Business Associate Agreement

1. Definitions

Capitalized terms used but not otherwise defined in this Agreement shall have the meanings ascribed to them in the HIPAA Rules, including but not limited to: Breach, Data Aggregation, Designated Record Set, Disclosure, Electronic Protected Health Information ("ePHI"), Health Care Operations, Individual, Minimum Necessary, Protected Health Information, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

2. Obligations of CareOS as Business Associate

CareOS agrees to:

• Not use or disclose PHI other than as permitted or required by this Agreement or as Required by Law.
• Use appropriate administrative, physical, and technical safeguards, and comply with Subpart C of 45 C.F.R. Part 164 with respect to ePHI, to prevent the use or disclosure of PHI other than as provided for by this Agreement.
• Report to Covered Entity any use or disclosure of PHI not provided for by this Agreement of which CareOS becomes aware, including Breaches of Unsecured PHI as required at 45 C.F.R. § 164.410, and any Security Incident of which it becomes aware.
• In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractors that create, receive, maintain, or transmit PHI on behalf of CareOS agree in writing to the same restrictions, conditions, and requirements that apply to CareOS with respect to such information.
• Make available PHI in a Designated Record Set to the Covered Entity as necessary to satisfy Covered Entity's obligations under 45 C.F.R. § 164.524.
• Make any amendments to PHI in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 C.F.R. § 164.526, or take other measures as necessary to satisfy Covered Entity's obligations under 45 C.F.R. § 164.526.
• Maintain and make available the information required to provide an accounting of disclosures to the Covered Entity as necessary to satisfy Covered Entity's obligations under 45 C.F.R. § 164.528.
• To the extent CareOS is to carry out one or more of Covered Entity's obligation(s) under Subpart E of 45 C.F.R. Part 164, comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such obligation(s).
• Make its internal practices, books, and records available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance with the HIPAA Rules.

3. Permitted Uses and Disclosures by CareOS

CareOS may use or disclose PHI only as necessary to perform the services set forth in any underlying services agreement with the Covered Entity, or as Required by Law. CareOS may also:

• Use PHI for the proper management and administration of CareOS or to carry out its legal responsibilities.
• Disclose PHI for such purposes provided that disclosures are Required by Law, or CareOS obtains reasonable assurances from the receiving party that the information will remain confidential and used only as required or for the purpose for which it was disclosed, and that the receiving party will notify CareOS of any instances of which it is aware that the confidentiality of the information has been breached.
• Provide Data Aggregation services relating to the Health Care Operations of the Covered Entity as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B).
• De-identify PHI in accordance with 45 C.F.R. § 164.514(a)–(c).

4. Obligations of Covered Entity

Covered Entity shall:

• Notify CareOS of any limitation(s) in its notice of privacy practices that may affect CareOS's use or disclosure of PHI.
• Notify CareOS of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI.
• Notify CareOS of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 C.F.R. § 164.522.
• Not request CareOS to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Covered Entity.

5. Breach Notification

CareOS shall, following the discovery of a Breach of Unsecured PHI, notify the Covered Entity without unreasonable delay and in no case later than sixty (60) calendar days after discovery. The notification shall include, to the extent possible, the identification of each Individual whose Unsecured PHI was, or is reasonably believed to have been, accessed, acquired, used, or disclosed during the Breach, along with any other available information required under 45 C.F.R. § 164.410.

6. Term and Termination

Term. This Agreement shall be effective as of the date the Covered Entity first provides PHI to CareOS and shall remain in effect until terminated in accordance with this Section or upon termination of the underlying services agreement.

Termination for Cause. Either party may terminate this Agreement if the other party materially breaches a term of this Agreement and fails to cure such breach within thirty (30) days of written notice.

Return or Destruction of PHI. Upon termination, CareOS shall, if feasible, return or destroy all PHI received from, or created or received by CareOS on behalf of, the Covered Entity. If return or destruction is not feasible, CareOS shall extend the protections of this Agreement to such PHI and limit further uses and disclosures to those purposes that make return or destruction infeasible.

7. Miscellaneous

• Regulatory References. A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended.
• Amendment. The parties agree to take such action as is necessary to amend this Agreement from time to time as is required to comply with the HIPAA Rules and any other applicable law.
• Survival. The respective rights and obligations of CareOS under Section 6 (Return or Destruction of PHI) shall survive the termination of this Agreement.
• Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits compliance with the HIPAA Rules.
• No Third-Party Beneficiaries. Nothing in this Agreement is intended, nor shall be deemed, to confer any rights or remedies upon any person other than the parties.

8. Requesting a Signed BAA

Covered Entities seeking to execute a counter-signed BAA with CareOS prior to transmitting PHI may contact us using the information below. CareOS will provide an executable copy of this Agreement upon request.