Source: http://arxchange.com/
Timestamp: 2014-10-23 11:00:06
Document Index: 649437930

Matched Legal Cases: ['§164', '§160', '§164', 'art 160', 'art 164', '§160', '§164', '§ 17932', '§160', '§164', '§164', '§164', '§164', '§164', '§164', '§164', '§164', '§164', 'arts 1', 'arts 160', '§164', '§ 160', '§ 164', '§ 160', '§ 164', '§ 17932', '§ 17935', 'arts 160', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 17935']

ARxChange Login
2014 excellence award from USTCRI ARxChange receives 2014 Excellence Award from U.S. Trade & Commerce Institute.	financial forward performance.
join the conversion With over $13 billion in listings, the ARxChange is the nation’s largest centralized marketplace for medical receivable disposition.	innovative options.
transformative performance ”Given today’s dynamic healthcare environment, we believe it’s essential to offer new and innovative options like ARxChange to bolster our hospitals’ financial pictures by improving their cash flow and working capital positions.” - Earl Rogers, President & CEO, Georgia Hospital Association.	market leading technology.
receivables fast-track ”ARxChange opens an additional lane for receivables performance, a fast-track or superhighway of sorts for more predictable, immediate, evidenced-based and guaranteed returns under hospital sanctioned and safeguarded servicing terms.” - Carl Pellettieri, Principal, Impact Healthcare Services, an MCHC company. performance spotlight.
receivables optimization ”ARxChange provided us with more reassurances and visibility into our collections performance. We uncovered value where we thought there was none, and converted this value into operating capital within weeks.” - Jay Hoffman, Chief Financial Officer, Southern Regional Medical Center.	Tricap Technology Group © 2005
Los Angeles	ARxCHANGE® USER TERMS AND CONDITIONS This ARxChange Terms and Conditions User Agreement (the "Agreement") is made and entered into between the TriCap Health Group, LLC d/b/a the TriCap Technology Group ("TriCap" or "TriCap Technology Group") and you as the User (the "User").
Whereas TriCap owns and operates the Accounts Receivables Exchange ("the ARxChange")
Whereas the User is either a healthcare provider or a covered entity under HIPPA Privacy Rules; a business associate of the healthcare provider or covered entity, a subcontractor of the business associate of the healthcare provider or covered entity, or an entity that has permissible purpose from the aforementioned entities to assess or review receivables placed on the ARxChange system for the business purpose of evaluation, performance consulting, or bidding to secure the rights to own, lease or service them; Whereas as healthcare provider/covered entity Users assign TriCap rights to act as its Business Associate pursuant to the terms set forth in Appendix A of this Agreement and grants TriCap and its subcontractors permissible purpose to use or disclose "Protected Health Information" (PHI) as reasonably necessary to deliver ARxChange services and to carry out TriCap's legal responsibilities under this Agreement or as required by law.
Whereas TriCap assigns rights to non-healthcare provider Users of the ARxChange to act as its business associate subcontractor pursuant to the terms set forth in Appendix B of this Agreement;
Whereas Usersunderstand and acknowledge that the ARxChange system is proprietary and patent-protected and that they will not infringe on TriCap's patents (#7,949,597; #8,234,209; and #8,442,903); and
Whereas the User understands that ARxChange is a web-based platform undergoing continuing development and programming that may be subject to changes, adjustments, modifications and errors that effect the availability and operation of all its functions.
Now therefore, in consideration of the mutual promises set forth herein, and for all other good and valuable consideration, the receipt, adequacy and sufficiency of which are hereby acknowledged, the parties hereby agree as follows:
The term of this Agreement is effective immediately upon the acceptance by the User and/or the User's submission to, or the receipt of, receivables data from TriCap and will continue unless terminated by TriCap at its sole discretion (the "Term").
During the Term, TriCap agrees to provide the User a limited, non-exclusive license to utilize the ARxChange. Users acknowledge that TriCap maintains exclusive control of all ARxChange access and rights to the system and as a result, may revoke or limit the User's privileges at any time without notice or cause for any reason whatsoever.
Violate any laws or third party rights or terms and conditions posted by TriCap.
Use any device, software, or routine to interfere or attempt to interfere with any application, function or use of the ARxChange system. Directly or indirectly decompile, disassemble, decrypt, extract, reverse engineer or otherwise attempt to derive the source code of the software, tools, methods, processes or infrastructure underlying the ARxChange process or system or its confidential information.
Take any action that may dilute, interfere, circumvent or undermine the consummation of an awarded transaction, or the competitive bid processes associated with any ARxChange one-time or recurring forward flow trade events, including (but not limited to):
Manipulating the bidding and/or the bidding price.
Engaging in frivolous bidding activity such as withdrawing transmitted bids for reasons unrelated to final due diligence that reveal material deviations in the portfolio and its individual accounts.
Not requesting or providing necessary underwriting information to consummate the transaction.
Not completing transactions for reasons unrelated to due diligence that reveal material deviations in the asset.
Placing bids or causing bids to be placed for the purpose of artificially increasing or otherwise manipulating the bidding process.
Submitting bids after conspiring or colluding with other Bidders to artificially inflate or deflate prices
Directly or indirectly contacting other Users during an auction event and/or recurring forward flow transactions to negotiate side arrangement agreements designed to circumvent the ARxChange process and/orTriCap's fees
Factually misrepresent information on any historical receivables/debt performance and/or liquidation on records provided
Unbundle recurring forward flow portfolios from "one-time" trade events to circumvent TriCap fees or bypass TriCap forward flow transactions involving the bidding community TriCap originally organized on behalf of the debt provider
In any manner may dilute the integrity of the auction event
Distribute viruses or any other technologies that may harm the ARxChange or the interests of ARxChange Users
Copy, modify, or distribute content from the ARxChange or harvest or otherwise collect information about Users.
Users who post receivables for disposition on, or through, the ARxChange process:
Represent and warranty that they have legal and rightful ownership of any and all accounts, files, and records on any and all receivables portfolios they post; Represent and warranty that it has has secured all necessary and requisite rights required from within its own organization or any other requisite entity with a claim against the User's organization to post portfolios for bid consideration on the ARxChange. Represent and warranty that the accounts within the portfolio the post are free of any and all encumbrances and liens;
That they are in possession ofa clear chain of custody and title for receivables they post;
Are solely responsible for the content, accuracy, integrity and completeness of any receivables' information comprising any data or records delivered to TriCap for posting on, or through, the ARxChange;
Will not to post any data or information containing false, inaccurate, misleading information as to:
the authenticity of the portfolio's ownership, the historical chain of custody,
The portfolio's inherent value; or
Any information related to historical collection performance activities, including the pace of such recoveries. Represent and warranty that none of the accounts, data, information, or portfolios provided for posting are involved in (or part of) any active and/or ongoing litigation with a third party that may impact title and/or the successful transfer of asset ownership or otherwise delay or prevent a successful trade disposition.
Represent and warranty that the guarantor names, addresses, account numbers, social security numbers, tax I.D. numbers, and all other information provided on accounts within the receivables portfolios are accurate. Accept bids in good faith, and once accepted,enter into a non-retractable and binding commitment to effect the transaction at the accepted bid price.
Grant TriCap the exclusive right to list and receive fees for any one-time or forward flowing debt or receivables pool for which its requested TriCap to list on, or through, the ARxChange process.
Agree not to solicit, entertain or accept bids or offers for any such debt pools that outside the exclusive ARxChange process. Pay TriCap's trading fees as set forth in Section 7 of this Agreement.
Users who place bidsto secure ownership of, or secure rights to service receivables, on, or through, the ARxChange process agree that:
Any and all scoring, sorting and segmentation lists, statistics and information, as well as the charts, graphs or other manner of representation of such information presented on, or through, the ARxChange is provided for informational, grouping, and organizational purposes only. It is solely responsiblefor its biddecisions and will base it decisions on its own independent examination, study, inspection and knowledge of the opportunities on the ARxChange, and that any acquisition or investment decision is based solely upon the User's own thorough and detailed analysis of the investment or acquisition opportunity and potential return horizons. Any informationprovided by TriCap should not be used in making a bid decision and that TriCap makes no such representations, warranties or guarantees as to the validity and/or accuracy of its information;
All bids placed on the system are legally binding and that prior to bidding, Users represent and warrant that they haveexisting funding and access to credit lines sufficient to cover and consummate any bid they place.
Funding the transaction within 48 hours of closing.
Pay TriCap's trading fees as set forth in Section 7 of this Agreement.
Users agree to pay ARxChange fees as set forth below:
An ARxChange registration fee of $10,000.
A minimum 6% ARxChange trade transaction fee for each one-time, and for any forward-flowing or recurring transaction that was initiated, associated with, and/or consummated on, or through, the ARxChange process as set forth below:
Both the debt lister and the winning bidder each pay the ARxChange minimum 6% trade transaction fee.
The ARxChange trade transaction fee is calculated on the face value of the purchase (or servicing) transaction price, which is payable immediately at closing. The ARxChange trade transaction fee applies:
To all one-time and recurring transactions occurring on, or through, the ARxChange process;
To all any recurring or forward flow postings initiated or associated with a ARxChange one-time receivables postings; Throughout the duration of any contractual relation between the debt lister and winner bidder or their affiliates or assignees; and
Throughout the duration of any run-out period or through any survivable period of the contractual relationship between the parties.
Users acknowledge that all ARxChange trade transaction fees along with the entire purchase price for any posting on the ARxChange (and for recurring forward flow fees and purchase prices resulting from any posting on ARxChange will be processed as follows:
The winning bidder will forward to TriCap the entire purchase or guarantee payment amount inclusive of all TriCap's trade transaction fees. Upon receipt of funds, TriCap will process payment to the debt lister, less TriCap'strade transaction fees. The above payment processing protocol will remain in effect throughout any recurring transactions associated with any ARxChange disposition awards as set forth above in Section 7(1).
Users understand that the registration and trade transaction fees may be reassessed by TriCap.
Users will not hold TriCap responsible for the accuracy and completeness of the content or for any actions or inactions of other Users. Users agrees to release TriCap, its officers, directors, employees, agents, and related parties from claims, demands and damages (actual or consequential) of every nature, known or unknown, arising out of or in any way connected to disputes between the User and other Users.
Users acknowledge that all information with regards to the ARxChange processes and transactions is confidential and thus TriCap may suffer irreparable harm if any disclosure is made.
Users agree to use all commercially reasonable efforts to maintain the confidentiality and secrecy of the ARxChange information and acknowledge and agrees that TriCap will suffer irreparable damage upon the User's breach of this Agreement and that such damages shall be difficult to quantify. Users agree to indemnify, defend (through attorneys reasonably acceptable to TriCap and its successors and assigns) and hold TriCap and all officers, directors, employees, and agents of TriCap harmless from and against any and all pending or threatened claims, causes of action, damages, losses, costs (including reasonable and necessary attorney's fees) and liabilities of any nature, which may at any time be assessed against or suffered by TriCap directly or indirectly relating to or arising out of a breach of this Agreement by the User.
The parties agree that, except as contained herein, no warranty, express or implied, is made with respect to the ARxChange. TriCap does not warrant that the functions contained in the ARxChange process will meet the User's requirements, or will operate in the manner desired by the User, or that the ARxChange process will be error free, or free from unauthorized intrusion. TriCap shall not, under any circumstances, be liable to the User or any other person for any special, incidental, consequential, or other damages resulting from the use of the ARxChange, including, without limitation to, the reliance by any entity/person on information obtained through the ARxChange. This may include scoring and segmentation statistics provided, virus transmission, or the deletion or loss of files or e-mail, the loss of data or information of any kind, the loss of profit, or any liability to third parties, however caused, whether by the act or negligence of TriCap or otherwise. The maximum liability of TriCap for any and all loss, claims, damage or liability of any kind hereunder shall be limited to the amount of any service fees paid by the User to TriCap under this Agreement.
TriCap may amend this Agreement at any time by posting the amended terms on the ARxChange. Except as stated elsewhere, all amended terms shall automatically be in effect upon their posting.
This Business Associates Agreement (“Agreement”) is effect at the start of the term of the ARxChange User Term and and Conditions Agreement set forth in Section 1 and entered into between TriCap and Users of the ARxChange as defined in the Recitals to the ARxChange User Term and and Conditions Agreement
Definitions. Terms used, but not otherwise defined in this Agreement, shall have the same meaning as those terms in the Privacy Rule and the Security Rule. Business Associate."Business Associate" shall mean TriCap Technology Group. Breach. Shall mean the acquisition, access, use, or disclosure of PHI in a manner not permitted under the HIPAA Privacy Rule which compromises the security or privacy of the PHI, as defined in 45 C.F.R. §164.402. Covered Entity. "Covered Entity" shall mean Users of the ARxChange as defined in the Recitals to the ARxChange User Term and and Conditions Agreement. Designated Record Set. Shall mean a group of Records maintained by or for a Covered Entity that: (a) consists of medical records and billing records about individuals maintained by or for the Covered Entity; (b) consists of the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (c) consists of Records used, in whole or part, by or for the Covered Entity to make decisions about individual patients. As used herein, the term “Record” shall mean any item, collection or grouping of information that includes PHI and is maintained, collected, used or disseminated by or for a provider. The term “designated record set”, however, shall not include any information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding, including but not limited to, any information subject to the attorney-client privilege, trial preparation immunity, attorney work product, peer review privilege or other privilege under applicable law HITECH Act. Shall mean the Health Information Technology for Economic and Clinical Health Act, enacted as part of the American Recovery and Reinvestment Act of 2009, Public Law 111-5. Individual."Individual" shall have the same meaning as the term "individual" in 45 CFR §160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR §164.502(g). Privacy Rule."Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR Part 160 and Part 164, Subparts A and E. Protected Health Information. "Protected Health Information" shall have the same meaning as the term "protected health information" in 45 CFR §160.103, limited to the information created or received by Business Associate from or on behalf of Covered Entity. Required By Law."Required By Law" shall have the same meaning as the term "required by law" in 45 CFR §164.103. Secretary."Secretary" shall mean the Secretary of the Department of Health and Human Services or his or her designee. Security Incident. Shall mean the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system. This term shall not include trivial incidents that occur on a daily basis, such as scans, “pings”, or unsuccessful attempts to penetrate computer networks or servers maintained by Subcontractor provided such trivial incident, alone or in aggregate, does not rise to a significant level. Unsecured Protected Health Information or PHI. Shall mean any “protected health information” or “PHI” that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary in the guidance issued pursuant to Section 13402(h) (42 U.S.C. § 17932(h)) of the HITECH Act. Security Rule. “Security Rule” shall mean the Standards for Security of Electronic Protected Health Information at 45 C.F.R. parts §160 and §164, subparts A and C. Obligations and Activities of Business Associate.
Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Agreement or as Required By Law. Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement. Business Associate agrees to implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of any electronic Protected Health Information that Business Associate creates, receives, maintains or transmits on behalf of Covered Entity, as provided for in the Security Rule. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware. Business Associate also agrees to report to Covered Entity any security incident, including all data breaches whether internal or external, related to Protected Health Information of which Business Associate becomes aware. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity, agrees to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. Business Associate agrees to provide access, at the request of Covered Entity and during normal business hours, to Protected Health Information in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR §164.524, provided that Covered Entity delivers to Business Associate a written notice at least five (5) business days in advance of requesting such access. This provision does not apply if Business Associate and its employees, subcontractors and agents have no Protected Health Information in a Designated Record Set of Covered Entity. Business Associate agrees to make any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR §164.526, at the request of Covered Entity or an Individual. This provision does not apply if Business Associate and its employees, subcontractors and agents have no Protected Health Information from a Designated Record Set of Covered Entity. Unless otherwise protected or prohibited from discovery or disclosure by law, Business Associate agrees to make internal practices, books, and records, including policies and procedures, relating to the use or disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity, available to the Covered Entity or to the Secretary for purposes of the Secretary determining Covered Entity's compliance with the Privacy Rule or Security Rule. Business Associate shall have a reasonable time within which to comply with requests for such access and in no case shall access be required in less than five (5) business days after Business Associate's receipt of such request, unless otherwise designated by the Secretary. Business Associate agrees to maintain necessary and sufficient documentation of disclosures of Protected Health Information as would be required for Covered Entity to respond to a request by an Individual for an accounting of such disclosures, in accordance with 45 CFR §164.528. On request of Covered Entity, Business Associate agrees to provide to Covered Entity documentation made in accordance with this Agreement to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 C.F.R.§164.528. Business Associate shall have a reasonable time within which to comply with such a request from Covered Entity and in no case shall Business Associate be required to provide such documentation in less than five (5) business days after Business Associate's receipt of such request. Except as provided for in this Agreement, in the event Business Associate receives an access, amendment, accounting of disclosure, or other similar request directly from an Individual, Business Associate will redirect the Individual to the Covered Entity. Permitted Uses and Disclosures by Business Associate.
Except as otherwise limited by this Agreement, Business Associate may make any uses and disclosures of Protected Health Information necessary to perform its services to Covered Entity and otherwise meet its obligations under this Agreement, if such use or disclosure would not violate the Privacy Rule if done by Covered Entity. All other uses or disclosures by Business Associate not authorized by this Agreement or by specific instruction of Covered Entity are prohibited. Except as otherwise limited in this Agreement, Business Associate may use Protected Health Information for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. Except as otherwise limited in this Agreement, Business Associate may disclose Protected Health Information for the proper management and administration of the Business Associate, provided that disclosures are Required By Law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as Required By Law or for the purpose for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached. Except as otherwise limited in this Agreement, Business Associate may use Protected Health Information to provide Data Aggregation services to Covered Entity as permitted by 45 CFR §164.504(e)(2)(i)(B). Business Associate may use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent with §164.502(j)(1). Obligations of Covered Entity.
Covered Entity shall notify Business Associate of any limitation(s) in its notice of privacy practices of Covered Entity in accordance with 45 CFR §164.520, to the extent that such limitation may affect Business Associate's use or disclosure of Protected Health Information. Covered Entity shall notify Business Associate of any changes in, or revocation of, permission by Individual to use or disclose Protected Health Information, to the extent that such changes may affect Business Associate's use or disclosure of Protected Health Information. Covered Entity shall notify Business Associate of any restriction to the use or disclosure of Protected Health Information that Covered Entity has agreed to in accordance with 45 CFR §164.522, to the extent that such restriction may affect Business Associate's use or disclosure of Protected Health Information. HITECH Act Compliance. The parties acknowledge that the HITECH Act includes significant changes to the HIPAA Privacy Rule and the HIPAA Security Rule. The Privacy Subtitle of the HITECH Act sets forth provisions that significantly change the requirements for business associates and the agreements between business associates and their agents and subcontractors under the HIPAA Regulations and many of these changes will be clarified in forthcoming regulations and guidance. Each Party agrees to comply with the applicable provisions of the HITECH Act and any implementing regulations issued there under. Also, the Parties agree to negotiate in good faith to modify this Agreement as reasonably necessary to comply with the HITECH Act and its implementing regulations as they become effective. Term
The Term of this Agreement shall be effective as of set forth in Section 1 of the ARxChange User Term and Conditions Agreemen tand shall terminate when all of the Protected Health Information provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or, if it is infeasible to return or destroy Protected Health Information, protections are extended to such information, in accordance with the termination provisions in this Agreement. This Agreement shall become effective on the Effective Date and shall continue in effect until all obligations of the Parties have been met under the Other Agreements and under this Agreement. Miscellaneous.
Regulatory References. A reference in this Agreement to a section in the Privacy Rule or Security Rule means the section as in effect or as amended. Amendment. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for Covered Entity to comply with the requirements of the Privacy Rule or Security Rule and the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191. Survival. The respective rights and obligations of Business Associate under Section 5(c) of this Agreement shall survive the termination of this Agreement. Interpretation. Any ambiguity in this Agreement shall be resolved to permit Covered Entity to comply with the Privacy Rule or the Security Rule. Appendix B
SubContractor Privacy Agreement
This Subcontractor Privacy Agreement (“Agreement”) is made and entered into as of the date executed by Contractor on the signature page below (the “Effective Date”), by and between TriCap Technology Group (“Contractor”) and non-healthcare covered entity ARxChange Users as defined in the Recitals to the ARxChange User Term and and Conditions Agreement.
(“Subcontractor”) (each, a “Party” and collectively, the “Parties”). WHEREAS, this Agreement: (1) applies to any and all agreements currently in effect between the Parties pursuant to which Subcontractor receives or obtains Protected Health Information (“PHI”) (as defined below) in the course of providing services to Contractor, and (2) applies to any and all future agreement(s) between Contractor and Subcontractor pursuant to which Subcontractor receives or obtains PHI (defined below) in the course of providing services to Contractor, provided that the future agreements referenced in this subpart (2) incorporate by reference this Agreement (the agreements referenced in subparts 1-2, collectively referred to as the “Other Agreement(s)”); and
WHEREAS, the services provided by Contractor to its health care provider clients that are Covered Entities cause Contractor to be considered a “business associate” of those Covered Entities under privacy and information security regulations, including the regulations contained in 45 C.F.R. Parts 160 and 164, as amended by the HITECH Act and otherwise from time to time (“HIPAA Regulations”) promulgated under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”); and
WHEREAS, under its Business Associate Agreements with its Covered Entity clients, Contractor is required to obtain contractual assurances from its subcontractors that create, receive, maintain or transmit PHI on Contractor's behalf that they will safeguard the PHI in accordance with applicable requirements under the HIPAA Regulations; and
NOW, THEREFORE, in consideration of the mutual covenants and conditions contained herein and the continued provision of PHI by Contractor to Subcontractor under the Other Agreements in reliance on this Agreement, the Parties agree as follows:
Definitions. For purposes of this Agreement, the terms below shall have the meanings given to them in this Section. Breach shall mean the acquisition, access, use, or disclosure of PHI in a manner not permitted under the HIPAA Privacy Rule which compromises the security or privacy of the PHI, as defined in 45 C.F.R. §164.402. Covered Entity shall mean the clients of Contractor that meet the definition given to that term in 45 C.F.R. § 160.103. Data Aggregation shall mean, with respect to PHI created or received by Subcontractor in its capacity as the business associate of Contractor, the combining of such PHI by Subcontractor with the PHI received by Subcontractor in its capacity as a business associate of another covered entity, to permit data analyses that relate to the Health Care Operations (defined below) of the respective Covered Entities. The meaning of “data aggregation” in this Agreement shall be consistent with the meaning given to that term in the HIPAA Regulations. Designated Record Set shall mean a group of Records maintained by or for a Covered Entity that: (a) consists of medical records and billing records about individuals maintained by or for the Covered Entity; (b) consists of the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (c) consists of Records used, in whole or part, by or for the Covered Entity to make decisions about individual patients. As used herein, the term “Record” shall mean any item, collection or grouping of information that includes PHI and is maintained, collected, used or disseminated by or for a provider. The term “designated record set”, however, shall not include any information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding, including but not limited to, any information subject to the attorney-client privilege, trial preparation immunity, attorney work product, peer review privilege or other privilege under applicable law. De-Identify shall mean to alter the PHI such that the resulting information meets the requirements described in 45 C.F.R. § 164.514(a) and (b). Effective Date shall mean the date first written above. Electronic PHI shall mean any PHI maintained in or transmitted by “electronic media” as defined in 45 C.F.R. § 160.103. Health Care Operations shall have the meaning given to that term at 45 C.F.R. § 164.501. HHS shall mean the U.S. Department of Health and Human Services. HITECH Act shall mean the Health Information Technology for Economic and Clinical Health Act, enacted as part of the American Recovery and Reinvestment Act of 2009, Public Law 111-5. Protected Health Information or PHI shall mean information transmitted or maintained in any form or medium, including demographic information collected from an individual, that is created or received by a health care provider, health plan, employer, or health care clearinghouse; and relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual, and (a) identifies the individual or (b) with respect to which there is a reasonable basis to believe the information can be used to identify the individual. The meaning of “protected health information” or “PHI” in this Agreement shall be consistent with the meaning given to that term in the HIPAA Regulations. Security Incident shall mean the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system. This term shall not include trivial incidents that occur on a daily basis, such as scans, “pings”, or unsuccessful attempts to penetrate computer networks or servers maintained by Subcontractor provided such trivial incident, alone or in aggregate, does not rise to a significant level. Unsecured Protected Health Information or PHI shall mean any “protected health information” or “PHI” that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary in the guidance issued pursuant to Section 13402(h) (42 U.S.C. § 17932(h)) of the HITECH Act. Use and Disclosure of PHI.
Except as otherwise provided in this Agreement, Subcontractor may use or disclose PHI as reasonably necessary to provide the services set forth in its agreement(s) with Contractor, and to undertake other activities of Subcontractor permitted or required of Subcontractor by this Agreement or as required by law. Except as otherwise limited by this Agreement, Contractor authorizes Subcontractor to use the PHI in its possession for the proper management and administration of Subcontractor’s business and to carry out its legal responsibilities. Subcontractor may disclose PHI for its proper management and administration, provided that (i) such disclosures are required by law; or (ii) Subcontractor obtains, in writing, prior to making any disclosure to a third party (a) reasonable assurances from such third party that the PHI will be held confidential as provided under this Agreement and used or further disclosed only as required by law or for the purpose for which it was disclosed to such third party; and (b) an agreement from such third party to notify Subcontractor immediately of any breaches of the confidentiality of the PHI, to the extent it has knowledge of such breach. Contractor does not authorize Subcontractor to De-Identify or to perform Data Aggregation services with respect to the PHI. Subcontractor shall not use or disclose PHI in a manner other than as provided in this Agreement, as permitted under the HIPAA Regulations, or as required by law. Subcontractor will not use or disclose PHI in any manner that would violate applicable laws or regulations, including, without limitation, the HIPAA Regulations, if done by Contractor. Subcontractor shall use or disclose PHI, to the extent practicable, as a Limited Data Set or limited to the minimum necessary amount of PHI to carry out the intended purpose of the use or disclosure, in accordance with Section 13405(b) (42 U.S.C. § 17935(b)) of the HITECH Act, and any implementing regulations adopted there under, for each use or disclosure of PHI hereunder. Upon request, Subcontractor shall make available to Contractor any of Contractor’s PHI that Subcontractor, or any of its subcontractors or agents, have in their possession. Safeguards Against Misuse of PHI. Subcontractor shall comply with the HIPAA Security Regulations at 45 CFR Parts 160 and 164, Subpart C, including but not limited to the implementation of administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, availability, and integrity of the Electronic PHI that it creates, receives, maintains, or transmits on behalf of Contractor or its Covered Entity clients, and shall use appropriate safeguards to prevent the use or disclosure of all PHI other than as provided by the Other Agreements or this Agreement. Subcontractor agrees to take reasonable steps to ensure that the actions or omissions of its employees or agents do not cause Subcontractor to breach the terms of this Agreement. Reporting Disclosures of PHI and Security Incidents. Subcontractor shall report to Contractor’s Privacy Officer in writing (1) any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, or (2) any Security Incident affecting Electronic PHI that it creates, receives, maintains, or transmits on behalf of Contractor or its Covered Entity clients of which it becomes aware. Subcontractor agrees to report any such unauthorized use or disclosure or Security Incident within two (2) business days of becoming aware of its occurrence. Reporting Breaches of PHI. Subcontractor shall notify Contractor’s Privacy Officer in writing within two (2) business days upon the discovery of any Breach of PHI, and within ten (10) calendar days after discovery shall provide the necessary information for Contractor to comply with 45 C.F.R. § 164.410. Mitigation of Disclosures of PHI. Subcontractor shall mitigate, to the extent practicable, any harmful effect that is known to Subcontractor of any use or disclosure of PHI by Subcontractor or its agents or subcontractors in violation of the requirements of this Agreement. Agreements with Agents or Subcontractors. Subcontractor shall ensure that any agent or subcontractor that has access to or to which Subcontractor provides PHI agrees in writing to the restrictions and conditions concerning uses and disclosures of PHI contained herein, and agrees to implement reasonable and appropriate safeguards to protect any electronic PHI that it creates, receives, maintains, or transmits on behalf of Contractor or Covered Entity. Access to PHI by Individuals. Upon request, Subcontractor agrees to furnish Contractor with copies of the PHI maintained by Subcontractor in a Designated Record Set in the time and manner designated by Contractor. In the event any individual or personal representative requests access to the individual’s PHI directly from Subcontractor, Subcontractor within five (5) business days, shall forward that request to Contractor. Any disclosure of, or decision not to disclose, the PHI requested by an individual or a personal representative and compliance with the requirements applicable to an individual’s right to obtain access to PHI shall be the sole responsibility of the health care provider contracting with Contractor. Amendment of PHI. Upon request and instruction from Contractor, Subcontractor shall amend PHI or a Record about an individual in a Designated Record Set that is maintained by, or otherwise within the possession of, Subcontractor as directed by Contractor in accordance with procedures established by 45 C.F.R. § 164.526. Any request by Contractor to amend such information shall be completed by Subcontractor within fifteen (15) business days of Contractor’s request. In the event that any individual requests that Subcontractor amend such individual’s PHI or Record in a Designated Record Set, Subcontractor within two (2) business days, shall forward such request to Contractor. Any amendment of, or decision not to amend, the PHI or Record as requested by an individual and compliance with the requirements applicable to an individual’s right to request an amendment of PHI shall be the sole responsibility of the health care provider contracting with Contractor. Accounting of Disclosures. Subcontractor shall document any disclosures of PHI made by it, except for disclosures relating to treatment, payment or health care operations of the health care provider clients of Contractor (including legal representation of the client by Contractor) or other disclosures excepted under 45 C.F.R. § 164.528(a). Subcontractor also shall make available information related to such disclosures as would be required for Contractor to respond to a request for an accounting of disclosures in accordance with 45 C.F.R. § 164.528. At a minimum, Subcontractor shall furnish Contractor the following with respect to any covered disclosures by Subcontractor: (i) the date of disclosure of PHI; (ii) the name of the entity or person who received PHI, and, if known, the address of such entity or person; (iii) a brief description of the PHI disclosed; and (iv) a brief statement of the purpose of the disclosure which includes the basis for such disclosure. Subcontractor hereby agrees to implement an appropriate recordkeeping system to enable it to comply with the requirements of this Section. Subcontractor agrees to retain such records for a minimum of six (6) years from the date of the disclosure. Subcontractor shall furnish to Contractor information collected in accordance with this Section, in the time and manner designated by the Contractor, to permit the health care provider contracting with Contractor to make an accounting of disclosures as required by 45 C.F.R. § 164.528, and Subcontractor shall otherwise furnish Contractor with the information necessary to enable Contractor to comply with the applicable provisions of Section 13405(c) (42 U.S.C. § 17935(c)) of the HITECH Act and any implementing regulations. In the event that an individual delivers the request for an accounting directly to Subcontractor, Subcontractor within two (2) business days shall forward such request to Contractor. Availability of Books and Records. Subcontractor shall make available its internal practices, books, agreements, records, and policies and procedures relating to the use and disclosure of PHI to Contractor and, upon request, to the Secretary of HHS for purposes of determining compliance with the HIPAA Regulations and this Agreement. Notwithstanding the foregoing, prior to any such disclosure to the Secretary of HHS or any other federal or state agency, Subcontractor shall notify Contractor in writing immediately of such request and shall furnish Contractor with copies of such request. Contractor and Subcontractor agree to work together in responding to any such request including, but not limited to, engaging in an effort to obtain a confidentiality agreement, protective order, injunction or court order, if necessary, to preserve any applicable privilege. Term and Termination. This Agreement shall become effective on the Effective Date and shall continue in effect until all obligations of the Parties have been met under the Other Agreements and under this Agreement. Upon termination of the Other Agreements for any reason, all PHI maintained by Subcontractor and its subcontractors shall be returned to Contractor or destroyed by Subcontractor and its subcontractors. Subcontractor shall not retain any copies of such information. This provision shall apply to PHI in the possession of Subcontractor’s subcontractors and agents. If return or destruction of the PHI is not feasible in Subcontractor’s reasonable judgment, Subcontractor shall furnish Contractor notification, in writing, of the conditions that make return or destruction infeasible. Upon mutual agreement of the Parties that return or destruction of the PHI is infeasible, Subcontractor will extend the protections of this Agreement to such information for as long as Subcontractor retains such information and will limit further uses and disclosures to those purposes that make the return or destruction of the information not feasible. HITECH Act Compliance. The Parties acknowledge that the HITECH Act includes significant changes to the HIPAA Privacy Rule and the HIPAA Security Rule. The Privacy Subtitle of the HITECH Act sets forth provisions that significantly change the requirements for business associates and the agreements between business associates and their agents and subcontractors under the HIPAA Regulations and many of these changes will be clarified in forthcoming regulations and guidance. Each Party agrees to comply with the applicable provisions of the HITECH Act and any implementing regulations issued there under. Also, the Parties agree to negotiate in good faith to modify this Agreement as reasonably necessary to comply with the HITECH Act and its implementing regulations as they become effective. PRIVACY POLICY Scope
This Privacy Policy describes how we handle your personal information for our services on the ARxChange® websites. It applies generally to the ARxChange.com website and content and other related websites where this policy appears in the footer of the page. Some ARxChange®-branded websites or websites we operate may be governed by separate privacy policies. The policy that applies on any of our domains or sub domains is always the policy that appears in the footer of each website.
Our subsidiaries' and joint ventures' privacy practices are similar to those described in this Privacy Policy. Subject to the requirements of applicable law, we strive to provide a consistent set of privacy practices throughout the global ARxChange® trading community. By accepting the Privacy Policy and the User Agreement in registration, you expressly consent to our collection, storage, use and disclosure of your personal information as described in this Privacy Policy. This Privacy Policy is effective upon acceptance for users.
You can browse our sites without telling us who you are or revealing any personal information about yourself. Once you give us your personal information, you are not anonymous to us. If you choose to provide us with personal information, you consent to the transfer and storage of that information on our servers. Marketing
We may disclose information to respond to legal requirements, enforce our policies, respond to claims that a listing or other content violates the rights of others, or protect anyone's rights, property, or safety. Such information will be disclosed in accordance with applicable laws and regulations.
We use "cookies" (small files placed on your hard drive) on certain of our pages to help analyze our web page flow; customize our services, content and advertising; measure promotional effectiveness, and promote trust and safety. You may encounter cookies from third parties on certain pages of the sites that we do not control.
Your password is the key to your account. Use unique numbers, letters and special characters, and do not disclose your ARxChange® password to anyone. If you do share your password or your personal information with others, remember that you are responsible for all actions taken in the name of your account. If you lose control of your password, you may lose substantial control over your personal information and may be subject to legally binding actions taken on your behalf. Therefore, if your password has been compromised for any reason, you should immediately notify ARxChange® and change your password.
You can see, review and change most of your personal information by signing on to ARxChange®. Generally, we will not manually modify your personal information because it is very difficult to verify your identity remotely. You must promptly update your personal information if it changes or is inaccurate. Security
Your information is stored on our secure servers. We treat data as an asset that must be protected and use lots of tools (encryption, passwords, physical security, etc.) to protect your information against unauthorized access and disclosure. However, as you probably know, third parties may unlawfully intercept or access transmissions or private communications, and other users may abuse or misuse your personal information that they collect from the site. Therefore, although we work very hard to protect your privacy, we do not promise, and you should not expect, that your information will always remain private.