Business Associate Agreement

Download

This Business Associate Agreement (“Agreement”) is entered into by and between Forcebrain.com dba Omnito (“Business Associate”) and (“Customer”) and is effective as of the date of the last signature below (“Effective Date”).

RECITALS

WHEREAS, Customer may disclose to Business Associate certain Protected Health Information (“PHI”) in conjunction with the services provided under the underlying Service Agreement (the “Services Agreement”);

WHEREAS, Business Associate and Customer intend to protect the privacy and provide for the security of PHI disclosed to Business Associate pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and their implementing regulations (collectively, the “HIPAA Rules”);

WHEREAS, the HIPAA Rules require that Customer receive adequate assurances from Business Associate that it will appropriately safeguard PHI;

NOW, THEREFORE, in consideration of the mutual promises and covenants contained herein, the parties agree as follows:

1. Definitions

Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in the HIPAA Rules.

  • “Breach” shall have the same meaning as the term “breach” in 45 CFR § 164.402.
  • “Security Incident” shall have the same meaning as the term “security incident” in 45 CFR § 164.304, provided that “Unsuccessful Security Incidents” (such as pings, port scans, or unsuccessful log-on attempts) shall not require active reporting.

2. Obligations and Activities of Business Associate

  • 2.1 Permitted Uses and Disclosures. Business Associate agrees to use or disclose PHI only as permitted or required by this Agreement, the Services Agreement, or as Required by Law.
  • 2.2 Safeguards. Business Associate shall use appropriate administrative, physical, and technical safeguards to prevent the use or disclosure of PHI other than as provided for by this Agreement.
  • 2.3 Security. Business Associate shall comply with the Security Rule (45 CFR §§ 164.308, 164.310, 164.312, and 164.316). Specifically, Business Associate agrees to maintain Multi-Factor Authentication (MFA) and encryption of PHI at rest and in transit using industry-standard protocols (e.g., AES-256).
  • 2.4 Reporting. Business Associate shall report to Customer any Breach of Unsecured PHI within seventy-two (72) hours of discovery.
  • 2.5 AI and Data Usage. (Modern Standard) Business Associate shall not use Customer’s PHI to train, improve, or fine-tune Artificial Intelligence (AI) models or machine learning algorithms unless such data is first de-identified in accordance with 45 CFR § 164.514.
  • 2.6 Subcontractors. Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree to the same restrictions and conditions that apply to Business Associate with respect to such information.
  • 2.7 Access and Amendment. To the extent Business Associate maintains PHI in a Designated Record Set, it shall make such information available to Customer or the Individual as necessary to satisfy Customer’s obligations under 45 CFR § 164.524 and 164.526.
  • 2.8 Accounting of Disclosures. Business Associate shall document and make available the information required to provide an accounting of disclosures to an Individual in accordance with 45 CFR § 164.528.

3. Obligations of Customer

  • 3.1 Notice of Privacy Practices. Customer shall notify Business Associate of any limitation(s) in its notice of privacy practices to the extent that such limitation may affect Business Associate’s use or disclosure of PHI.
  • 3.2 Requests. Customer shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Customer.

4. Term and Termination

  • 4.1 Term. The Term of this Agreement shall be effective as of the Effective Date and shall terminate when all PHI provided by Customer to Business Associate is destroyed or returned to Customer.
  • 4.2 Termination for Cause. Upon Customer’s knowledge of a material breach by Business Associate, Customer may provide an opportunity for Business Associate to cure or may immediately terminate this Agreement.
  • 4.3 Return or Destruction. Upon termination, Business Associate shall, if feasible, return or destroy all PHI received from Customer. If return or destruction is not feasible, Business Associate shall extend the protections of this Agreement to the information.

5. Indemnification and Liability

  • 5.1 Indemnification. Business Associate shall indemnify and hold Customer harmless from and against any third-party claims or government fines resulting from a Breach of PHI caused by Business Associate’s gross negligence or willful misconduct.
  • 5.2 Limitation of Liability. (Market Trend) The parties agree that any limitation of liability set forth in the underlying Services Agreement shall apply to this Agreement, except in cases of Business Associate’s gross negligence regarding data security obligations.

6. Miscellaneous

  • 6.1 Regulatory References. A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended.
  • 6.2 Amendment. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for Customer to comply with the requirements of HIPAA.
  • 6.3 Governing Law. This Agreement shall be governed by the laws of Leon County, Florida  (or the state specified in the Services Agreement).
  • 6.4 Conflict. In the event of a conflict between the terms of this Agreement and the Services Agreement, the terms of this Agreement shall control regarding the protection of PHI.

IN WITNESS WHEREOF, the parties have executed this Agreement as of the Effective Date.

FOR OMNITO (Business Associate): 

By:

Name:

Title:

FOR CUSTOMER (Covered Entity/BA): 

By:

Name:

Title:

Download