This Business Associate Agreement (this “BA Agreement”) is entered into by and between Think Smart Group Inc., a California corporation (“TSI”), and the TSI Customer (“End User”), who utilizes Think Smart’s products and services (the “Products and Services”). TSI and End User may be referred to individually as a “Party” and collectively as the “Parties.” Capitalized terms used in this BA Agreement without definition shall have the meanings assigned to such terms by the Administrative Simplification section of the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act (HITECH), and their implementing regulations as amended from time to time (collectively, 'HIPAA').
RECITALS
WHEREAS, TSI receives Protected Health Information (PHI) from or on behalf of End User pursuant to End User’s use of Think Smart’s Products and Services (“PHI”); and
WHEREAS, the Parties desire to enter into this Business Associate Agreement in order to comply with HIPAA.
NOW, THEREFORE, in consideration of the mutual premises and covenants contained herein and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
I. OBLIGATIONS OF TSI
Section 1.1. Use and Disclosure of PHI.
TSI shall use and disclose PHI only as permitted or required under this BA Agreement or as required by law. TSI shall not use or disclose PHI in any manner that violates HIPAA or the terms of this Agreement. TSI shall ensure that any PHI disclosed to third parties is protected under a written agreement that meets the requirements of HIPAA. Furthermore, TSI will use reasonable efforts to minimize the amount of PHI disclosed in any given situation.
Section 1.2. Safeguards.
TSI shall implement and maintain reasonable and appropriate administrative, physical, and technical safeguards to prevent the unauthorized use or disclosure of PHI. TSI will ensure that all personnel, agents, and Subcontractors have been adequately trained and are bound by confidentiality obligations that are at least as restrictive as those imposed by HIPAA.
Section 1.3. Minimum Necessary Standard.
TSI agrees to comply with the 'minimum necessary' standard under HIPAA by only requesting, using, and disclosing the minimum amount of PHI necessary to accomplish the purpose of the request, use, or disclosure.
Section 1.4. Mitigation.
TSI shall promptly take all reasonable steps to mitigate any harmful effects of any unauthorized use or disclosure of PHI of which TSI becomes aware. This includes notifying End User of the breach and cooperating in the resolution process.
Section 1.5. Subcontractors.
TSI agrees to enter into a written agreement with each Subcontractor that receives, maintains, or processes PHI on behalf of TSI, which shall include obligations that are at least as restrictive as those set forth in this Agreement. TSI shall ensure that its Subcontractors comply with HIPAA’s requirements regarding the safeguarding of PHI.
Section 1.6. Reporting Requirements.
TSI shall notify End User immediately of any unauthorized use or disclosure of PHI. In the event of a security incident involving EPHI, TSI will promptly report the incident in writing, detailing the nature of the incident and the corrective actions taken. TSI agrees to report any Security Incident as required by HIPAA regulations, including both successful and unsuccessful breaches of EPHI, unless otherwise exempted by HIPAA amendments.
Section 1.7. Access to PHI.
TSI shall provide End User access to PHI for the purpose of fulfilling End User’s obligations under HIPAA, including responding to requests for access, amendments, and accountings of disclosures. If TSI receives a request for access from an Individual, TSI will forward such requests to End User within ten (10) business days, and End User will bear sole responsibility for responding to such requests.
Section 1.8. Availability of PHI for Amendment.
TSI shall provide PHI to End User for amendment and incorporate any amendments to PHI as required by HIPAA. If TSI receives a request for amendment from an Individual, it will forward the request to End User for consideration.
Section 1.9. Accounting of Disclosures.
TSI shall maintain an accounting of disclosures of PHI as required under HIPAA and shall assist End User in providing such accounting within the time frame required by HIPAA. If TSI receives a request for an accounting from an Individual, TSI will promptly forward such request to End User.
II. OBLIGATIONS OF END USER
Section 2.1. Permissible Requests.
End User shall not request TSI to use or disclose PHI in any manner that would violate HIPAA or this Agreement. End User shall be solely responsible for ensuring that any disclosures made to TSI are permissible under HIPAA.
Section 2.2. Minimum Necessary Information.
End User shall ensure that any PHI disclosed to TSI is the minimum amount necessary for the accomplishment of the stated purpose, in compliance with HIPAA's minimum necessary standard.
Section 2.3. Permissions and Legal Requirements.
End User warrants that it has obtained all necessary consents, authorizations, and legal permissions required under HIPAA and other applicable laws to disclose PHI to TSI. End User shall notify TSI promptly of any revocation or modification of permissions regarding PHI, and TSI shall have no responsibility for any violation of such permissions.
III. TERMINATION OF THE EULA AND THIS BA AGREEMENT
Section 3.1. Termination.
This BA Agreement will remain in effect for as long as TSI maintains PHI, and the obligations contained herein shall survive the termination or expiration of this Agreement.
Section 3.2. Termination Upon Breach.
Either Party may terminate this Agreement with ninety (90) days written notice if the other Party materially breaches the terms of this Agreement and fails to cure such breach within the notice period. If termination is necessary to comply with HIPAA, the termination shall occur immediately upon notice.
Section 3.3. Return or Destruction of PHI.
Upon termination of this Agreement, TSI shall return or destroy all PHI, except where retention is required by law or regulatory authority. In such cases, TSI will continue to protect PHI under the terms of this Agreement.
IV. MISCELLANEOUS PROVISIONS
Section 4.1. Applicability.
This Agreement governs the use, disclosure, and protection of PHI by TSI as part of its services to End User, in compliance with HIPAA regulations.
Section 4.2. HIPAA Amendments.
The Parties acknowledge that HIPAA and the HITECH Act may be amended from time to time. This Agreement incorporates any amendments as they are enacted. TSI shall comply with the revised regulations as required by law, and End User agrees to notify TSI of any changes to the scope of its compliance obligations.
Section 4.3. Regulatory References.
Any reference to sections of HIPAA in this Agreement refers to the current version of those sections, as amended, and includes references to any amendments that may apply.
Section 4.4. Indemnification.
End User agrees to indemnify and hold TSI harmless from any and all claims, damages, liabilities, and costs (including reasonable attorneys' fees) arising from any breach of HIPAA or the terms of this Agreement by End User, its employees, or agents.
Section 4.5. Limitation of Liability.
Except for breaches related to confidentiality, security, or data protection, neither Party shall be liable for any indirect, special, incidental, or consequential damages, including but not limited to loss of profits, arising out of the performance of this Agreement.
Section 4.6. Entire Agreement.
This Agreement constitutes the entire understanding between the Parties regarding PHI, superseding any prior agreements on this subject. No amendments or waivers shall be effective unless in writing and signed by both Parties.
THINK SMART GROUP INC.
Robert Ross
President