Business Associate Agreement
This Business Associate Agreement (“Agreement”) by and between YOU, a Sectegrity Corporation SecurePaging Customer, (hereinafter known as “Covered Entity”) and Sectegrity Corporation, a provider of secure urgent communications, providing Business Associate services (hereinafter known as “Business Associate”), is effective as of the Covered Entity's acceptance of the Sectegrity Customer Agreement (“Effective Date”). Covered Entity and Business Associate shall collectively be known herein as “the Parties.”
WHEREAS, Covered Entity wishes to commence a business relationship with Business Associate whereby Business Associate will provide products and services to Covered Entity pursuant to a separate agreement;
WHEREAS, the nature of the prospective contractual relationship between Covered Entity and Business Associate may involve the exchange of Protected Health Information (“PHI”) and/or Electronic Protected Health Information (“ePHI”) as those terms are defined under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), including all pertinent regulations issued by the Department of Health and Human Services (“HHS”);
WHEREAS, Covered Entity and Business Associate intend to protect the privacy and provide for the security of PHI and/or ePHI disclosed to Business Associate in compliance with the Privacy and Security Rules.
NOW THEREFORE, in consideration of the mutual recitals above, and the exchange of information pursuant to this Agreement, the Parties agree as follows:
a. Catch-all Definitions.
The following terms used in this Agreement shall have the same meaning as those terms in the HIPAA Rules: “Breach,” “Data Aggregation,” “Designated Record Set,” “Disclosure,” “Health Care Operations,” “Minimum Necessary,” “Notice of Privacy Practices,” “Required By Law,” “Secretary,” “Security Incident,” “Subcontractor,” “Unsecured Protected Health Information,” and “Use.”
b. “Business Associate”
shall have the same meaning as given in 45 CFR § 160.103.
c. “Covered Entity”
shall have the same meaning as given in 45 CFR § 160.103.
shall mean the first day on which a Breach is known to Business Associate (including any person, other than the individual committing the Breach, that is an employee, officer, or other agent of Business Associate), or should reasonably have been known to Business Associate (or person), to have occurred.
e. “HIPAA” or “Health Insurance Portability and Accountability Act of 1996”
is the law under which the Privacy and Security Rules were promulgated.
f. “HIPAA Rules”
shall mean the Privacy, Security, Breach Notification, and Enforcement Rules in 45 CFR Part 160 and 164.
g. “HITECH Act”
or “Health Information Technology for Economic and Clinical Health Act” are those provisions set forth in Title XIII of Public Law 111-5 as enacted on February 17, 2009.
shall have the same meaning as the term “individual” in 45 CFR § 160.103, and shall include a person who qualifies as a personal representative in accordance with 45 CFR § 164.502(g).
i. “Privacy Rule”
is the regulation entitled “Standards for Privacy of Individually Identifiable Health Information,” promulgated under HIPAA and/or the HITECH Act that is codified at 45 CFR Part 160 and 164, Subparts A and E.
j. “Protected Health Information”(“PHI”) and “Electronic Protected Health Information” (“ePHI”)
shall have the meaning given to such terms in 45 CFR § 160.103, limited to the information created or received by Business Associate from, or on behalf of, Covered Entity.
k. “Security Rule”
is the regulation entitled “Security Standards for the Protection of Electronic Protected Health Information,” promulgated under HIPAA and/or the HITECH Act that is codified at 45 CFR, Part 160 and 164, Subparts A and C.
II. OBLIGATIONS OF BUSINESS ASSOCIATE
a. Limitation(s) on Uses and Disclosures.
Business Associate agrees to not use or disclose PHI or ePHI other than as permitted or required by this Agreement, or as Required by Law.
b. Permitted Uses and Disclosures.
Business Associate may use and disclose PHI and/or ePHI created or received pursuant to this Agreement as follows:
i. To carry out the purposes of this Agreement.
Business Associate may use and disclose Covered Entity’s PHI and/or ePHI received or created by Business Associate (or its agents and subcontractors) in performing its obligations pursuant to this Agreement, provided that such use or disclosure would not violate the Privacy Rule if done by Covered Entity.
ii. For Archival purposes.
iii. Use for Management and Administration.
Business Associate may use PHI and/or ePHI created or received in its capacity as a Business Associate of Covered Entity, if such use is necessary (i) for the proper management and administration of Business Associate or (ii) to carry out the legal responsibilities of Business Associate.
iv. Disclosure for Management and Administration.
Business Associate may disclose PHI and/or ePHI created or received in its capacity as a Business Associate of Covered Entity for the proper management and administration of Business Associate if (i) the disclosure is Required by Law or (ii) Business Associate (a) obtains reasonable assurances from the person to whom the PHI and/or ePHI is disclosed that it will be held confidentially and used or further disclosed only as Required by Law, or for the purpose for which it was disclosed to the person and (b) the person agrees to notify Business Associate of any instances in which it becomes aware the confidentiality and security of the PHI and/or ePHI has been Breached.
Business Associate shall not use or further disclose Covered Entity’s PHI and/or ePHI other than permitted or required by this Agreement, or as Required by Law.
Business Associate shall use appropriate administrative, physical, and technical safeguards, including, among others, policies and procedures regarding the protection of PHI and/or ePHI that reasonably and appropriately protect the confidentiality, integrity, and availability of the PHI and/or ePHI that Business Associate receives, maintains, or transmits on behalf of Covered Entity.
i. With respect to ePHI,
Business Associate shall comply with the applicable requirements of the Security Rule.
ii. With respect to ePHI,
Business Associate shall ensure that any agent, including a subcontractor, to whom it provides ePHI, agrees to implement reasonable and appropriate safeguards to protect it.
e. Reporting of Impermissible Uses and Disclosures, Security Incidents, and Breaches.
Business Associate agrees to report to Covered Entity any use or disclosure of PHI not provided for by this Agreement or any Security Incident of which Business Associate becomes aware, except that this section shall hereby serve as notice, and no additional reporting shall be required, of the regular occurrence of unsuccessful attempts at unauthorized access, use, disclosure, modification, or destruction of ePHI or interference with system operations in an information system containing ePHI. After discovery of an impermissible Use, Disclosure or Security Incident, Business Associate shall report such incident to the Covered Entity promptly without unreasonable delay. In the event that such use or disclosure or Security Incident constitutes a Breach of Unsecured Protected Health Information, such notice shall include the identification of each individual whose Unsecured PHI has been or is reasonably believed by Business Associate to have been accessed, acquired, used, or disclosed in connection with such Breach and any additional information set forth at 45 CFR § 164.410, to the extent possible. In addition, Business Associate shall provide any additional information reasonably requested by Covered Entity for the purpose of investigating and responding to the Breach. Notification of Breach, or potential Breach, under this Agreement shall be made to Covered Entity as indicated in (X)(d).
Business Associate agrees to mitigate, to the extent practicable, any harmful effect that becomes known to Business Associate as a result of a Breach, or use or disclosure of PHI, by Business Associate in violation of the requirements of this Agreement.
g. Use of Agents and Subcontractors.
Business Associate shall ensure that any of its agents and subcontractors that receive, maintain, or transmit protected health information on behalf of the Business Associate agrees to the same or more stringent restrictions, conditions, and requirements that apply to the Business Associate with respect to such information.
h. Accounting of PHI.
Within five (30) business days notice by Covered Entity of a request for an accounting of disclosures of PHI, Business Associate shall make available to Covered Entity a list of disclosures of PHI as required for Covered Entity to fulfill its obligations to provide an accounting pursuant to the Privacy Rule, including but not limited to, 45 CFR § 164.528.
k. Availability of Books and Records.
Business Associate shall make its internal practices, books and records relating to the use and disclosure of PHI, including ePHI, created or received pursuant to this Agreement, available to the Secretary of the United States Department of Health and Human Services, for the purpose of determining Covered Entity’s compliance with the Privacy and Security Rules as set forth in 45 CFR § 160.310.
l. Data Ownership.
Business Associate acknowledges that Covered Entity is the owner of all the PHI and/or ePHI obtained from the Covered Entity.
Furthermore, any specific listing of duties or functions to be performed by Business Associate for Covered Entity contained in a separate contract (or addendum thereto) between the Parties is hereby incorporated by reference into this Agreement for the sole purpose of further elaborating duties and functions that Business Associate is contractually undertaking on behalf of the Covered Entity.
In all instances, Business Associate shall not use or disclose PHI and/or ePHI obtained from Covered Entity in a manner that would violate the Security and Privacy Rule of HIPAA, the HITECH Act, or the pertinent regulations of HHS.
III. OBLIGATIONS OF COVERED ENTITY
a. Notice of Privacy Practices.
Covered Entity shall not include in its notice of privacy practices under 45 CFR § 164.520 any limitation(s) that further limits Business Associate’s use or disclosure of PHI under this Agreement unless such a limitation(s) is required by law or Covered Entity receives Business Associate’s prior approval so that Business Associate can confirm that it can operationalize the limitation(s). In the event that Covered Entity is required to include such a limitation in its notice of privacy practices, Covered Entity shall promptly notify Business Associate of such limitation(s).
b. Revocation of Authorization.
Covered Entity shall provide Business Associate with any changes in, or revocation of, permission by an Individual to use or disclose Protected Health Information, to the extent that such changes affect Business Associate’s use or disclosure of PHI and/or ePHI.
Covered Entity shall not agree to any request for a restriction under 45 CFR § 164.522 that further limits Business Associate’s use or disclosure of PHI under this Agreement unless Covered Entity is required by law to agree to such a restriction or Covered Entity receives Business Associate’s prior approval so that Business Associate can confirm that it can operationalize the restriction. Covered Entity shall notify Business Associate of any restriction to the use or discloser of PHI that Covered Entity has agreed to in accordance with 45 CFR § 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI and/or ePHI.
d. Requests to Use or Disclose PHI.
Covered Entity shall not request or cause Business Associate to use or disclose PHI in any manner that would not be permissible under the Privacy Rule if done by Covered Entity or that is not otherwise expressly permitted under Section (II)(b) hereof.
e. Limitations of Use.
Covered Entity shall only use the following SecurePaging interfaces for the transmission of PHI/EPHI data:
ii.User Web Interface
Covered Entity may not use SecurePaging's Email interface for the transmission of PHI/EPHI data.
IV. TERM AND TERMINATION
The Term of this Agreement shall be effective as of the Effective Date and shall terminate when all of the PHI provided by Covered Entity to Business Associate, or created/received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or, if it is infeasible to return or destroy PHI, protections are extended to such information in accordance with the termination provisions in this Section.
b. Termination for Cause.
Upon Covered Entity’s knowledge of a material Breach by Business Associate, Covered Entity shall either:
i. Provide an opportunity for Business Associate to cure the Breach or end the violation, and terminate this Agreement if Business Associate does not cure the Breach or end the violation within the time specified by Covered Entity;
ii. Immediately terminate this Agreement if Business Associate has breached a material term of this Agreement, and a cure is not possible; or
iii. If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary.
c. Effect of Termination.
i. Except as provided in paragraph (c)(ii) of this section, upon termination of this Agreement, for any reason, Business Associate shall return or to the best extent possible, destroy all PHI received from Covered Entity.
ii. In the event that Business Associate determines that returning or destroying the PHI is infeasible, Business Associate shall provide to Covered Entity written notification of the conditions that make return or destruction infeasible. After written notification that return or destruction of PHI is infeasible, Business Associate shall extend the protections of this Agreement to such PHI, and limit further uses and disclosure of such PHI to those purposes that make the return or destruction infeasible, for so long as Business Associate maintain such PHI.
iii. Should Business Associate make a disclosure of PHI in violation of this Agreement, Covered Entity shall have the right to immediately terminate any contract, other than this Agreement, then in force between the Parties.
Business Associate makes no warranty or representation that compliance by Covered Entity with this Agreement, HIPAA, the HITECH Act, or the Privacy and Security Rules will be adequate or satisfactory for Covered Entity’s own purposes. Covered Entity is solely responsible for all decisions made by Covered Entity regarding the safeguards of PHI and/or ePHI.
VI. NO THIRD PARTY BENEFICIARIES
Nothing expressed or implied in this Agreement is intended to confer, nor shall anything herein confer, upon any person other than Covered Entity, Business Associate, and their respective successors and assigns, any rights, remedies, obligations, or liabilities whatsoever.
VII. CHANGE IN APPLICABLE LAWS OR REGULATIONS
In the event the laws or regulations of the United States or the State in which the majority of services are rendered are modified or amended in any material way with respect to this Agreement, this Agreement shall not be terminated but rather, to the extent feasible, shall be promptly amended by the Parties to operate in compliance with the existing law. The Parties acknowledge that their responsibilities under this Agreement may be affected and governed by the requirements of HIPAA and/or the HITECH Act, to the extent that regulations implementing HIPAA and/or the HITECH Act (the “Regulations”) become effective during the Term of this Agreement or any renewal thereof. Both Parties agree that, upon the effective date of any such obligations applicable to each of them under such Regulations pursuant to their responsibilities hereunder. To the extent any amendments to this Agreement shall be necessary to effectuate or clarify the obligations of the Parties pursuant to such Regulations; the Parties hereby agree to negotiate such amendments in good faith, subject to the right of either Party to terminate this Agreement in accordance with its terms.
This Agreement may only be modified through a written notice signed by the Parties and, thus, no oral modification hereof shall be permitted. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for Covered Entity to comply with the requirements of the Privacy Rule and the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191.
Should there be any conflict between the language of this contract and any other contract entered into between the Parties (either previous or subsequent to the date of this Agreement), the language and provisions of this Agreement shall control and prevail, unless in a subsequent written agreement the Parties specifically refer to this Agreement by its title and date, and, also, specifically state that the provisions of the later written agreement shall control over this Agreement. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits Covered Entity and Business Associate to comply with the Privacy and Security Rules and/or the HITECH Act.
a. Any ambiguity in this Agreement shall be resolved to permit Covered Entity and Business Associate to comply with HIPAA, the HITECH Act, and the Security and Privacy Rule.
b. A reference in this Agreement to a section in the Privacy Rule means the section as in effect or amended.
c. Any notice required under this Agreement to be given to Covered Entity or Business Associate shall be made in writing.
Last Updated: 12/04/2018