These Standard HIPAA Business Associate Agreement Terms and Conditions ("HIPAA Addendum") shall be incorporated into the Service
Agreement for Customers that are Covered Entities (as defined below) and that provide Protected Health Information ("PHI")(as defined below) to PatientPop
in connection with the services they have purchased. These terms supplement and are made part of the purchase agreement between PatientPop and Customers
("Underlying Agreement") in order to comply with the federal Standards for Privacy of Individually Identifiable Health Information, located at 45 C.F.R.
Part 160 and Part 164, Subparts A through E ("Privacy Rule") and the Health Information Technology for Economic and Clinical Health Act, Public Law 111-005
(the "HITECH Act").
WHEREAS, in order to ensure that Covered Entity and Business Associate remain in compliance with the HIPAA Rules and other applicable
federal and state laws and regulations regarding the disclosure of PHI to Business Associate, the parties have agreed to enter into this Agreement.
NOW
THEREFORE, Covered Entity and Business Associate agree as follows:
1. DEFINITIONS
Capitalized terms used in this Agreement and not otherwise defined herein shall have that meaning given
to them in the HIPAA Rules."Breach" when capitalized, shall have the meaning set forth in 45 CFR § 164.402 (including all of its subsections); with respect
to all other uses of the word "breach" in this Agreement, the word shall have its ordinary contract meaning."Electronic Protected Health Information" or
"EPHI" shall have the same meaning as the term "electronic protected health information" in 45 CFR § 160.103, limited to information that Business Associate
creates, accesses or receives from or on behalf of Covered Entity."Individually Identifiable Health Information" means information that is a subset of health
information, including demographic information collected from an individual, and;is created or received by a health care provider, health plan, employer, or
health care clearinghouse; and relates to the past, present, or future physical or mental health or condition of an individual; the provision of health
care to an individual; or the past, present or future payment for provision of health care to an individual; and
• that identifies
the individual; or
• with respect to which there is a reasonable basis to believe the information can be used to identify the individual.
"Protected Health Information" or "PHI" shall have the meaning set forth in the Privacy Rule, limited to information that Business
Associate creates, accesses or receives from or on behalf of Covered Entity. PHI includes EPHI.
"Privacy Rule" means the Standards for Privacy of Individually Identifiable Health Information, codified at 45 CFR parts 160 and 164,
Subparts A, D and E, as currently in effect.
"Security Incident" shall have the same meaning as the term "security incident" at 45 CFR 164.304.
"Security Rule" means the Standards for Security for the Protection of Electronic Protected Health Information, codified at 45 CFR parts
160 and 164, Subpart C, as currently in effect.
"Unsecured Protected Health Information" or "Unsecured PHI" shall have the same meaning as the term "unsecured protected health
information" in 45 CFR § 164.402, limited to the information created or received by Business Associate from or on behalf of Covered Entity.
2. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATES
• Business Associate Status
Business Associate acknowledges and agrees that it is a "Business Associate" as defined by the HIPAA Rules, and as such, Business Associate shall, in addition to complying with the other terms and conditions of the Terms of Service Agreement, comply with the HIPAA-required provisions set forth in this Agreement. In the event of a conflict between the terms of this Agreement and the Terms of Service Agreement with respect to the use or disclosure of PHI, the terms of this Agreement will govern. In all other circumstances, the terms of the Terms of Service Agreement will govern.
• Performance of Services
Business Associate may use PHI only to perform the services and its other obligations pursuant to the Terms of Service Agreement or as Required by Law. Business Associate may disclose such PHI only within its organization and only to those of its employees who need to know such information in order to perform its obligations under the Terms of Service Agreement and, in such case, only the minimum amount of such PHI as is necessary for such performance. Business Associate shall not access, use or disclose PHI in any manner that would violate the HIPAA Rules if such access, use or disclosure was done by Business Associate or Covered Entity,
• Privacy Rule Obligations
Business Associate shall comply with the Privacy Rule as it directly applies to business associates: To the extent Business Associate carries out one or more of Covered Entity's obligations under the Privacy Rule, Business Associate shall comply with the requirements of HIPAA that apply to Business Associate or Covered Entity in the performance of such obligation(s).
• Safeguards for Protection of PHI
Business Associate agrees that it will (a) protect and safeguard from any disclosure (whether oral, written or otherwise) all PHI with which it may come into contact with in accordance with the HIPAA Rules and more stringent state laws and regulations governing the handling of such information; and (b) use appropriate safeguards to prevent use or disclosure of PHI other than as permitted by the Terms of Service Agreement or this Agreement or as Required by Law.
• Mitigation
Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Agreement.