Business Associate Agreement

THIS BUSINESS ASSOCIATE AGREEMENT (the “Agreement”) is an agreement between Upheal, Inc. (“Upheal”) and you or the entity you represent (“you” or “your”). This Agreement takes effect on the date (the “Agreement Effective Date”) when you click the “Accept Upheal Business Associate Agreement” button (or other electronic means made available by Upheal for such purpose) presented with this Agreement (an “Accept Button”). You represent to Upheal that you are lawfully able to enter into contracts (e.g., you are not a minor). If you are entering into this Agreement for an entity, such as the company you work for, you represent to Upheal that you have legal authority to bind that entity.

‍

NOW THEREFORE, the parties agree as follows:

Definitions

Catch-all definition:

The following terms used in this Agreement shall have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

‍

Specific definitions:

(a) Covered Entity. “Covered Entity” shall generally have the same meaning as the term “covered entity” at 45 CFR 160.103, and in reference to the party to this agreement, shall mean you or the entity you represent.

(b) Business Associate. “Business Associate” shall generally have the same meaning as the term “business associate” at 45 CFR 160.103, and in reference to the party to this agreement, shall mean Upheal.

(c) HIPAA Rules. “HIPAA Rules” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.

Obligations and Activities of Business Associate

Business Associate agrees to:

(a) Not use or disclose sensitive information other than as permitted or required by the Agreement or as required by law;

(b) Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to sensitive information, to prevent use or disclosure of sensitive information other than as provided for by the Agreement;

(c) Report to Covered Entity any use or disclosure of sensitive information not provided for by the Agreement of which it becomes aware, including breaches of unsecured sensitive information as required at 45 CFR 164.410, and any security incident of which it becomes aware;

(d) In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any subcontractors that create, receive, maintain, or transmit sensitive information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information;

(e) Make available sensitive information in a designated record set to the Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.524;

(f) Make any amendment(s) to sensitive information in a designated record set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526;

(g) Maintain and make available the information required to provide an accounting of disclosures to the Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.528;

(h) To the extent the Business Associate is to carry out one or more of covered entity's obligation(s) under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such obligation(s); and

(i) Make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules promptly following receipt of a written request to do so.

Permitted Uses and Disclosures by Business Associate

(a) Business Associate may only use or disclose sensitive information as necessary to perform the services set forth in Service Agreement and according to the terms and conditions of the use of Business Associate’s services.

(b) Business Associate may use or disclose sensitive information only as required by law.

(c) Business Associate agrees to make uses and disclosures and requests for sensitive information consistent with Covered Entity’s minimum necessary policies and procedures.

(d) Business Associate may not use or disclose sensitive information in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity

(e) Business Associate may disclose sensitive information for the proper management and administration of Business Associate or to carry out the legal responsibilities of the Business Associate, provided the disclosures are required by law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

(f) Except as otherwise limited in this Agreement, Business Associate may use sensitive information to provide Data Aggregation services to Covered Entity as permitted by 45 C.F.R. §164.504(e)(2)(i)(B).

(g) Business Associate will not receive direct or indirect remuneration in exchange for any sensitive information under any circumstances.

Provisions for Covered Entity to Inform Business Associate of Privacy Practices and Restrictions

(a) Covered Entity shall notify Business Associate of any limitation(s) in the notice of privacy practices of Covered Entity under 45 CFR 164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of sensitive information.

(b) Covered Entity shall notify Business Associate of any changes in, or revocation of, the permission by an individual to use or disclose his or her sensitive information, to the extent that such changes may affect Business Associate’s use or disclosure of sensitive information.

(c) Covered Entity shall notify Business Associate of any restriction on the use or disclosure of sensitive information that covered entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of sensitive information.

Safeguards, Reporting, Mitigation and Enforcement

(a) Safeguards. Business Associate shall use any and all appropriate administrative, physical and technical safeguards to (i) prevent use or disclosure of Covered Entity’s sensitive information otherwise than as provided by this Agreement, and (ii) protect the confidentiality, integrity and availability of any sensitive information.

(b) BA’s Agents. Business Associate shall ensure that any agents, including subcontractors, to whom it provides sensitive information, agree in writing to be bound by the same restrictions and conditions that apply to Business Associate with respect to such sensitive information.

(c) Reporting. Business Associate shall report to Covered Entity as soon as practicable of Business Associate becoming aware of any use or disclosure of Covered Entity’s sensitive information in violation of this Agreement or applicable law. Business Associate shall also report to Covered Entity within the same time-frame any Security Incident of which it becomes aware.

(d) Mitigation. Business Associate shall have procedures in place to mitigate, to the maximum extent practicable, any deleterious effect from any use or disclosure of Covered Entity’s sensitive information in violation of this Agreement or applicable law.

(e) Sanctions. Business Associate shall have and apply appropriate sanctions against any employee, subcontractor, or agent who uses or discloses Covered Entity’s sensitive information in violation of this Agreement or applicable law.

Term and Termination

(a) Term. The Term of this Agreement is concluded for an indefinite term but Covered Entity can terminate at any time for causes as outlined in paragraph (b) of this Section.

(b) Termination for Cause. Covered Entity shall be able to terminate this agreement immediately upon receiving notice from Business Associate that a breach involving Patient or Protected Health Information has occurred, or Covered Entity determines Business Associate has violated a material term of the Agreement and Business Associate has not cured the breach or ended the violation within thirty (30) days.

‍

Upon termination of this Agreement for any reason, Business Associate, with respect to sensitive information received from Covered Entity, or created, maintained, or received by Business Associate on behalf of Covered Entity, shall:

‍

Retain only that sensitive information which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities;
Return to Covered Entity the remaining sensitive information that the Business Associate still maintains in any form;
Continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to sensitive information to prevent use or disclosure of the sensitive information, other than as provided for in this Section, for as long as Business Associate retains the sensitive information;
Not use or disclose the sensitive information retained by Business Associate other than for the purposes for which such sensitive information was retained and subject to the same conditions set out at paragraphs (e) and (f) above under “Permitted Uses and Disclosures By Business Associate” which applied prior to termination; and
Return to Covered Entity the sensitive information retained by Business Associate when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities.

Miscellaneous

(a) Regulatory References. A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended.

(b) Amendment. The parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with the requirements of the HIPAA Rules and any other applicable law.