or disclosure of PHI by Business Associate in any manner that would not be permitted under Subpart E of 45 CFR Part 164 if performed by Covered Entity. Exceptions where specific provisions are made.
Mark all that apply:
☐ Data aggregation
☐ Management and administration
☐ Legal obligations of the Business Associate
BUSINESS ASSOCIATE’S OBLIGATIONS
Business Associate shall not use or disclose PHI other than as permitted or required by this Agreement or as required by law.
Comply with Subpart C of 45 CFR Part 164 and use appropriate safeguards with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by the Agreement and HIPPA.
Report to Covered Entity any use or disclosure of PHI not in accordance with the requirements in this Agreement of which it becomes aware, including breaches of unsecured PHI as required at 45 CFR 164.410, and any security incident of which it becomes aware; Mark all that apply:
☐ Business Associate will notify Covered Entity of breach within sixty (60) days.
☐ Business Associate will notify patient of breach
☐ Business Associate will notify HHS Office for Civil Rights of breach
☐ Business Associate will notify media of breach
Any subcontractors (if applicable) that create, receive, maintain, or transmit PHI on behalf of the Business Associate must agree in writing to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information, in accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2).
Under 45 CFR 164.524, make available PHI in a designated record sent to the Covered Entity as necessary to satisfy Covered Entity’s obligations.
Mark all that apply:
☐ Business Associate will forward requests for access of the designated record set to Covered Entity within thirty (30) days.
☐ Business Associate will respond to request for access to the designated record set within thirty (30) days. Business Associate will notify the requesting party in scenarios where Business Associate is unable to respond to requests for access.
Make any revision(s) to PHI in a designated record set as directed or agreed to by the Covered Entity in accordance to 45 CFR 164.526, or take other measures as necessary to satisfy the Covered Entity’s obligations under 45 CFR 164.526.
Mark all that apply:
☐ The Business Associate will not make amendment(s) to PHI in a designated record set. Business Associate will forward all amendment requests to Covered Entity within sixty (60) days.
☐ Business Associate will make amendment(s) to PHI in a designated record set within sixty (60) days.
Under 45 CFR 164.528, maintain and make available the information required to provide an accounting of disclosures to the Covered Entity as necessary to satisfy Covered Entity’s obligations.
Mark all that apply:
☐ Business Associate will not provide accounting of disclosures. Business Associate will forward requests for accounting of disclosures to Covered Entity within sixty (60) days.
☐ Business Associate will respond to request(s) for accounting of disclosures within sixty (60) days.
Under Subpart E of 45 CFR Part 164, to the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s), to comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such obligation(s).
Provide its internal practices and records to the Secretary for purposes of determining compliance with the HIPAA Rules.
PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE
Business Associate may only use or disclose PHI in the manner specified below.
Payment
Legal Requirements
Law Enforcement
Emergency Situations
The Business Associate may use or disclose PHI as necessary to perform the Services outlined in the MSA. The Business Associate is allowed to use PHI to de-identify information in compliance with 45 CFR 164.514.
Business Associate may use or disclose PHI only as permitted or required by its business associate contract or other arrangements under § 164.504(e) or as required by law.
Business Associate agrees to permit the use and disclosure and requests for PHI Consistent with the minimum required policies and procedures of the Covered Entity.
Business Associate shall not use or disclose PHI in a manner that is contrary to Subpart E of 45 CFR Part 164. If the Agreement allows the Business Associate to use or disclose PHI for its management and administration and legal obligations or data aggregation services as set out in the optional provisions:
Business Associate may use PHI for management and administration of the Business Associate or perform the legal obligations for the Business Associate.
Business Associate may disclose PHI for management and administration of the Business Associate or to carry out the legal obligations of the Business Associate, provided that the disclosure is necessary by law, or the Business Associate receives satisfactory assurances from the individual to whom the information is disclosed that the information will remain confidential and will be used or disclosed only as necessary by law or for the purposes for which it has been disclosed to the individual, and the individual shall notify the Business Associate of any instances in which the confidentiality of the information is breached.
Business Associate may provide data aggregation services relating to the Covered Entity’s health care operations.
TERMINATION
This Agreement will automatically terminate without further action of the Parties upon the termination or expiration of the business association between the Parties.
If either Party materially breaches this Agreement, the other party may terminate this Agreement, at its election, pursuant to the underlying provisions, subject to thirty (30) days prior written notice and opportunity to cure the breach.
Within thirty (30) days of the termination of this Agreement, Business Associate shall return all PHI to Covered Entity,  or, if agreed to by Covered Entity, within thirty (30) days, either transfer the PHI to another business associate designated by the Covered Entity or destroy all PHI received from Covered Entity or created, maintained, or received by Business Associate on behalf of Covered Entity, that Business Associate still maintains in any form (including any information in the possession of any employee, Subcontractor or other agent of Business Associate). Upon request of Covered Entity, Business Associate will provide a certificate to Covered Entity acknowledging such transfer or destruction. Business Associate will thereafter retain no written, digital, back-up or other copies of any PHI of Covered Entity. Notwithstanding the foregoing, if the return or destruction of PHI upon termination is not feasible, Business Associate shall so inform Covered Entity and will continue to maintain the security and privacy of such PHI in a manner consistent with the obligations of this Agreement and as required by applicable law, for so long as Business Associate is in possession of such information. Business Associate will return or destroy such retained PHI as soon as is reasonably feasible. Business Associate may retain all de-identified information created prior to the date of termination of this Agreement.
The obligations of Business Associate, according to this section, shall survive the termination of this Agreement.
OWNERSHIP
All PHI that Covered Entity discloses to Business Associate pursuant to this Agreement is and will remain the property of Covered Entity.
LIMITATION OF LIABILITY
NOTWITHSTANDING ANY OTHER PROVISION IN THIS AGREEMENT, UNDER NO CIRCUMSTANCES WILL BUSINESS ASSOCIATE HAVE ANY OBLIGATION OR LIABILITY HEREUNDER FOR ANY INCIDENTAL, INDIRECT, CONSEQUENTIAL, COLLATERAL, EXEMPLARY, PUNITIVE OR SPECIAL DAMAGES INCURRED BY COVERED ENTITY (INCLUDING DAMAGES FOR LOST BUSINESS, LOST PROFITS, COSTS OF COVER, COSTS OF DELAY, OR DAMAGES TO BUSINESS REPUTATION), REGARDLESS OF HOW SUCH DAMAGES ARISE, WHETHER OR NOT BUSINESS ASSOCIATE WAS ADVISED SUCH DAMAGES MIGHT ARISE, OR THE FAILURE OF THE ESSENTIAL PURPOSE OF ANY LIMITED REMEDY. IN NO EVENT SHALL BUSINESS ASSOCIATE HAVE ANY OBLIGATION, OR BE LIABLE FOR ANY DAMAGES, DIRECT OR OTHERWISE, UNDER THIS AGREEMENT IN EXCESS OF THE TOTAL AMOUNTS PAID BY COVERED ENTITY TO BUSINESS ASSOCIATE PURSUANT TO THE TERMS. These limitations are cumulative; the sum of multiple claims may not exceed such limit.
DE-IDENTIFIED DATA
Business Associate and its subcontractors may disclose non-personally identifiable information, provided that the information disclosed does not contain a key or other mechanism that would allow the information to be identified.
MISCELLANEOUS
This Agreement is personal to Business Associate and Covered Entity and may not be assigned or delegated by either Party without the prior written consent of the other Party in each instance; provided, however, that in the event of a permitted assignment of the Terms, this Agreement may be assigned together with the MSA. This Agreement shall be binding upon and shall inure to the benefit of the parties hereto and their respective representatives, successors, and permitted assigns.
Business Associate and Covered Entity agree to update this Agreement to the degree required to allow either Party to comply with the Privacy Standards, the Standards for Electronic Transactions, the Security Standards or any applicable state or federal laws or regulations developed or modified to protect the privacy of patient information. All of such changes shall be made in writing and signed by all Parties.
This Agreement contains the entire agreement between the Parties, and supersedes all prior or contemporaneous discussions, understandings or representations with respect to the subject matter hereof.
If any term or provision of this Agreement shall to any extent be invalid or unenforceable, the remainder of this Agreement shall not be affected thereby and each term and provision of this Agreement shall be valid and enforced to the fullest extent permitted by law.
The terms and provisions of this Agreement shall supersede any other conflicting or inconsistent terms and provisions in the MSA, including any other attachments thereto and documents incorporated therein by reference.
This Agreement shall be construed in accordance with the laws of the State of South Carolina, without giving effect to the choice of law provisions thereof. Venue for any action or proceeding related to this Agreement shall be in the state or federal courts of the state of South Carolina and County or Division of Charleston, as appropriate. The Parties agree to the personal jurisdiction and venue of such courts.
Any notice or report hereunder shall be deemed given if delivered or sent by first class mail, postage prepaid, addressed to the other Party at the address set forth in the MSA, or at such other address as designated by the Party by written notice, or by commercial delivery service, or by confirmed email or facsimile. If notice is given by mail and the notice affects the other Party’s rights hereunder, the effective date of the notice shall be seven (7) days after the date of mailing or the date the notice is received, whichever is earlier.
Any ambiguity in this Agreement shall be resolved in favor of a definition that permits the Parties to comply with the most current HIPAA rules.