Business Associate Agreement (BAA)
|
MAMACARE360 HIPAA BUSINESS ASSOCIATE AGREEMENT 45 C.F.R. Parts 160 and 164 (HIPAA/HITECH) |
|
PARTIES TO THIS AGREEMENT Covered Entity (Provider): _____________________________________________ License / NPI: ___________________ Practice / Organization Name: _____________________________________________ Address: _____________________________________________ State: _______ ZIP: ____________ Business Associate: MamaCare360 LLC, Atlanta, Georgia · www.mamacare360.com Effective Date of Agreement: _____________________________________________ |
RECITALS
This Business Associate Agreement (201cAgreement201d) is entered into between the Covered Entity identified above (201cCE201d) and MamaCare360 LLC (201cBusiness Associate201d or 201cBA201d), effective as of the date set forth above.
The CE is a healthcare provider subject to the Health Insurance Portability and Accountability Act of 1996 ('HIPAA'), the Health Information Technology for Economic and Clinical Health Act ('HITECH'), and the regulations promulgated thereunder, including the HIPAA Privacy Rule (45 C.F.R. Part 164, Subparts A and E), the Security Rule (45 C.F.R. Part 164, Subparts A and C), and the Breach Notification Rule (45 C.F.R. Part 164, Subpart D).
The BA provides remote patient monitoring and care documentation services through a web-based Software as a Medical Device (SaMD) platform. In the course of providing these services, BA may create, receive, maintain, or transmit Protected Health Information ('PHI') on behalf of the CE. This Agreement sets forth the terms and conditions under which BA may use and disclose such PHI.
SECTION 1 — DEFINITIONS
Terms used but not defined in this Agreement shall have the same meaning as those terms are defined under HIPAA and its implementing regulations.
• "'Breach' means the acquisition, access, use, or disclosure of PHI in a manner not permitted by the Privacy Rule that compromises the security or privacy of the PHI.
• "'Business Associate' has the meaning given to such term under 45 C.F.R. § 160.103. • `"Covered Entity" means the healthcare provider identified above.`
• "'Protected Health Information' or 'PHI' has the meaning given to such term under 45 C.F.R. § 160.103, limited to PHI created, received, maintained, or transmitted by BA on behalf of CE.
• "'Services' means the remote patient monitoring, mood and symptom logging, screening administration, and care documentation services provided by MamaCare360 to the CE and its patients.
• "'Subcontractor' means any person to whom BA delegates a function, activity, or service that involves PHI, other than a workforce member.
SECTION 2 — OBLIGATIONS OF BUSINESS ASSOCIATE
2.1 Use and Disclosure Limitations. BA shall not use or disclose PHI other than as permitted or required by this Agreement or as Required by Law. BA shall use PHI only to provide the Services described herein.
2.2 Appropriate Safeguards. BA shall implement and maintain appropriate administrative, physical, and technical safeguards to protect the privacy and security of PHI, including compliance with the Security Rule with respect to electronic PHI (ePHI).
2.3 Reporting of Breaches. BA shall report to CE, without unreasonable delay and in no case later than thirty (30) calendar days after discovery, any Breach of Unsecured PHI, any Security Incident, or any use or disclosure of PHI not permitted by this Agreement.
2.4 Subcontractors. BA shall ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of BA agrees to the same restrictions, conditions, and requirements that apply to BA under this Agreement.
2.5 Access and Amendment. BA shall make PHI available to CE as necessary to fulfill CE's obligations under the Privacy Rule, including patients' rights to access and amendment of their PHI.
2.6 Accounting of Disclosures. BA shall document and make available to CE information required for CE to provide an accounting of disclosures of PHI as required by 45 C.F.R. § 164.528.
2.7 Minimum Necessary. BA shall request, use, and disclose only the minimum necessary PHI to accomplish the purpose of the request, use, or disclosure.
2.8 Government Access. BA shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of Health and Human Services for the purpose of determining compliance with HIPAA.
2.9 Return or Destruction. Upon termination of this Agreement, BA shall, to the extent feasible, return or destroy all PHI received from CE or created or received by BA on behalf of CE. If return or destruction is not feasible, BA shall extend the protections of this Agreement to the retained PHI and limit further uses and disclosures.
SECTION 3 — PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE
3.1 Services. BA is authorized to use and disclose PHI as necessary to provide the Services described in this Agreement, including making PHI available to the CE's authorized providers through the MamaCare360 web platform.
3.2 Operations. BA may use PHI for the proper management and administration of BA's business and to carry out its legal responsibilities, provided that such disclosures are Required by Law, or BA obtains reasonable assurances from the recipient that the information will remain confidential.
3.3 Data Aggregation. BA may use PHI to provide data aggregation services to CE as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B). Any aggregated or de-identified data shared with CE or third parties shall not include any individually identifiable information.
3.4 Prohibited Uses. BA shall not use or disclose PHI for marketing purposes, shall not sell PHI, and shall not use or disclose PHI in any manner that would violate Subpart E of 45 C.F.R. Part 164 if done by CE.
SECTION 4 — OBLIGATIONS OF COVERED ENTITY
4.1 Notice of Privacy Practices. CE shall notify BA of any limitations in CE's Notice of Privacy Practices that would affect BA's use or disclosure of PHI.
4.2 Patient Consent. CE shall obtain and document patient authorization or consent for the collection and sharing of PHI through the MamaCare360 platform as required by applicable law, or shall ensure that MamaCare360's patient consent process satisfies applicable requirements.
4.3 Permissible Requests. CE shall not request that BA use or disclose PHI in any manner that would violate applicable law.
4.4 Revocations. CE shall promptly notify BA of any revocation of patient consent or authorization that would affect BA's permitted use or disclosure of that patient's PHI.
SECTION 5 — TERM AND TERMINATION
5.1 Term. This Agreement shall be effective as of the Effective Date and shall continue in full force until the earlier of (a) termination by either party as provided below, or (b) the termination of all Services between the parties.
5.2 Termination for Cause. Either party may terminate this Agreement upon thirty (30) days' written notice if the other party materially breaches any provision of this Agreement and fails to cure such breach within the notice period.
5.3 Immediate Termination. CE may immediately terminate this Agreement if CE determines that BA has violated a material term of this Agreement and cure is not possible.
5.4 Effect of Termination. Upon termination, BA shall return or destroy all PHI per Section 2.9. The obligations of BA under this Agreement shall survive termination as required by law.
SECTION 6 — GENERAL PROVISIONS
6.1 Amendment. The parties agree to amend this Agreement as necessary to comply with changes in HIPAA, HITECH, or other applicable law. MamaCare360 will provide written notice of any such amendments.
6.2 Interpretation. This Agreement shall be interpreted as broadly as necessary to implement and comply with HIPAA and HITECH. Any ambiguity shall be resolved in favor of a meaning that permits CE to comply with applicable law.
6.3 No Third-Party Beneficiaries. This Agreement is for the sole and exclusive benefit of the parties. Nothing in this Agreement shall confer rights on any third party.
6.4 Governing Law. This Agreement shall be governed by the laws of the State of Georgia and applicable federal law.
6.5 Entire Agreement. This Agreement, together with any services agreement between the parties, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior agreements relating to PHI.
6.6 Electronic Signatures. The parties agree that electronic signatures executed through DocuSign or another qualified electronic signature platform are valid and binding under the Electronic Signatures in Global and National Commerce Act (E-SIGN Act) and the Uniform Electronic Transactions Act (UETA).
SIGNATURES
IN WITNESS WHEREOF, the parties have executed this Business Associate Agreement as of the Effective Date.
|
COVERED ENTITY (Provider) Authorized Signature Printed Name & Title Date |
BUSINESS ASSOCIATE — MamaCare360 LLC Authorized Signature Printed Name & Title Date |
|
MamaCare360 LLC · Atlanta, Georgia · info@mamacare360.com · mamacare360.com This document is intended for use with DocuSign or equivalent qualified electronic signature platform. |