Source: https://www.mdereferral.com/BusinessAssociateAgreement.aspx
Timestamp: 2019-04-26 16:21:32+00:00

Document:
THIS BUSINESS ASSOCIATE AGREEMENT (the "Agreement"), effective as of the sign up date on the login information page of the MDeReferral.Com website, by and between Porteck with an office at 260 Madison Avenue, 8th Floor, New York New York 10016 (hereinafter referred to in this Agreement as “MDeReferral.Com”) and the provider (hereinafter referred to in this Agreement as "Covered Entity") as entered in the MDeReferral.Com’s login information page with the location(s) as indicated on said location page(which locations are incorporated into this Agreement and made a part hereof by reference).
WHEREAS, MDeReferral.Com shall have access to and/or receive from Covered Entity (hereafter defined) certain information that can be used or disclosed only for the purposes under which such Business Associate has been retained by the Covered Entity, and in accordance with this Agreement and the Privacy Rule.
WHEREAS, Business Associate hereby acknowledges and agrees that Covered Entity is a covered entity and that Business Associate is a Business associate of Covered Entity under HIPAA and the HIPAA Regulations.
a. Any terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms have under HIPAA and the HIPAA Regulations.
b. "Business Associate" shall mean MDeReferral.Com and its agents, servants, staff and/or employees as well as and any and all subsidiaries, subdivisions and/or related affiliates.
c. "Breach" shall have the same meaning as the term “breach” in 45 C.F.R. § 164.402.
d. "Covered Entity" shall mean the provider as entered in the login information page of the website and its respective agents, servants, staff and/or employees as well as and any and all subsidiaries, subdivisions and/or related affiliates.
e. "HIPAA" means Title II, Subtitle F, "Administrative Simplification," of the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191.
f. "HIPAA Regulations" means the regulations promulgated under HIPAA by the United States Department of Health and Human Services, including, but not limited to, 45 CFR Part 160 and 45 CFR part 164.
g. "Individual" shall have the same meaning as the applicable term "individual" in 45 CFR § 160.103 and/or 45 CFR § 164.501 and shall include a person who qualifies as a personal representative in accordance with 45 CFR § 164.502(g).
h."Law Enforcement Official" shall have the same meaning as the term "law enforcement official"in 45 C.F.R. § 164.103.
j. "Protected Health Information" shall have the same meaning as the term "protected health information" in 45 CFR §164.501 and/or 45 CFR §160.103, now or as hereafter amended, including information received from, created and/or received by Business Associate on behalf of Covered Entity including demographic information collected from an Individual which relates to the past, present and/or future physical and/or mental health and/or condition of an Individual, the provision of health care to an Individual, or the past, present and/or future payment for the provision of health care to an Individual, which information identifies the Individual and/or with respect to which there is a reasonable basis upon which to believe that the information can be used to identify the Individual, but is all limited to the extent the Protected Health Information created and/or received by the Business Associate from or on behalf of the Covered Entity.
k. "Required by Law" shall have the same meaning as the term "required by law" in 45 CFR § 164.501 and/or 45 CFR §164.103, now or as hereafter amended.
l. "Secretary" shall mean the Secretary of the Department of Health and Human Services or his designee.
m. "Services" means those specific activities and/or functions for which Covered Entity engages Business Associate to perform for Covered Entity and/or on Covered Entity’s behalf. Such engagement(s) may be by written and/or oral agreement entered into before or after the date of this Agreement.
n. "Unsecured Protected Health Information" and/or "UPHI" shall have the same meaning as the term "unsecured protected health information" in 45C.F.R. § 164.402.
o. Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in 45 CFR Part 160 and Part 164, now or as hereafter amended.
(iv) Use Protected Health Information to provide Data Aggregation services to Covered Entity as permitted by 42 CFR §164.504(e)(2)(i)(B).
(xix) The provisions of this Section 3 shall survive the termination of this Agreement.
4.Obligation of the Covered Entity.
a. Covered Entity agrees to provide Business Associate with its Notice of Privacy Practices that the Covered Entity must post in accordance with the Privacy Rule. Covered Entity also agrees to provide Business Associate with any changes to that Notice.
b. Covered Entity agrees to provide Business Associate with any changes in, or revocation of, permission by an Individual to use or disclose PHI, if such changes affect Business Associate’s permitted uses and disclosures.
c. Covered Entity agrees not to request Business Associate to use or disclose PHI in any manner that would not be permissible under the Privacy Rule.
d. Covered Entity agrees to notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with the Privacy Rule to the extent that such restrictions may affect Business Associate’s use or disclosure of PHI.
b. Upon Covered Entity’s knowledge of a material breach of this Agreement by Business Associate, Covered Entity shall provide a reasonable opportunity for Business Associate to cure the breach, and Covered Entity may terminate this Agreement (and, if applicable, any agreement pursuant to which Services are provided) if Business Associate does not cure the breach within a reasonable amount of time after notice is provided to the Business Associate, or may immediately terminate this Agreement (and, if applicable, any agreement pursuant to which Services are provided) if Business Associate has breached a material term of this Agreement and cure is not possible. Business Associate shall be required to mitigate the damages caused by its breach whether or not Covered Entity terminates this Agreement.
b. In the event that Business Associate determines that returning or destroying Protected Health Information is unfeasible, Business Associate shall provide to Business Associate notification of the conditions that make return or destruction infeasible. Upon delivering such notification that return or destruction of Protected Health Information is infeasible, Business Associate shall extend the protections of this Agreement to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction unfeasible, for so long as Business Associate maintains such Protected Health Information. This provision shall survive termination or expiration of this Agreement for any reason.
a. The parties agree to negotiate in good faith any modification to this Agreement that may be necessary or required to ensure consistency with amendments to and changes in applicable Federal and State laws and regulations, including but not limited to, the HIPAA and/or HITECH Regulations. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for Covered Entity to comply with the requirements of the Privacy Rule and the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191 and the Health Insurance Technology for Economic and Clinical Health Act.
a. A reference in this Agreement to a section in the HIPAA and/or HITECH Regulations means the section as now in effect or as hereafter amended. This Agreement constitutes the entire Agreement between Covered Entity and Business Associate regarding the subject matter hereof and supersedes and controls over any and all oral or written proposals, purchase orders, representations, understandings and/or agreements, if any, previously made and/or existing with respect to any matter contained in this Agreement and none of the same have been relied upon by any party hereto. Without limiting the generality of the foregoing, in the event of a conflict between the terms of this Agreement and any prior agreement (written or oral) pursuant to which Business Associate is providing Services, the terms of the Agreement shall be controlling and such prior agreement shall be deemed to be amended hereby to the extent necessary to resolve such conflict. Any ambiguity in this Agreement shall be resolved in favor of a meaning that requires or permits Covered Entity to comply with the HIPAA and/or HITECH Regulations. Subject to HIPAA and/or HITECH, this Agreement shall be governed by and construed in accordance with the laws of the State of New York applicable to agreements made and to be performed entirely within such State, without regard to principles of conflicts of law. Nothing express or implied in this Agreement is intended to confer, nor shall anything herein confer, upon any person other than Covered Entity, Business Associate and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever. All title to the physical medical records, medical charts and other PHI shall remain the sole property of Covered Entity. Covered Entity and Business Associate agree that amendment of this Agreement may be required to ensure that Covered Entity and Business Associate comply with changes to State and/or Federal laws and regulations relating to the privacy, security, and confidentiality of PHI. Covered Entity may terminate this Agreement upon 14 days written notice in the event that Business Associate does not promptly enter into an amendment that Covered Entity, in its sole discretion, deems sufficient to ensure that Covered Entity will be able to comply with such laws and regulations. Nothing in this Agreement shall be construed to require Business Associate to use or disclose Protected Health Information without a written authorization from an individual who is a subject of the Protected Health Information, or written authorization from any other person, where such authorization would be required under state law for such use or disclosure. Covered Entity and Business Associate agree that any violation of the provisions of this Agreement may cause irreparable harm to Covered Entity. Accordingly, in addition to any other remedies available to Covered Entity at law, in equity, or under this Agreement, Covered Entity shall be entitled to an injunction or other degree of specific performance with respect to any violation of this Agreement or explicit threat thereof; without any bond or other security being required and without the necessity of demonstrating actual damages. To the extent that any provisions of this Agreement conflict with the provisions of any other agreement or understanding between the parties, this Agreement shall control.
IN WITNESS WHEREOF, the parties have agreed to this Agreement with the intention to be legally bound hereby on the date indicated on the login information page of the MDeReferral.Com’s website by clicking on the check box on MDeReferral.Com’s Login Information page of said website.

References: § 164
 § 160
 § 164
 § 164
 § 164
 §164
 §160
 § 164
 §164
 § 164
 §164