Business Associate Agreement

1.Definitions

Capitalized terms used, but not otherwise defined, in this BAA shall have the meanings set forth in HIPAA, HITECH, and the HIPAA Regulations.

2.Services and Applicability

The Covered Entity and Business Associate have entered into the Services Agreement under which Business Associate may create, receive, use, maintain or transmit PHI from or on behalf of the Covered Entity. This BAA shall only be effective in the event that Business Associate meets the definition of a business associate under 45 C.F.R. 160.103. In the event of a conflict between the terms of the Services Agreement and this BAA with respect to the HIPAA Rules, this BAA shall control unless expressly stated otherwise.

3.Relationship of the Parties

None of the provisions of this BAA are intended to create, nor shall they be deemed to create, any relationship between the Parties other than that of independent parties contracting with each other solely for the purposes of effecting the provisions of this BAA and the Services Agreement evidencing their business relationship. Business Associate is an independent contractor and not an agent of the Covered Entity.

4.Permitted Uses and Disclosures

Business Associate may use and/or disclose PHI only as permitted or required by the Services Agreement and this BAA, or as otherwise Required by Law. Business Associate may disclose PHI to, and permit the use of PHI by, its employees, contractors, agents, or other representatives only to the extent directly related to and necessary for the performance of the Services. Business Associate shall make uses and disclosures of, and requests for PHI from Business Associate only in a manner consistent with the Covered Entity minimum necessary policies and procedures, and shall request, use or disclose no more than the minimum PHI necessary to perform the Services. Business Associate shall not use or disclose PHI in a manner (i) inconsistent with Business Associate's obligations under the HIPAA Rules, or (ii) that would violate the HIPAA Rules if disclosed or used in such a manner by Covered Entity.

4.1Business Associate may use and disclose PHI for the proper management and administration of its business and to carry out its legal responsibilities in accordance with 45 C.F.R. §164.504(e)(4).

4.2Business Associate may use PHI to create de-identified information pursuant to the standards set forth at 45 C.F.R. § 164.514(b). Once de-identified, this data is no longer PHI and may be used by Business Associate for any lawful purpose.

4.3Business Associate may use PHI in its possession to provide data aggregation services relating to the health care operations of the Covered Entity.

4.4Business Associate may disclose PHI in its possession to third parties to support Business Associate’s performance of Services, provided that Business Associate has received from the third party written assurances that the PHI will be held confidentially, that the PHI will only be used or further disclosed as Required by Law or for the purpose for which it was disclosed to the third party, and that the third party will notify Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached, as required under 45 C.F.R. § 164.504(e)(4).

4.5To the extent Business Associate is carrying out one or more obligations of the Covered Entity under 45 C.F.R. Part 164, Subpart E, Business Associate shall comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such obligation(s).

5.Safeguards for the Protection of PHI

Business Associate warrants that it has implemented and shall maintain commercially reasonable and appropriate security safeguards for PHI and will protect the confidentiality and integrity of such PHI created, received, used, maintained or transmitted from, or on behalf of the Covered Entity. Business Associate shall comply with the Security Rule, as may be amended, and with the applicable provisions of the Privacy Rule, as may be amended, in carrying out its obligations under the Services Agreement.

6.Reporting of Unauthorized Uses and Disclosures

If Business Associate has knowledge of any use or disclosure of PHI not provided for by this BAA, including any Security Incident, then Business Associate shall provide notification without unreasonable delay to Covered Entity in writing. Notwithstanding the above, the Parties acknowledge that probes and reconnaissance scans are commonplace in the industry and as such, the Parties acknowledge and agree that, to the extent such probes and reconnaissance scans constitute Security Incidents, this Section 6 constitutes notice by Business Associate to Covered Entity of the ongoing existence and occurrence of such Security Incidents for which no additional notice to Covered Entity shall be required, as long as such probes and reconnaissance scans do not result in unauthorized access, Use, or Disclosure of PHI. Probes and reconnaissance scans as used in this Section 6 include, without limitation, pings and other broadcast attacks on Business Associate’s firewalls, port scans, and unsuccessful log-on attempts that do not result in unauthorized access, Use, or Disclosure of PHI.

7.Reporting of Breach of Unsecured PHI

Business Associate agrees to promptly report to Covered Entity any Breach of Unsecured PHI of which Business Associate becomes aware in the time and manner specified under 45 C.F.R. 164.410, except where a law enforcement official determines that a notification would impede a criminal investigation or cause damage to national security. Following a Breach, Business Associate shall provide Covered Entity with sufficient information to permit the Covered Entity to comply with the Breach notification requirements set forth at 45 C.F.R. §164.400 et seq. To the extent Business Associate is not able to provide all of the information requested by Covered Entity within the time frame set forth above, Business Associate agrees to promptly supplement such information with additional information as it becomes available. Business Associate agrees to act, in cooperation with the Covered Entity, in good faith to investigate and mitigate any harm caused by any unauthorized use, Security Incident, or Breach.

8.Use and Disclosure of PHI by Subcontractors, Agents, and Representatives

Business Associate shall require any Subcontractor, agent, or other representative that is authorized to create, receive, maintain, or transmit PHI on behalf of Business Associate to execute a business associate agreement to agree in writing to terms, restrictions, conditions, and requirements no less stringent than those that apply to Business Associate set forth herein.

9.Individual Rights

To the extent that Business Associate maintains PHI in a Designated Record Set and at the request of Covered Entity, Business Associate agrees to provide the following to Covered Entity to permit Covered Entity to comply with Individual rights requirements as applicable to PHI used or maintained by Business Associate:

9.1Right of Access. Business Associate agrees to provide access to PHI maintained by Business Associate in a Designated Record Set, if any, at the request of the Covered Entity or as directed by the Covered Entity, to an Individual in order to meet the requirements under 45 C.F.R. §164.524. Upon receipt of a request for access from an Individual, Business Associate shall forward the request, or direct the Individual, to the Covered Entity within fifteen (15) calendar days of receipt.

9.2Right of Amendment. Business Associate agrees to make any amendment(s) to PHI maintained by Business Associate in a Designated Record Set, if any, that the Covered Entity directs or agrees to, pursuant to 45 C.F.R. §164.526, or take such other measures as directed or agreed to by the Covered Entity to satisfy the Covered Entity' instructions pursuant to such regulation. Upon receipt of a request for amendment from an Individual, Business Associate shall forward such request to the Covered Entity within fifteen (15) calendar days of receipt.

9.3Right to Accounting of Disclosures. Business Associate agrees to document such disclosures of PHI as would be required for the Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. §164.528. Business Associate agrees to maintain and provide to the Covered Entity such information collected in order to permit the Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. §164.528. Upon receipt of a request for an accounting of disclosures Business Associate shall forward the request to the Covered Entity within fifteen (15) calendar days of receipt.

9.4Modifications to Individual Rights. Business Associate shall comply with any request from Covered Entity to comply with Individuals' requests to restrict the uses and disclosures of their PHI under 45 C.F.R. §164.522.

10.Prohibition on Sale of PHI

Business Associate shall not receive or provide direct or indirect remuneration in exchange for any PHI in a manner that would violate Section 13405(d) of HITECH or 45 C.F.R. §164.502(a)(5)(ii).

11.Inspection of Books and Records

Business Associate shall make its internal practices, books, records, and policies and procedures relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of, the Covered Entity, available to the DHHS Office for Civil Rights ("OCR"), or their agents, or to the Covered Entity for purposes of monitoring compliance with the HIPAA Rules and the HITECH Act. Such information shall be made available in a time and manner designated by the Covered Entity, DHHS or OCR.

12.Obligations of Covered Entity

12.1Notice of Privacy Practices. Covered Entity shall provide Business Associate with the Covered Entity’s then-current Notice of Privacy Practices.

12.2Revocation of Permitted Use or Disclosure of PHI. Covered Entity shall notify Business Associate of any changes in, or revocation of, permission by a patient to use or disclose PHI of Covered Entity, to the extent that such changes may affect Business Associate’s use or disclosure of PHI.

12.3Restrictions on Use or Disclosure of PHI. Covered Entity shall notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 C.F.R. § 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI.

12.4Requested Uses or Disclosures of PHI. Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Regulations if done by Covered Entity.

13.Term and Termination

13.1Term. This BAA shall commence on the Effective Date and end with the termination of the Services Agreement, unless terminated sooner pursuant to this Section 13.

13.2Termination for Breach. As provided under 45 C.F.R. §164.504(e)(2)(iii), the Covered Entity may immediately terminate the Services Agreement and any related agreements if the Covered Entity determines that Business Associate has breached a material term of this BAA after Covered Entity shall have provided Business Associate with written notice of the existence of the breach, stating with particularity the nature of the breach, and shall have provided Business Associate with thirty (30) calendar days to cure said breach.

13.3Termination of Subcontractor. If Covered Entity determines that a Subcontractor of Business Associate has breached a material term of this BAA, Covered Entity shall provide Business Associate with written notice of the breach, stating with particularity the nature of the breach, and provide Business Associate with thirty (30) calendar days to require Subcontractor to cure said breach. Failure by Business Associate to cure a breach or violation by the Subcontractor, in the manner set forth above, shall be grounds for immediate termination of the Services Agreement.

13.4Effect of Termination. Upon termination of the Services Agreement, Covered Entity may, in its sole discretion, recover all PHI relating to Covered Entity in the possession of Business Associate and its Subcontractors, agents, or representatives. Business Associate shall return to Covered Entity or destroy all such PHI, and shall retain no copies. If Business Associate reasonably believes that it is not feasible to return or destroy all PHI as described above, Business Associate shall ensure that any and all protections, requirements and restrictions contained in this BAA shall be extended to any PHI retained after the termination of this BAA, and that any further uses and/or disclosures shall be limited to the purposes that make the return or destruction of the PHI infeasible.

14.Notices

All notices or other communications required or permitted hereunder shall be in writing and shall be deemed given or delivered (a) when delivered personally, against written receipt, (b) if sent by registered or certified mail, return receipt requested, postage prepaid, when received, (c) when received by email transmission, and (d) when delivered by a nationally recognized overnight courier service, prepaid, and in the case of Business Associate, shall be sent to the address set forth in the introductory paragraph of this BAA (with a copy to legal@carebrain.com), and in the case of Covered Entity, at the address provided in the Services Agreement or in the account registration information provided at the time of enrollment, or by email to the email address associated with the Authorized User’s account.

15.Miscellaneous

15.1Regulatory References. A citation in this BAA to the Code of Federal Regulations shall mean the cited section as that section may be amended from time to time.

15.2Amendment. This BAA may be amended or modified only in a writing signed by the Parties. Business Associate may update this BAA from time to time, including to reflect changes in the HIPAA Rules, by making the updated version available through the Platform with a new version date. Acceptance of an updated version in accordance with Section 16 shall constitute a writing signed by the Parties for purposes of this Section 15.2, and the updated version shall take effect upon such acceptance.

15.3Interpretation/Integration. Any ambiguity in this BAA shall be interpreted to permit compliance with HIPAA, the HIPAA Rules, and HITECH. This BAA supersedes any prior version of this BAA accepted through the Platform. Notwithstanding the foregoing or anything to the contrary in this BAA, if Covered Entity and Business Associate have executed a separate business associate agreement by handwritten or electronic signature outside of the Platform sign-in process (for example, through DocuSign or as an exhibit to a master services agreement) (a “Negotiated BAA”), the Negotiated BAA shall govern and control, this BAA shall not supersede or amend the Negotiated BAA, and this BAA shall apply only to the extent the Negotiated BAA does not cover the services Business Associate provides to Covered Entity.

15.4Governing Law; Venue. This BAA shall be governed by and construed in all respects under the governing law identified in the Services Agreement. To the extent that the Services Agreement is silent on such matters, the laws of the Commonwealth of Virginia shall govern.

15.5No Third Party Beneficiaries. Nothing express or implied in this BAA is intended to confer, nor shall anything herein confer, upon any person other than the Parties and the respective successors and permitted assigns of the Parties, any rights, remedies, obligations, or liabilities whatsoever.

15.6Assignment. This BAA may only be assigned in accordance with the terms and conditions of the Services Agreement.

15.7Binding Effect. The provisions of this BAA shall be binding upon and shall inure to the benefit of the Parties and their respective heirs, executors, administrators, legal representatives, successors and assigns.

16.Electronic Acceptance and Execution

16.1Acceptance by Covered Entity. Business Associate makes its services available through app.carebrain.com, admin.carebrain.com, and the Carebrain mobile applications, including access through PointClickCare or another single sign-on provider (collectively, the “Platform”). Each Platform sign-in and account creation screen displays a notice stating that, by continuing, the user agrees to the Carebrain Terms & Conditions, this BAA, and the Carebrain Privacy Policy, each of which is available through a hyperlink in that notice. When an individual creates an account on, or signs in to, the Platform after that notice is displayed and selects “Continue with email,” “Continue with PointClickCare,” “Create account,” or any other action that proceeds past the notice (such individual, an “Authorized User”), that action constitutes (a) Covered Entity’s acceptance of this BAA and (b) the Authorized User’s electronic signature of this BAA on behalf of Covered Entity. The Parties consent to conduct this transaction by electronic means and agree that such electronic signature has the same force and effect as a handwritten signature under the Electronic Signatures in Global and National Commerce Act (15 U.S.C. § 7001 et seq.) and the Uniform Electronic Transactions Act as adopted in the applicable state. If Covered Entity does not agree to this BAA, the Authorized User must not proceed and may not access the Platform.

16.2Authority. The Authorized User represents and warrants that he or she is authorized to accept this BAA on behalf of Covered Entity. If the Authorized User is an individual health care provider using the Platform on his or her own behalf, the Authorized User is the Covered Entity. If the Authorized User is not authorized to bind Covered Entity and this BAA has not otherwise been accepted on Covered Entity’s behalf, the Authorized User shall not create, receive, maintain, or transmit PHI through the Platform until an authorized representative of Covered Entity accepts this BAA or the Parties execute a Negotiated BAA. Covered Entity’s use of the Platform, including permitting members of its workforce to create, receive, maintain, or transmit PHI through the Platform, constitutes Covered Entity’s ratification of this BAA.

16.3Business Associate Signature. Business Associate has executed this BAA by the electronic signature of its authorized officer set forth below. That signature is adopted in advance and is effective as to each Covered Entity as of the Effective Date applicable to that Covered Entity, without any further action by Business Associate.

16.4Acceptance Record. Business Associate shall maintain an electronic record of each acceptance of this BAA, including the Authorized User’s name and email address, the Covered Entity associated with the Authorized User’s account, the date and time of acceptance, the sign-in method, the IP address or device identifier, and the version of this BAA accepted (the “Acceptance Record”). Business Associate shall retain each Acceptance Record for at least six (6) years from the later of the date of its creation or the date this BAA was last in effect, consistent with 45 C.F.R. §§ 164.316(b)(2) and 164.530(j). The Acceptance Record completes the Covered Entity signature block below, and this BAA together with the Acceptance Record shall be treated as an executed original. Upon written request to legal@carebrain.com, Business Associate shall provide Covered Entity with a copy of this BAA and the applicable Acceptance Record.

16.5Subsequent Sign-Ins. Each subsequent sign-in to the Platform by an Authorized User after the notice described in Section 16.1 is displayed reaffirms Covered Entity’s acceptance of the then-current version of this BAA, including any updated version made available in accordance with Section 15.2.