Business
Associate
Agreement

WHEREAS, Carebility and Customer have entered into a certain agreement for the provision of online services (the “Services Agreement”) under which Carebility will provide services to the Customer; and

WHEREAS, in the Customer’s use of the services, the Customer will transmit ePHI (defined below) to be processed and/or stored on Carebility’s data processing system; and

WHEREAS, the parties acknowledge that this Agreement is entered into in connection with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended, and the Health Information Technology for Economic and Clinical Health (HITECH) Act provisions of the American Recovery and Reinvestment Act of 2009, and their implementing regulations.

NOW, THEREFORE, in consideration of the foregoing, and in reliance on the mutual agreements contained herein, the parties agree as follows:

Definitions

1. Terms used but not otherwise defined in this Agreement shall have the same meaning as those terms in the Services Agreement, HIPAA Regulations (defined below), and the HITECH Act (defined below).
2. “Breach”: The same meaning as the term “breach” under Section 13400(1) of the HITECH Act.
3. “Business Associate”: The same meaning as the term “business associate” under HIPAA Regulations.
4. “Covered Entity”: The same meaning as the term “covered entity” under HIPAA Regulations.
5. “HITECH Act”: The Health Information Technology for Economic and Clinical Health (HITECH) Act, Pub. L. 111-5, Div. A, Title XIII, and Title IV of Div. B (generally effective February 17, 2010).
6. “HIPAA Regulations”: The Standards for Privacy of Individually Identifiable Health Information and the Security Standards for the Protection of Electronic Protected Health Information [45 C.F.R. Parts 160 and 164] promulgated by the U.S. Department of Health and Human Services under HIPAA, as amended, modified, or renumbered.
7. “ePHI”: The same meaning as the term “electronic protected health information” under HIPAA Regulations.
8. “Secretary”: The Secretary of the U.S. Department of Health and Human Services.
9. “Unsecured ePHI”: The same meaning as the term “unsecured protected health information” under Section 13402(h)(1) of the HITECH Act.

Applicability

Execution of this Agreement does not automatically qualify either party as a Covered Entity or a Business Associate.

This Agreement applies only to the extent that:

1. Customer is a Covered Entity; and
2. Carebility is a Business Associate of Customer under HIPAA Regulations and the HITECH Act.

Compliance with Regulations

1. HIPAA Compliance: Carebility shall comply with all duties and obligations imposed upon it as a Business Associate under HIPAA Regulations regarding ePHI transmitted by Customer in its capacity as a Covered Entity for processing and/or storage on Carebility’s system.
2. HITECH Act Compliance: Carebility, as a Business Associate, and Customer, as a Covered Entity, shall comply with the following:
   1. Carebility shall adhere to the administrative, physical, and technical safeguard requirements, including:
      1. 45 C.F.R. § 164.308 (Administrative Safeguards);
      2. 45 C.F.R. § 164.310 (Physical Safeguards);
      3. 45 C.F.R. § 164.312 (Technical Safeguards); and
      4. 45 C.F.R. § 164.316 (Policies and Procedures and Documentation Requirements).
   2. Carebility shall have discretion regarding “addressable” implementation specifications under these regulations.

Additional Requirements

1. Use and Disclosure of ePHI: Carebility may only use or disclose ePHI in compliance with applicable HIPAA and HITECH Act provisions.
2. Breach Reporting: Carebility shall report any Breach of Unsecured ePHI to the Customer within five (5) business days of becoming aware of it. Reports shall include details of individuals affected, information to facilitate further investigation, and any additional assistance requested by the Customer.
3. Prohibition on Remuneration: Unless approved by the Customer and in compliance with the HITECH Act, Carebility shall not directly or indirectly receive remuneration in exchange for ePHI without appropriate authorization.
4. Marketing Restrictions: Carebility shall not directly or indirectly perform marketing to the Customer’s patients using ePHI unless approved by the Customer, in compliance with HIPAA Regulations.
5. Audits: As mandated by the HITECH Act, Carebility may be subject to audits by the Secretary to ensure compliance.
6. Accounting of Disclosures: Carebility shall document disclosures of ePHI and provide information to assist the Customer in responding to requests for accounting of disclosures as required under HIPAA and the HITECH Act.
7. Minimum Necessary Standard: Carebility shall limit requests, uses, and disclosures of ePHI to the minimum necessary to accomplish the intended purpose.

Term and Termination

The term of this Agreement shall be effective upon execution and shall terminate when all Protected Health Information (PHI) provided by Customer to Carebility, or created or received by Carebility on behalf of Customer, is either destroyed or returned to the Customer. If it is infeasible to return or destroy the PHI, protections will be extended to such information in accordance with the termination provisions in this Agreement.

Entire Agreement

This Agreement supersedes all prior and contemporaneous written and oral agreements and understandings between Customer and Carebility regarding this subject matter. It contains the entire Agreement between the parties. This Agreement may be modified only by a signed written agreement between Customer and Carebility. All other agreements entered into between Customer and Carebility, not related to this subject matter, remain in full force and effect.

Governing Law

This Agreement and the rights of the parties shall be governed by and construed in accordance with Federal law as it pertains to the subject matter. It shall also be governed by and construed in accordance with the laws of the State of Texas as it pertains to contract formation and interpretation, without giving effect to its conflict of laws principles.

The parties agree that any appropriate state court sitting in Collin County, Texas, or any Federal court sitting in the district court in Dallas County, Texas, shall have exclusive jurisdiction over any case or controversy arising under or in connection with this Agreement and shall be a proper forum in which to adjudicate such case or controversy.

Each party irrevocably consents to the jurisdiction of such courts and irrevocably waives, to the fullest extent permitted by law, the defense of inconvenient forum to the maintenance of such suit, action, or proceeding in any such court. Each party further waives the right to object, with respect to such suit, action, or proceeding, that such court does not have jurisdiction over such party.

Miscellaneous

Counterparts

This Agreement may be executed in any number of counterparts, each of which shall be deemed an original, but all of which together shall constitute one original Agreement. Facsimile or electronically authenticated signatures shall be accepted and enforceable in lieu of original signatures.