1. Catch-all definition:
   The following terms used in this BBA shall have the same meaning as those terms in the HIPAA Rules and Regulations: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, PHI, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured PHI, and Use.
2. Specific definitions:
   1. “Breach” shall have the same meaning as set forth in 45 CFR Section 164.402.
   2. “Business Associate” (“BA”) shall generally have the same meaning as the term “business associate” at 45 CFR Section 160.103.
   3. “Covered Entity” (“CE”) shall generally have the same meaning as the term “covered entity” at 45 CFR Section 160.103.
   4. “Electronic Protected Health Information” shall mean any PHI which is also “electronic protected health information” as that term is defined in 45 CFR Section 160.103.
   5. “HIPAA Rules” and “HIPPA Regulations” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164 and under the HITECH Act.
   6. Individual. “Individual” shall have the same meaning as the term “individual” in 45 CFR Section 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR Section 164.502(g).
   7. Protected Health Information or “PHI” shall have the same meaning as the term “protected health information” in 45 CFR Section 160.103 that is created, received, maintained, transmitted, or accessed by BA from and on behalf of CE.
   8. Security Incident” means the attempted or successful unauthorized access, use, disclosure, modification, destruction of information or interference with system operations in an information system.

Business Associate agrees to:

1. Not use or disclose PHI other than as permitted or required by this BBA or as required by law;
2. Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this BBA;
3. Report, in writing, to covered entity any use or disclosure of PHI not provided for by this BBA of which it becomes aware, including breaches of unsecured PHI as required at 45 CFR Section 164.410, and any Security Incident of which it becomes aware, without unreasonable delay and in no case later than three (3) days after discovery;
4. Breach notifications to individuals, The HHS Office for Civil Rights (“OCR”), and potentially the media, will be handled by the CE. BA agrees to pay the actual costs of CE for such notifications, as long as the nature of the breach has been determined to have been caused by the BA or BA’s Subcontractor(s).
5. In accordance with 45 CFR Sections 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the BA agree to the same or more stringent restrictions, conditions, and requirements that apply to the BA with respect to such information;
6. Make available PHI in a designated record set to the CE for inspection and copying within five (5) days of a request by CE to enable CE to fulfill its obligations under 45 CFR Section 164.524;
7. Make any amendment(s) to PHI in a designated record set as directed or agreed to by the CE pursuant to 45 CFR Section164.526, within thirty (30) days of receipt of a request from the CE or take other measures as necessary to satisfy CE’s obligations under 45 CFR Section164.526;
8. Maintain and make available, within thirty (30) days of notice by CE or a request, the information required to provide an accounting of disclosures to the CE as necessary to satisfy CE’s obligations under 45 CFR Section164.528;
9. To the extent the BA is to carry out one or more of CE’s obligation(s) under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to the CE in the performance of such obligation(s); and
10. Make its internal practices, books, and records available to CE and the OCR for purposes of determining compliance with the HIPAA Rules.
11. To mitigate, to the extent practicable, any harmful effect that is known to BA of a use or disclosure of PHI in violation of the requirements of this BBA and shall cooperate with CE in the mitigation process.
12. To acknowledge and agree that it shall have no ownership rights with respect to the PHI.
13. To the extent that BA is to carry out one or more covered obligations under the Privacy Rule, Security Rule, Breach Notification Rule, and any and all other applicable state and federal laws and regulations.

1. BA may only use or disclose PHI for the sole purpose of performing BA’s obligations as directed by CE and as permitted under this BAA.
2. BA may use or disclose PHI as required by law.
3. BA agrees to make uses and disclosures and requests for only the minimum amount of PHI necessary to accomplish the purpose of the request, use or disclosure.
4. BA may not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by CE, except for the specific uses and disclosures set forth in paragraphs 5 and 6 below.
5. BA may disclose PHI for the proper management and administration of BA or to carry out the legal responsibilities of the BA, provided the disclosures are required by law, or BA obtains reasonable written assurances from the third party to whom the information is disclosed that the information will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the third party, and a written agreement from the third party is in place outlining that the third party immediately notifies BA of any instances of which it is aware in which the confidentiality of the information has been breached.
6. BA may provide data aggregation services relating to the health care operations of the CE.
7. BA shall not (a) use or disclose PHI for fundraising or marketing purposes, except as provided in a separate contract between CE and BA, and consistent with the requirements of 42 U.S.C. Section 17936; (b) shall not disclose PHI to a health plan for payment or health care operations purposes if the patient has requested this special restriction and has paid out of pocket in full for the health care item or service to which the PHI solely relates, 42 U.S.C. Section 17935(a); and (c) shall not directly or indirectly receive remuneration in exchange for PHI, except with the prior written consent of CE and as permitted by the HITECH Act, 42 U.S.C Section 17935 (d)(2); however, this prohibition shall not affect payment by CE to BA for services provided at the direction of CE.
8. BA shall not use PHI to create de-identified Health Information in accordance with 45 CFR Section 164.514(b) for purposes unrelated to this BBA without prior written approval of CE.

1. CE shall notify BA of any limitation(s) in the notice of privacy practices of CE under 45 CFR Section 164.520, to the extent that such limitation may affect BA’s use or disclosure of PHI.
2. CE shall notify BA of any restriction on the use or disclosure of PHI that CE has agreed to or is required to abide by under 45 CFR Section 164.522, to the extent that such restriction may affect BA’s use or disclosure of PHI.

1. Material Breach. If either Party (CE or BA) knows of a pattern of activity or practice of the other Party that constitutes a material breach or violation of the BAA, or other arrangement, then the non-breaching Party shall provide written notice of the breach or violation to the other Party that specifies the nature of the breach or violation. The breaching Party must cure the breach or end the violation on or before thirty (30) days after receipt of the written notice. In the absence of a cure reasonably satisfactory to the non-breaching Party within the specified time frame, or in the event the breach is reasonably incapable of cure, then the non-breaching Party may do the following: (a) if feasible, terminate the arrangement; or (b) if termination of the arrangement is infeasible, report the issue to the Secretary of the HHS.
2. Obligations of BA Upon Termination.
   1. Upon termination of this Agreement for any reason, BA shall return to CE (or, if agreed to by CE, destroy) all PHI received from CE, or created, maintained, or received by BA or its agents or subcontractors on behalf of CE, that the BA or its agents or subcontractors still maintain in any form. BA shall retain no copies of the PHI. BA shall certify in writing to CE that such PHI has been destroyed.
   2. If return or destruction of said PHI is not feasible, as determined by CE, BA shall continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI to prevent use or disclosure of the PHI other than for those purposes that make the return or destruction of such PHI infeasible.
3. Survival. The obligations of BA under this Section shall survive the termination of this Agreement.

1. Amendment. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with the requirements of the HIPAA Rules and any other applicable law.
2. Assistance in Litigation. BA shall make itself and any subcontractors, employees or agents assisting BA in the performance of its obligations under this BAA or any other arrangements between CE and BA available to CE, at no cost to CE, to testify as witnesses, or otherwise, in the event of litigation or administrative proceedings being commenced against CE, its directors, officers or employees based upon a claim of violation of HIPAA, the HITECH Act, or other laws related to security and privacy, except where BA or its subcontractor, employee or agent is named as an adverse party.
3. Indemnification; Limitation of Liability. BA shall defend, indemnify and hold harmless CE, its parent and subsidiary corporations, officers, directors, employees, and agents from any and all claims, inquiries, investigations, costs, reasonable attorneys’ fees, monetary penalties, and damages incurred by CE to the extent resulting directly or indirectly from any acts or omissions of BA, including without limitation breach of this BAA by BA.
   1. CE shall defend, indemnify and hold harmless BA and its representatives for any and all claims, inquiries, investigations, costs, reasonable attorneys’ fees, monetary penalties, and damages incurred by BA and its representatives to the extent resulting directly or indirectly from any acts or omissions of CE, including without limitation breach of this BAA by CE.
   2. This provision shall survive the termination of the BAA.
4. Interpretation. Any ambiguity in this Agreement shall be interpreted to permit compliance with the HIPAA Rules.
5. No Third-Party Beneficiaries. Nothing express or implied in the BAA is intended to confer, nor shall anything herein confer upon any person other than CE, BA and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.
6. Notices. All notices or other communications required or permitted hereunder shall be in writing and shall be deemed given or delivered (a) when delivered personally, against written receipt, (b) if sent by registered or certified mail, return receipt requested, postage prepaid, when received, (c) when received by facsimile transmission, and (d) when delivered by a nationally recognized overnight courier service, prepaid, and shall be sent to the addresses set forth below or at such other address as each party may designate by written notice to the other by following this notice procedure.
7. Regulatory References. A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended.
8. Authority. The undersigned representative acknowledges and warrants that he/she has the authority to bind the entity BA.