HIPAA Business Agreement (subcontractor) 

Download

This HIPAA Subcontractor Agreement (“Agreement”) is between Forcebrain.com dba Omnito (“Omnito”) and  (“Subcontractor”) and is effective as of
(“Effective Date”).

RECITALS

WHEREAS, Certain clients of Omnito are Covered Entities under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”). Omnito is a Business Associate of said Covered Entities;

WHEREAS, Omnito and Subcontractor have entered into an agreement for Subcontractor to provide services in which Omnito will disclose certain Protected Health Information (“PHI”) to Subcontractor or Subcontractor may create or receive PHI for or on behalf of Omnito;

WHEREAS, the parties acknowledge that in 2025-2026, the Department of Health and Human Services (HHS) increased requirements for technical safeguards, specifically regarding Artificial Intelligence (AI) and multi-factor authentication (MFA);

NOW, THEREFORE, in reliance on the mutual covenants and promises contained herein, the parties hereto hereby agree as follows:

1. Definitions

  • “Breach” and “Security Incident” shall have the same meaning as those terms in 45 CFR § 164.402 and 164.304.
  • “Unsuccessful Security Incident” shall mean pings and other broadcast attacks on a firewall, port scans, unsuccessful log-on attempts, denial of service attacks, or any combination of the above, so long as such incident does not result in unauthorized access, use, or disclosure of PHI.
  • “Protected Health Information” or “PHI” shall have the meaning set forth in 45 CFR § 160.103, limited to information Subcontractor creates, accesses, transmits, or receives on behalf of Omnito.

2. Services

Omnito and Subcontractor have executed, and may in the future execute, agreements (“Services Agreements”) pursuant to which Subcontractor provides services to Omnito that require the use or disclosure of PHI.

3. Obligations of Subcontractor

  • 3.1 Permitted Use and Disclosure. Except as expressly provided herein, Subcontractor may only use or disclose PHI for the purpose of providing the Services.
  • 3.2 AI and Machine Learning Restrictions. (NEW STANDARD) Subcontractor shall not use PHI to train, improve, or “fine-tune” any Artificial Intelligence (AI) models or machine learning algorithms without the express, separate written consent of Omnito. Subcontractor warrants that PHI will not be ingested by “Public” AI tools.
  • 3.4 Technical Safeguards & MFA. Subcontractor shall implement appropriate administrative, technical, and physical safeguards. Subcontractor specifically agrees to require Multi-Factor Authentication (MFA) for all personnel and systems that access Omnito’s PHI.
  • 3.5 Security of EPHI. Subcontractor agrees to comply with the applicable standards of 45 CFR §§ 164.306 through 164.316, including encryption of PHI at rest and in transit using NIST-validated cryptographic modules (e.g., FIPS 140-2).
  • 3.6 Reporting of Breach. Subcontractor shall report to Omnito within forty-eight (48) hours any acquisition, access, use, or disclosure of PHI not permitted by this Agreement.
  • 3.7 Reporting of Security Incidents. Subcontractor shall report to Omnito any successful Security Incident. The parties agree that this section constitutes notice of Unsuccessful Security Incidents (as defined in Section 1), and no further notice is required for such unsuccessful attempts.
  • 3.8 Downstream Subcontractors. Subcontractor shall ensure that any agent or subcontractor that receives PHI on Subcontractor’s behalf agrees in writing to the same restrictions and conditions that apply to Subcontractor under this Agreement.
  • 3.9 Access and Amendment. Subcontractor agrees to provide access to PHI in a Designated Record Set within five (5) business days of a request by Omnito to satisfy the requirements of 45 CFR § 164.524.

4. Obligations of Omnito

Omnito shall notify Subcontractor of any changes in the Covered Entity’s Notice of Privacy Practices or any withdrawal of authorization by an Individual that may affect Subcontractor’s use or disclosure of PHI.

5. Term and Termination

  • 5.1 Term. This Agreement shall terminate when all PHI is destroyed or returned to Omnito.
  • 5.2 Termination for Cause. Upon Omnito’s knowledge of a material breach by Subcontractor, Omnito shall provide a reasonable opportunity for Subcontractor to cure the breach. If Subcontractor does not cure the breach, Omnito may immediately terminate this Agreement.
  • 5.3 Effect of Termination. Subcontractor shall return or destroy all PHI and retain no copies. If destruction is not feasible, Subcontractor shall extend the protections of this Agreement to such information.

6. Indemnification

Subcontractor shall indemnify and hold Omnito, its affiliates, and any Covered Entity harmless from and against any claim, cause of action, liability, damage, or expense (including reasonable attorneys’ fees and government-imposed fines) arising out of or in connection with any non-permitted use or disclosure of PHI or other breach of this Agreement by Subcontractor or its agents.

7. Limitation of Liability

(NEW STANDARD) Notwithstanding any “Limitation of Liability” or “Cap on Damages” contained in the underlying Services Agreement, the parties agree that such limitations shall not apply to Subcontractor’s indemnification obligations under Section 6 of this Agreement.

8. Miscellaneous

  • 8.1 Compliance with Laws. Subcontractor shall comply with all applicable federal and state laws, including HIPAA and the HITECH Act.
  • 8.2 Choice of Law. This Agreement shall be governed by the laws of Leon County, Florida
  • 8.3 Counterparts. This agreement may be signed in two or more counterparts, each of which shall be deemed original.

IN WITNESS WHEREOF, the parties hereto have duly executed this HIPAA Subcontractor Agreement, to be effective as of the Effective Date.

Omnito (Forcebrain.com): 

By:

Name:

Title:

Subcontractor:

By:

Name:

Title:

Download