Source: https://www.getrx.com/baa
Timestamp: 2019-09-19 05:20:52
Document Index: 516670446

Matched Legal Cases: ['arts 160', '§ 160', '§ 164', 'art 160', 'art 162', 'art 164', 'art 164', 'art 164', 'art 164', 'art 164']

This Business Associate Agreement (“BAA”) effective on the last signature date below, is entered into by and between getRx (“Company”) and ______________ (“Prescriber”).
Prescriber has elected to use one or more smart device applications and/or access to Web based software (“Applications”) that require Company to be provided with, to have access to, and/or to create Protected Health Information that is subject to the federal regulations issued pursuant to the Health Insurance Portability and Accountability Act (“HIPAA”) and codified at 45 C.F.R. parts 160 and 164 (“HIPAA Rules”). This BAA shall apply to Company's Use, Disclosure, and creation of PHI under the Underlying Contract(s) to allow Prescriber to comply with sections 164.502(e) and 164.314(a)(2)(i) of the HIPAA Rules. Company acknowledges that as a Business Associate, it is responsible for compliance with the HIPAA Security and Privacy Rules pursuant to Subtitle D of the Health Information Technology for Economic and Clinical Health Act (HITECH), including Sections 164.308, 164.310, 164.312 and 164.316 of title 45 of the Code of Federal Regulations.
The following terms used in this BAA shall have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Privacy Rule, Protected Health Information, Required By Law, Secretary, Security Incident, Security Standards, Subcontractor, Unsecured Protected Health Information, and Use. “PHI” and “ePHI” shall mean Protected Health Information and Electronic Protected Health Information, respectively, as defined in 45 C.F.R. § 160.103, limited to the information Company received from or created or received on behalf of Prescriber as Prescriber’s Business Associate. “Administrative Safeguards” shall have the same meaning as the term “administrative safeguards” in 45 C.F.R. § 164.304, with the exception that it shall apply to the management of the conduct of Company's workforce, not Prescriber’s workforce, in relation to the protection of that information. Additionally, the following definitions shall apply:
(a) Business Associate. “Business Associate” shall generally have the same meaning as the term “business associate” at 45 CFR 160.103, and in reference to the party to this agreement, shall mean the Company with respect to this BAA.
(b) Covered Entity. “Covered Entity” shall generally have the same meaning as the term “covered entity” at 45 CFR 160.103, and in reference to the party to this agreement, shall mean the Prescriber with respect to this BAA.
(c) HIPAA Rules. “HIPAA Rules” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160, Part 162, and Part 164.
(a) Not use or disclose protected health information other than as permitted or required by this BAA or as required by law;
(b) Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information, to prevent use or disclosure of protected health information other than as provided for by this BAA;
(c) Report to Covered Entity any use or disclosure of protected health information not provided for by this BAA of which it becomes aware, including breaches of unsecured protected health information as required at 45 CFR 164.410, and any security incident of which it becomes aware;
(h) To the extent the business associate is to carry out one or more of Covered Entity's obligation(s) under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to the covered entity in the performance of such obligation(s);
(i) Implement Administrative Safeguards, Physical Safeguards, and Technical Safeguards (“Safeguards”) that reasonably and appropriately protect the Confidentiality, Integrity, and Availability of ePHI as required by 45 C.F.R. Part 164 Subpart C (“Security Rule”);
(j) Make its policies, procedures and documentation required by the Security Rule relating to the Safeguards available to the Secretary of HHS for purposes of determining Covered Entity's compliance with the Security Rule;
(k) If Business Associate accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses Unsecured Protected Health Information (as defined in HITECH Sec. 4402(h)(1)), it shall, following the discovery of a breach of such information, notify the Covered Entity of such breach. Such notice shall include the identification of each individual whose unsecured protected health information has been, or is reasonably believed by Business Associate to have been accessed, acquired, or disclosed during such breach; and
(l) Make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.
Business associate may make any and all Uses and Disclosures of PHI necessary to perform the services provided by its Applications. Additionally, Business Associate may make the following Uses and Disclosures:
(a) Use the PHI in its possession for its proper management and administration and to carry out the legal responsibilities of Business Associate;
(b) Disclose the PHI in its possession to a third party for the purpose of Business Associate’s proper management and administration or to carry out the legal responsibilities of Business Associate, provided that the Disclosures are Required By Law or Business Associate obtains reasonable assurances from the third party regarding the confidential handling of such PHI as required under the Privacy Rule;
(c) Provide Data Aggregation services relating to the Health Care Operations of the Covered Entity;
(d) De-identify any and all PHI obtained by Business Associate under this BAA, and use such de-identified data, all in accordance with the de-identification requirements of the Privacy Rule; or
(e) Business associate may not use or disclose protected health information in a manner that would violate Subpart E of 45 CFR Part 164 if done by covered entity except for the specific uses and disclosures set forth herein.
Covered Entity agrees to timely notify Business Associate, in writing, of any arrangements between Covered Entity and the Individual that is the subject of PHI that may impact in any manner the Use and/or Disclosure of that PHI by Business Associate under this BAA.
(a) Term. The Term of this BAA shall be effective on the last signature date below and shall terminate on the date Covered Entity or Business Associate terminates this BAA.
(b) Obligations of Business Associate Upon Termination. Upon termination of this BAA for any reason, business associate, with respect to protected health information received from covered entity, or created, maintained, or received by business associate on behalf of covered entity, shall:
Not use or disclose the protected health information retained by business associate other than for the purposes for which such protected health information was retained and subject to the same conditions set forth herein which applied prior to termination; and
(c) Survival. The obligations of business associate under this Section shall survive the termination of this Agreement.
(d) No Third Party Beneficiaries. Nothing in this BAA shall confer upon any person other than the Parties and their respective successors or assigns, any rights, remedies, obligations, or liabilities whatsoever.
IN WITNESS WHEREOF, each of the undersigned has caused this BAA to be duly executed in its name and on its behalf.