HIPAA BUSINESS ASSOCIATE AGREEMENT
Last Updated December 1, 2020
THIS IS A LEGALLY BINDING AGREEMENT BETWEEN STEVARA, LLC AND YOU, A MEMBER, AS DEFINED IN THE STEVARA, LLC TERMS AND CONDITIONS (THE “TERMS”). BY CLICKING “I AGREE,” OR BY OTHERWISE SIGNING UP OR FOR AN ACCOUNT, OR BY ACCESSING OR USING THE SERVICES AS DESCRIBED IN THE TERMS, YOU ARE ENTERING INTO THIS BUSINESS ASSOCIATE AGREEMENT (THIS “BAA”) AND YOU AGREE TO BE BOUND BY ITS TERMS AND CONDITIONS.
STEVARA, LLC PROVIDES CERTAIN SERVICES TO MEMBERS PURSUANT TO THE TERMS. THESE SERVICES QUALIFY STEVARA, LLC AS A BUSINESS ASSOCIATE TO ANY SUCH MEMBER OR COVERED ENTITY. THE PARTIES ARE ENTERING INTO THIS BAA TO SET FORTH THE TERMS ON WHICH STEVARA, LLC MAY USE AND DISCLOSE PROTECTED HEALTH INFORMATION AS THE MEMBER’S BUSINESS ASSOCIATE.
DEFINITIONS
- CATCH-ALL DEFINITION: The following terms used in this Agreement shall have the same meaning as those terms in the Health Insurance Portability and Accountability Act of 1996 (hereinafter “HIPAA”) Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.
- SPECIFIC DEFINITIONS:
(a) Business Associate. “Business Associate” shall generally have the same meaning as the term “business associate” at 45 CFR 160.103, and in reference to the party to this agreement, shall mean Stevara, LLC.
(b) Covered Entity. “Covered Entity” shall generally have the same meaning as the term “covered entity” at 45 CFR 160.103, and in reference to the party to this agreement, shall mean you, a Member, as defined in the BPCorrect Terms and Conditions.
(c) HIPAA Rules. “HIPAA Rules” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.
OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE
Business Associate agrees to:
(a) Not use or disclose protected health information other than as permitted or required by the Agreement or as required by law;
(b) Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information, to prevent use or disclosure of protected health information other than as provided for by the Agreement;
(c) Report to covered entity any use or disclosure of protected health information not provided for by the Agreement of which it becomes aware, including, but not limited to, breaches of unsecured protected health information as required at 45 CFR 164.410, and any security incident of which it becomes aware. Such report shall be made within thirty (30) business days of discovery of a breach of unsecured protected health information.
(d) In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the business associate agree to the same restrictions, conditions, and requirements that apply to the business associate with respect to such information;
(e) Make available protected health information in a designated record set to the covered entity as necessary to satisfy covered entity’s obligations under 45 CFR 164.524. Any requests for protected health information shall forward such request to the covered entity within fifteen (15) business days of receipt of the request.
(f) Make any amendment(s) to protected health information in a designated record set as directed or agreed to by the covered entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy covered entity’s obligations under 45 CFR 164.526.
(g) Maintain and make available the information required to provide an accounting of disclosures to the covered entity as necessary to satisfy covered entity’s obligations under 45 CFR 164.528. Business Associate shall forward information necessary to respond to an individual’s request for an accounting of disclosures to Covered Entity along with information necessary to respond to such request within thirty (30) days of receipt of such request.
(h) To the extent the business associate is to carry out one or more of covered entity’s obligation(s) under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to the covered entity in the performance of such obligation(s); and
(i) Make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.
PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE
(a) Business associate may only use or disclose protected health information for the purpose of providing services with covered entity’s membership and participation in Business Associate’s platform. Business associate is authorized to use protected health information to de-identify the information in accordance with 45 CFR 164.514(a)-(c) and may use this de-identified information for purposes of providing information to Covered Entity.
(b) Business associate shall not use or disclose protected health information other than as permitted or required by the Agreement or as required by law.
(c) Business associate agrees to make uses and disclosures and requests for protected health information consistent with covered entity’s minimum necessary policies and procedures.
(d) Business associate may not use or disclose protected health information in a manner that would violate Subpart E of 45 CFR Part 164 if done by covered entity except for the specific uses and disclosures set forth below:
(i) Business associate may use protected health information for the proper management and administration of the business associate or to carry out the legal responsibilities of the business associate.
(ii) Business associate may provide data aggregation services relating to the health care operations of the covered entity.
PROVISIONS FOR COVERED ENTITY TO INFORM BUSINESS ASSOCIATE OF PRIVACY PRACTICES AND RESTRICTIONS
(a) Covered entity shall notify business associate of any limitation(s) in the notice of privacy practices of covered entity under 45 CFR 164.520, to the extent that such limitation may affect business associate’s use or disclosure of protected health information.
(b) Covered entity shall notify business associate of any changes in, or revocation of, the permission by an individual to use or disclose his or her protected health information, to the extent that such changes may affect business associate’s use or disclosure of protected health information.
(c) Covered entity shall notify business associate of any restriction on the use or disclosure of protected health information that covered entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect business associate’s use or disclosure of protected health information.
PERMISSIBLE REQUESTS BY COVERED ENTITY
Covered entity shall not request business associate to use or disclose protected health information in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by covered entity, except to the extent that Business Associate will use or disclose protected health information for data aggregation or management and administration and legal responsibilities of the business associate.
NO THIRD-PARTY BENEFICIARIES
The Parties agree that the terms of this Agreement shall apply only to themselves and are not for the benefit of any third-party beneficiaries.
TERM AND TERMINATION
(a) Term. The Term of this Agreement shall be effective as of the Effective Date and shall terminate upon termination of the Covered Entity’s service agreement with the business associate or on the date covered entity terminates for cause as authorized in paragraph (b) of this Section, whichever is sooner.
(b) Termination for Cause. Business associate authorizes termination of this Agreement by covered entity, if covered entity determines business associate has violated a material term of the Agreement and business associate has not cured the breach or ended the violation within thirty (30) days of notice of the breach or violation.
(c) Obligations of Business Associate Upon Termination. Upon termination of this Agreement for any reason, business associate, with respect to protected health information received from covered entity, or created, maintained, or received by business associate on behalf of covered entity, shall:
(i) Retain only that protected health information which is necessary for business associate to continue its proper management and administration or to carry out its legal responsibilities;
(ii) Return to covered entity or destroy the remaining protected health information that the business associate still maintains in any form;
(iii) Continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information to prevent use or disclosure of the protected health information, other than as provided for in this Section, for as long as business associate retains the protected health information;
(iv) Not use or disclose the protected health information retained by business associate other than for the purposes for which such protected health information was retained and subject to the same conditions set out at in paragraphs above under “Permitted Uses and Disclosures By Business Associate” which applied prior to termination.
(d) Survival. The obligations of business associate under this Section shall survive the termination of this Agreement.
AMENDMENT
The Business Associate and the Covered Entity agree to amend this Agreement to the extent necessary to allow either party to comply with the Privacy Standards, the Standards for Electronic Transactions, the Security Standards, or other relevant state or federal laws or regulations created or amended to protect the privacy of patient information. All such amendments shall be made in a writing signed by both of the parties hereto.
INTERPRETATION
Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits the Covered Entity to comply with the then most current version of HIPPA and the HIPPA privacy regulations.
ELECTRONIC SIGNATURES
Any signature (including any electronic symbol or process attached to, or associated with, a contract or other record and adopted by an individual or entity with the intent to sign, authenticate or accept such contract or record) hereto or to any other certificate, agreement or document related to this transaction, and any contract formation or record-keeping through electronic means shall have the same legal validity and enforceability as a manually executed signature or use of a paper-based recordkeeping system to the fullest extent permitted by applicable law, and you hereby waive any objection to the contrary.