Source: https://www.yprime.com/privacy/
Timestamp: 2020-08-10 09:19:32
Document Index: 258966359

Matched Legal Cases: ['§160', '§164', '§164', 'art 164', '§ 160', 'art 160', 'art 164', 'art 160', 'art 162', 'art 164', '§13404', '§164', '§164', '§164', '§164', '§ 164', '§ 164', '§164', '§514', '§164', '§13405', '§164', '§164']

privacy - YPrime
YPrime, INC. Privacy Policy
YPRIME, LLC.
YPrime, LLC (“we,” “our,” or “us”) respects and is committed to protecting your privacy. That is why we have adopted this Privacy Policy. This Privacy Policy lets you know how and for what purposes we are collecting, processing and using your Personal Information (as defined herein). We pledge that we will take reasonable steps to ensure that your Personal Information will only be used in ways that are in compliance with this Privacy Policy.
This Privacy Policy is in effect for any web page, third party social media site, generic information, and Personal Information collected and/or owned by us, no matter the method of collection (e.g., mail, facsimile, sign-up/sign-in page, survey, contest, promotion), including collection through this website and any online features, services and/or programs we offer (collectively, the “Web Properties”). Notwithstanding the foregoing, this Privacy Policy is not applicable to any other web page, mobile application, social media site, generic information or Personal Information collected and/or owned by any entity other than YPrime. Users of the foregoing resources of entities other than YPrime should refer to the Privacy Policy in effect for the applicable owner.
Your use of the Web Properties is also governed by the Terms and Conditions found here.
Contact Information. Contact information refers to the information that you intentionally provide to us when you submit a request to be contacted. This information may include Personal Information such as your name, address, phone number, and email address, as well as any other information that you may voluntarily provide through the Web Properties. We collect this information only for purposes of responding to requests for more information about YPrime and our offerings. When you submit contact information, you accept that this information will be shared with our content providers and other professionals, contractors and staff that may be able to assist you.
You can opt-out via the IAB UK’s industry opt-out at www.youronlinechoices.com.
To communicate with you and to inform you about YPrime’s and third parties’ products and services. When requested by you, we (and/or any of our third party service providers) may send you and keep you updated with information about existing and new services, products, and special offers, by email, telephone, mail or by means of any other contact details you provide to us or our affiliates, or to such third party service providers.
To obtain this information, please send an email message to privacy@yprime.com with “Request for California Privacy Information” in the subject line and in the body of your message. We will provide the requested information to you at your email address in response.
Your disclosure to us of any “protected health information” (as defined pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”)) shall be subject to the Business Associate Agreement appended to the end of this Privacy Policy. We make no representation or warranty that the Business Associate Agreement is necessary for the compliance by you with HIPAA or other applicable law or regulation regarding any such protected health information. You are fully responsible for your actions with respect to any such protected health information, and agree to indemnify, defend and hold harmless YPrime for and against any violations by you of HIPAA or any other applicable law or regulation regarding any such protected health information.
privacy@yprime.com
Copyright © 2019. YPrime, Inc. All Rights Reserved.
The following capitalized terms, as used in this Business Associate Agreement (this “Agreement”), shall have the meanings set forth below. Terms used, but not otherwise defined in this Agreement shall have the same meaning as those terms in 45 C.F.R. §160.103, §164.304, and §164.501.
1.1. “Administrative Safeguards” shall have the same meaning as the term “administrative safeguards” set forth in the Security Regulations.
1.2. “Breach” shall have the meaning set forth in the Breach Notification Regulations.
1.3. “Breach Notification Regulations” shall mean Subpart D of Part 164, entitled “Notification in the Case of Breach of Unsecured Protected Health Information.”
1.4. “Business Associate” shall mean YPrime, LLC.
1.5. “Covered Entity” shall have the meaning given to such term under the Privacy Rule and Security Rule, including, but not limited to, 45 C.F.R. § 160.103, and may include users of the website to which this Agreement applies.
1.6. “Data Aggregation” shall have the same meaning as the term “data aggregation” set forth in the Privacy Rule.
1.7. “Electronic Health Record” shall mean an electronic record of health-related information on an individual that is created, gathered, managed, and consulted by authorized health care clinicians and staff.
1.8. “Electronically Maintained” shall mean information stored by a computer or on any electronic medium from which information may be retrieved by a computer, such as electronic memory chips, magnetic tape, disk, or compact disc media.
1.9. “Electronically Transmitted” shall mean information exchanged with a computer using electronic media, such as the movement of information from one location to another using magnetic tape, disk or compact disc media; transmissions over the Internet, Extranet, leased lines, dial-up lines, or private networks; but excluding information exchanged using paper-to-paper facsimiles, person-to-person telephone calls, video teleconferencing, voicemail messages, telephone voice response or “faxback” systems.
1.10. “Individual” shall have the same meaning as the term “individual” in the Privacy Rule.
1.11. “Physical Safeguards” shall have the meaning set forth in the Security Regulations.
1.12. “Privacy Official” shall have the meaning set forth in the Privacy Regulations.
1.13. “Privacy Regulations” shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 C.F.R. part 160 and part 164, subparts A and E, as such provisions are currently drafted and as they are subsequently amended or revised.
1.14. “Protected Health Information” shall have the meaning set forth in the Privacy Regulations.
1.15. “Required by Law” shall have the meaning set forth in the Privacy Regulations.
1.16. “Secretary” shall mean the Secretary of the Department of Health and Human Services or his or her designee.
1.17. “Security Incident” shall have the meaning set forth in the Security Regulations.
1.18. “Security Regulations” shall mean the Security Standards at 45 C.F.R. part 160, part 162, and part 164, subparts A and C, as such provisions are currently drafted and as they are subsequently amended or revised.
1.19. “Technical Safeguards” shall have the meaning set forth in the Security Regulations.
1.20. “Unsecured Protected Health Information”, as used in Section 3.1(n), below, shall have the meaning set forth under §13404(h) of the HITECH Act, as such provision is currently drafted and as it is subsequently amended or revised.
2.1. Services. Subject to the limitations of this Agreement and the Privacy Rule, Business Associate may use and disclose Protected Health Information as necessary to perform its obligations to Covered Entity. Business Associate may not use or disclose Protected Health Information in a manner that would violate the Privacy Regulation if done by Covered entity, except for those uses and disclosures set forth in Section 2.2 hereof. All other uses and disclosures not authorized by this Agreement are prohibited. Without limiting the generality of the foregoing Business Associate may disclose Protected Health Information for the purposes authorized by this Agreement only: (a) to its employees, subcontractors and agents, in accordance with Section 3.1(d), below, (b) as directed by Covered Entity, or (c) as otherwise permitted by the terms of this Agreement including, but not limited to, Section 2.2 below.
2.2. Business and Other Activities of Business Associate. The Business Associate may:
(a)Use the Protected Health Information for the proper management and administration of Business Associate and to fulfill any present or future legal responsibilities of Business Associate provided that such uses are permitted under state and federal confidentiality law.
(b)Disclose the Protected Health Information to third parties for the proper management and administration of Business Associate or to fulfill any present or future legal responsibilities of Business Associate, provided that: (i) the disclosures are Required by Law, or (ii) Business Associate has received from the third party written assurances regarding the confidential treatment of such Protected Health Information as required under 45 C.F.R. §164.504(e)(4)(ii)(B)(1), and that the third party will notify Business Associate of any instances of which it is aware in which the confidentiality of the Protected Health Information has been breached.
(c)Use Protected Health Information to create de-identified information, as defined in the Privacy Regulation, for use by Covered Entity or Business Associate.
3.OBLIGATIONS OF THE PARTIES WITH RESPECT TO PROTECTED HEALTH INFORMATION.
3.1. Obligations of Business Associate. With regard to the use and/or disclosure of Protected Health Information, Business Associate hereby agrees to do the following:
(a)Use and/or disclose the Protected Health Information only as permitted or required by this Agreement or as otherwise required by law.
(b)Report to the designated Privacy Official of Covered Entity any use and/or disclosure of the Protected Health Information that is not permitted or required by this Agreement of which Business Associate becomes aware. Oral reports shall be made within two (2) business days following discovery, and shall be followed promptly by a written report based on subsequently developed information.
(c)Use reasonable and appropriate safeguards to maintain the security of the Protected Health Information and to prevent unauthorized use and/or disclosure of such Protected Health Information.
(d)Require all of its subcontractors and agents that receive or use, or have access to, Protected Health Information under this Agreement to agree, in writing, to adhere to materially the same restrictions and conditions on the use and/or disclosure of Protected Health Information that apply to Business Associate pursuant to this Section 3.
(e)Make available all records, books, agreements, policies and procedures relating to the use and/or disclosure of Protected Health Information to Covered Entity or the Secretary, in a time and manner designated by Covered Entity or the Secretary, for purposes of the Secretary determining Covered Entity’s compliance with the Privacy Regulations and the Security Regulations, subject to attorney-client and other applicable legal privileges.
(f)Within ten (10) calendar days of receiving a written request from Covered Entity, provide to Covered Entity such information as is requested by Covered Entity to permit Covered Entity to respond to a request by an Individual under 45 C.F.R. §164.524, which entitles Individuals access to their own Protected Health Information.
(g)Within ten (10) calendar days of receiving a written request from Covered Entity, provide to Covered Entity such information as is requested by Covered Entity to permit Covered Entity to respond to a request by an Individual for an amendment of the Individual’s Protected Health Information under 45 C.F.R. §164.526. Accordingly, Business Associate will promptly incorporate any amendment(s) to the Protected Health Information that Covered Entity directs or agrees to be made.
(h)Within ten (10) calendar days of receiving a written request from Covered Entity, provide to Covered Entity such information as is requested by Covered Entity to permit Covered Entity to respond to a request by an Individual for an accounting of the disclosures of the Individual’s Protected Health Information in accordance with 45 C.F.R. §164.528.
(i)Except as otherwise provided in this Agreement, in the event Business Associate receives an access, amendment, accounting of disclosure, or other similar request directly from an Individual, with respect to Protected Health Information subject to this Agreement, Business Associate will promptly redirect the Individual to Covered Entity.
(j)Subject to Section 4.3, below, return to Covered Entity or destroy, within sixty (60) calendar days of the termination of this Agreement, the Protected Health Information in its possession and retain no copies (which for purposes of this Agreement shall include all backup tapes or files).
(k)Disclose to its subcontractors, agents or other third parties, and request from Covered Entity, only the minimum Protected Health Information necessary to perform or fulfill a specific function permitted hereunder. Without limiting the foregoing, to the extent required by the HITECH Act, Business Associate shall limit its use, disclosure or request of Protected Health Information to the limited data set (as defined under HIPAA) or, if needed, to the minimum necessary to accomplish the intended use, disclosure or request, respectively. Effective as of the date the Secretary issues guidance on what constitutes “minimum necessary” for purposes of HIPAA, Business Associate shall limit its use, disclosure, or request of Protected Health Information to only the minimum necessary as set forth in such guidance.
(l)Establish procedures in order to mitigate, to the greatest extent possible, any deleterious effects from any improper use and/or disclosure of Protected Health Information by Business Associate.
(m)Report to the designated Privacy Official of Covered Entity, any Security Incident of which Business Associate becomes aware. Oral reports shall be made within five (5) business days following discovery, and shall be followed promptly by a written report based on subsequently developed information. Business Associate shall cooperate with Covered Entity with respect to disclosure of such incident in accordance with applicable law, including without limitation the applicable requirements of the HITECH Act.
(n) Report to Covered Entity any Breach of Unsecured Protected Health Information, including identification of each individual whose Unsecured Protected Health Information has been, or is reasonably believed by Business Associate to have been accessed, acquired, or disclosed during such Breach and any other information required under 45 C.F.R. § 164.410. Oral reports shall be made within five (5) business days if practicable, and shall be followed promptly by a written report based on subsequently developed information. Business Associate shall cooperate with Covered Entity with respect to disclosure of such Breach in accordance with applicable law, including without limitation the applicable requirements of the HITECH Act; provided, however, that Covered Entity shall have sole control over the timing and method of providing notification of such Breach to the affected individual(s) or others as required by the HITECH Act.
3.2.Compliance with the Security Regulations. Business Associate will comply with all requirements of the Security Regulations. Without limiting the generality of the foregoing, with respect to all Protected Health Information that is Electronically Transmitted or Electronically Maintained, Business Associate shall implement Administrative Safeguards, Physical Safeguards, and Technical Safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronically Transmitted or Electronically Maintained Protected Health Information that the Business Associate creates, receives, maintains, or transmits on behalf of the Covered Entity, all as required by, and set forth more specifically in, the Security Regulations.
3.3. Compliance with Certain Provisions of the HITECH Act.
(a)Business Associate shall not, directly or indirectly, receive remuneration in exchange for any Protected Health Information of an individual, except pursuant to a valid written authorization signed by or on behalf of such individual, or as otherwise permitted under the HITECH Act or such implementing regulations.
(b)Business Associate shall not use or disclose Protected Health Information for the purpose of making such a communication about a product or service that encourages recipients of the communication to purchase or use the product or service, unless such communication: (1) complies with the requirements of subparagraph (i), (ii) or (iii) of paragraph (1) of the definition of marketing contained in 45 C.F.R. § 164.501; and (2) complies with the requirements of subparagraphs (A), (B) or (C) of Section 13406(a)(2) of the HITECH Act. Covered Entity shall cooperate with Business Associate to determine if the foregoing requirements are met with respect to any such marketing communication.
3.4. Obligations of the Covered Entity. With regard to the use and/or disclosure of Protected Health Information by Business Associate, Covered Entity hereby agrees to do the following:
(a)Provide Business Associate with the notice of privacy practices that Covered Entity produces in accordance with 45 C.F.R. §164.520, as well as any changes to such notice.
(b)Inform Business Associate of any changes in, or revocation of, authorization provided to Covered Entity by an Individual to use or disclose Protected Health Information, if such changes affect Business Associate’s permitted uses and disclosures. If applicable to services provided to or on behalf of Covered Entity, inform Business Associate of any opt-outs exercised by any individual from fundraising activities of Covered Entity pursuant to 45 C.F.R. §514(f).
(c)Notify Business Associate of any arrangements permitted or required of Covered Entity under the Privacy Regulations that may impact in any manner the use and/or disclosure of Protected Health Information by Business Associate under this Agreement, including any restriction on the use or disclosure of Protected Health Information that Covered Entity has agreed to in accordance with 45 C.F.R. §164.522. Without limiting the foregoing, in the event that Covered Entity is required to comply with a restriction on the disclosure of Protected Health Information pursuant to §13405 of the HITECH Act, then Covered Entity shall, to the extent needed to comply with such restriction, provide written notice to Business Associate of the name of the individual requesting the restriction and the Protected Health Information affected thereby. Upon receipt of such notification, Business Associate shall not disclose the identified Protected Health Information to any health plan for the purposes of carrying out payment or health care operations, except as otherwise required by law.
4.1. Term. This Agreement shall become effective on the Effective Date and shall continue in effect until all of the Protected Health Information provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity is destroyed or returned to Covered Entity, or, if it is infeasible to return or destroy Protected Health Information, protections are extended to such information in accordance with the termination provisions in this Section 4. In addition, certain provisions and requirements of this Agreement shall survive its expiration or other termination in accordance with Section 4.3 herein.
4.2. Termination for Cause. As provided in 45 C.F.R. §164.314(a)(2)(i)(D) and §164.504(e)(2)(iii), Covered Entity may immediately terminate this Agreement and any related agreements, if Covered Entity makes the determination that Business Associate has breached a material term of this Agreement. Covered Entity may choose to provide Business Associate with written notice of the alleged breach and afford Business Associate an opportunity to cure said breach to the satisfaction of Covered Entity within thirty (30) calendar days after Business Associate’s receipt of such notice. Failure to cure in the manner set forth in this Section is grounds for immediate termination of this Agreement and any related agreements.
(a)Except as provided in Section 4.3(b) below, upon termination of this Agreement for any reason, Business Associate shall return or destroy all Protected Health Information received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity. This provision shall apply to Protected Health Information that is in the possession of subcontractors or agents of Business Associate. Business Associate shall retain no copies of the Protected Health Information.
(b)In the event that Business Associate determines that returning or destroying the Protected Health Information is infeasible or inconsistent with the obligations of Business Associate to Covered Entity, Business Associate shall provide to Covered Entity notification of the conditions that make return or destruction infeasible. Upon mutual agreement between the Parties that return or destruction of Protected Health Information is infeasible, Business Associate shall extend the protections of this Agreement to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such Protected Health Information.
5.1. Relationship of Parties. Business Associate, in furnishing services pursuant to the Service Contract and other related documents thereunder, is acting as an independent contractor, and Business Associate has the sole right and obligation to supervise, manage, contract, direct, procure, perform or cause to be performed, all work to be performed by Business Associate under this Agreement. Business Associate is not an agent of Covered Entity, and has no authority to represent Covered Entity as to any matters, except as expressly authorized in this Agreement or in the Service Contract.
5.2. Amendments; Waiver. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for the Parties to comply with the requirements of the Privacy Regulations, the Security Regulations, the HITECH Act, or applicable federal or state confidentiality laws or regulations. Notwithstanding anything herein to the contrary, this Agreement may not be modified, nor shall any provision hereof be waived or amended, except in a writing duly signed by authorized representatives of both Parties. A waiver with respect to one event shall not be construed as continuing, or as a bar to or waiver of any right or remedy as to subsequent events.
5.3. Interpretation; Regulatory References. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits the Parties to comply with the Privacy Regulations, the Security Regulations, the HITECH Act, or applicable federal or state confidentiality laws or regulations. Any reference in this Agreement to a section in the Privacy Regulations, the Security Regulations, or the HITECH Act means the section as in effect or as amended. Section titles in this Agreement are for convenience only, and shall not be used in interpreting this Agreement.
5.4. Severability. If any provisions of this Agreement are unenforceable, invalid or violate applicable law, such provisions shall be deemed stricken and shall not affect the enforceability of any other provisions of this Agreement.
5.5. Notices. Any notices to be given hereunder to a Party shall be made via certified mail, overnight mail, or via electronic mail with confirmed receipt to the other Party’s principal place of business or email address provided to the other Party.
5.6. Counterparts. For the convenience of the Parties, this Agreement may be executed in two or more identical counterparts, all of which together shall constitute one agreement.