Source: https://www.startboxor.com/baa
Timestamp: 2019-04-26 11:58:28+00:00

Document:
This Agreement is governed by the Electronic Signatures in Global and National Commerce Act. You manifest your agreement to the terms and conditions in this Agreement by any act demonstrating your assent thereto, including clicking any button containing the words “I agree” or similar syntax, by accessing the Service, by establishing an account, or using the Service, whether you have read this Agreement or not. You should print a copy of this Agreement for your personal records. This Agreement may be changed by StartBox as provided in Section 7 below. By continuing to access or use the Service after the effective date of any such change, you agree to be bound by the modified Agreement.
Terms used, but not otherwise defined in this Agreement, shall have the same meaning as those terms in the Privacy Rule, Security Rule, and HITECH Act.
“Breach” shall have the same meaning as the term “breach” in 45 CFR § 164.402.
“Data Aggregation” shall have the same meaning as the term “data aggregation” in 45 CFR § 164.501.
“Designated Record Set” shall have the same meaning as the term “designated record set” in 45 CFR § 164.501.
“Disclosure” and “Disclose” shall have the same meaning as the term “disclosure” in 45 CFR § 160.103.
“Electronic Health Record” shall have the same meaning as the term in Section 13400 of the HITECH Act.
“HITECH Act” shall mean The Health Information Technology for Economic and Clinical Health Act, part of the American Recovery and Reinvestment Act of 2009, specifically DIVISION A: TITLE XIII Subtitle D - Privacy, and its corresponding regulations as enacted under the authority of the Act.
“Minimum Necessary” shall mean the Privacy Rule Standards found at §164.502(b) and § 164.514(d)(1).
“Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR Part 160 and Part 164, Subparts A and E.
"Protected Health Information" shall have the same meaning as the term "protected health information" in 45 CFR § 160.103, limited to the information created, received, maintained or transmitted by StartBox on your behalf.
"Required By Law" shall have the same meaning as the term "required by law" in 45 CFR § 164.103.
"Secretary" shall mean the Secretary of the Department of Health and Human Services or his or her designee.
“Security Incident” shall have the same meaning as the term “security incident” in 45 CFR § 164.304.
“Security Rule” shall mean the Standards for Security of Electronic Protected Health Information at 45 C.F.R. parts § 160 and § 164, Subparts A and C.
“Subcontractor” shall mean a person or entity “that creates, receives, maintains, or transmits protected health information on behalf of a business associate” and who is now considered a business associate, as the latter term is defined in 45 CFR § 160.103.
“Subject Matter” shall mean compliance with the HIPAA Rules and with the HITECH Act.
“Unsecured Protected Health Information” shall have the same meaning as the term “unsecured protected health information” in 45 CFR § 164.402.
“Use” shall have the same meaning as the term “use” in 45 CFR § 164.103.
StartBox agrees to not Use or Disclose Protected Health Information other than as permitted or required by this Agreement or as Required By Law.
StartBox agrees to use appropriate safeguards to prevent Use or Disclosure of Protected Health Information other than as provided for by this Agreement. StartBox further agrees to implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of any electronic Protected Health Information, as provided for in the Security Rule and as mandated by Section 13401 of the HITECH Act.
StartBox agrees to mitigate, to the extent practicable, any harmful effect that is known to us resulting from our Use or Disclosure of Protected Health Information in violation of the requirements of this Agreement. StartBox further agrees to report to you any Use or Disclosure of Protected Health Information not provided for by this Agreement of which we become aware, and in a manner as prescribed herein.
StartBox agrees to report any Breach of your Unsecured Protected Health Information to you within ten (10) business days of discovery of said Breach; all other compromises of your Protected Health Information shall be reported to you within twenty (20) business days of discovery. StartBox further agrees, consistent with Section 13402 of the HITECH Act, to provide you, via email or phone call, with information necessary for you to meet the requirements of said section.
StartBox agrees to ensure that any Subcontractor, to whom StartBox provides Protected Health Information, agrees to the same restrictions and conditions that apply through this Agreement to StartBox with respect to such information. StartBox further agrees that restrictions and conditions analogous to those contained herein shall be imposed on said Subcontractors via a written agreement that complies with all the requirements specified in § 164.504(e)(2), and that StartBox shall only provide said Subcontractors Protected Health Information consistent with Section 13405(b) of the HITECH Act.
StartBox agrees to provide you access to Protected Health Information in a Designated Record Set, and make amendments thereto, in order to meet the requirements under the HIPAA Rules and the HITECH Act.
Unless otherwise protected or prohibited from discovery or disclosure by law, StartBox agrees to make internal practices, books, and records, including policies and procedures (collectively “Compliance Information”), relating to the Use or Disclosure of Protected Health Information and the protection of same, available to you or to the Secretary for purposes of the Secretary determining your compliance with the HIPAA Rules and the HITECH Act. StartBox further agrees, upon request, to provide you with demonstrable evidence that its Compliance Information ensures StartBox’s compliance with this Agreement over time. StartBox shall have a reasonable time within which to comply with requests for such access and/or demonstrable evidence, consistent with this Agreement. In no case shall access, or demonstrable evidence, be required in less than ten (10) business days after StartBox’s receipt of such request, unless otherwise designated by the Secretary.
StartBox agrees to maintain necessary and sufficient documentation of Disclosures of Protected Health Information as would be required for you to respond to a request by an Individual for an accounting of such Disclosures, in accordance with 45 CFR §164.528.
Upon request, StartBox agrees to provide to you documentation made in accordance with this Agreement to permit you to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 C.F.R. § 164.528. StartBox shall provide said documentation in a manner and format to be specified by you. StartBox shall have a reasonable time within which to comply with such a request from you and in no case shall StartBox be required to provide such documentation in less than five (5) business days after StartBox's receipt of such request.
Except as provided for in this Agreement, in the event StartBox receives an access, amendment, accounting of disclosure, or other similar request directly from an Individual, StartBox shall redirect the Individual to you.
Except as otherwise limited by this Agreement, StartBox may make any Use and Disclosure of Protected Health Information necessary to perform its services and otherwise meet its obligations under this Agreement, if such Use or Disclosure would not violate the Privacy Rule, or the privacy provisions of the HITECH Act, if done by you. All other Uses or Disclosures by StartBox not authorized by this Agreement, or by your specific instruction, are prohibited.
Except as otherwise limited in this Agreement, StartBox may Use Protected Health Information for the proper management and administration of StartBox or to carry out the legal responsibilities of StartBox.
Except as otherwise limited in this Agreement, StartBox may Disclose Protected Health Information for the proper management and administration of StartBox, provided that Disclosures are Required By Law, or StartBox obtains reasonable assurances from the person to whom the information is Disclosed that it will remain confidential and used, or further Disclosed, only as Required By Law, or for the purpose for which it was Disclosed to the person, and the person notifies StartBox of any instances of which it is aware in which the confidentiality of the information has been breached.
Except as otherwise limited in this Agreement, StartBox may Use Protected Health Information to provide Data Aggregation services to you as permitted by 45 CFR §164.504(e)(2)(i)(B). StartBox further agrees that said services shall not be provided in a manner that would result in Disclosure of Protected Health Information to another covered entity who was not the originator and/or lawful possessor of said Protected Health Information.
StartBox may Use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent with § 164.502(j)(1).
StartBox shall make Uses, Disclosures, and requests for Protected Health Information consistent with the Minimum Necessary principle as defined herein.
You shall notify StartBox of the provisions and any limitation(s) in your notice of privacy practices, to the extent that such provisions and limitation(s) may affect our Use or Disclosure of Protected Health Information.
You shall notify StartBox of any changes in, or revocation of, permission by an Individual to use or disclose Protected Health Information, to the extent that the changes or revocation may affect our use or disclosure of Protected Health Information.
You shall notify StartBox of any restriction to the use or disclosure of Protected Health Information that you have agreed to, and also notify StartBox regarding restrictions that must be honored under section 13405(a) of the HITECH Act, to the extent that such restrictions may affect our Use or Disclosure of Protected Health Information.
You shall notify StartBox of any modifications to accounting disclosures of Protected Health Information under 45 CFR § 164.528, made applicable under Section 13405(c) of the HITECH Act, to the extent that such restrictions may affect our use or disclosure of Protected Health Information.
You shall not require StartBox to Use or Disclose Protected Health Information in any manner that would not be permissible under the HIPAA Rules if done by you.
The Agreement shall terminate when all of the Protected Health Information provided by you to StartBox, or created or received by StartBox on your behal, is destroyed or returned to you, or, if it is infeasible to return or destroy Protected Health Information, protections are extended to such information, in accordance with the termination provisions in this Agreement.
A reference in this Agreement to a section in the Privacy Rule, Security Rule, or HITECH Act means the section as in effect or as amended.
Any ambiguity in this Agreement shall be resolved to permit you and StartBox to comply with the Privacy Rule, Security Rule, the Health Insurance Portability and Accountability Act of 1996 (Pub. L. No. 104-191), and the HITECH Act and its corresponding regulations.

References: § 164
 § 164
 § 164
 § 160
 §164
 § 164
 § 160
 § 164
 § 164
 § 160
 § 164
 § 160
 § 164
 § 164
 § 164
 §164
 § 164
 §164
 § 164
 § 164