Terms used but not defined in this Agreement have the meaning given in the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations at 45 C.F.R. Parts 160 and 164, as amended by the HITECH Act and the Omnibus Rule ("HIPAA").
| Term | Meaning |
|---|---|
| PHI | Protected Health Information, limited to that created, received, maintained or transmitted by Business Associate on behalf of Covered Entity. |
| ePHI | PHI maintained or transmitted in electronic form. |
| Breach | As defined at 45 C.F.R. § 164.402. |
| Security Incident | As defined at 45 C.F.R. § 164.304. |
| Required By Law | As defined at 45 C.F.R. § 164.103. |
| Services | The Noxtill business operating system provided under the Terms of Service. |
1. Business Associate may use and disclose PHI only as necessary to perform the Services, as Required By Law, or as permitted by this Agreement.
2. Business Associate may use PHI for its proper management and administration and to carry out its legal responsibilities.
3. Business Associate may disclose PHI for those purposes only if the disclosure is Required By Law, or if Business Associate obtains reasonable assurances in writing from the recipient that the PHI will be held confidentially, used or further disclosed only as Required By Law or for the purpose disclosed, and that the recipient will notify Business Associate of any breach of confidentiality.
4. Business Associate may de-identify PHI in accordance with 45 C.F.R. § 164.514(b) and use de-identified information for any lawful purpose.
5. Business Associate will not sell PHI, and will not use or disclose PHI for marketing or fundraising, except as permitted by HIPAA and authorised in writing by Covered Entity.
6. Business Associate will make reasonable efforts to use, disclose and request only the minimum necessary PHI to accomplish the intended purpose.
Business Associate will implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of ePHI, and will comply with the Security Rule at 45 C.F.R. Part 164 Subpart C with respect to ePHI.
Those safeguards are described in our Security page and in Annex 2 of our Data Processing Agreement, and include encryption in transit and at rest, access control, audit logging, tenant isolation and documented incident response.
Business Associate will ensure that any subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to restrictions and conditions at least as restrictive as those that apply to Business Associate under this Agreement, in accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2).
The current list of subcontractors is at https://noxtill.com/subprocessors.
| Right | Business Associate's obligation | Timing |
|---|---|---|
| Access — § 164.524 | Make PHI in a Designated Record Set available to Covered Entity, or to the individual as directed. | Within 10 business days of request. |
| Amendment — § 164.526 | Make PHI available for amendment and incorporate amendments as directed by Covered Entity. | Within 10 business days. |
| Accounting — § 164.528 | Document disclosures and provide the information needed for Covered Entity to respond to an accounting request. | Within 10 business days. |
| Restriction — § 164.522 | Comply with a restriction Covered Entity has agreed to and communicated in writing. | On notice. |
Where an individual contacts Business Associate directly, Business Associate will not respond substantively and will forward the request to Covered Entity without undue delay.
| Event | Notification | Timing |
|---|---|---|
| Breach of Unsecured PHI | Written notice with the information required by 45 C.F.R. § 164.410, including the individuals affected, the PHI involved, what happened and what is being done. | Without unreasonable delay and in no case later than 10 calendar days after discovery. |
| Use or disclosure not permitted by this Agreement | Written notice with the same detail. | Within 10 calendar days of discovery. |
| Successful Security Incident | Written notice. | Within 10 calendar days of discovery. |
| Unsuccessful Security Incidents — pings, port scans, failed logins, blocked traffic | Reported in aggregate on request. This paragraph constitutes notice of their ongoing occurrence; individual notice is not required. | On request. |
Business Associate will mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure in violation of this Agreement.
Covered Entity is responsible for notification to individuals, to the Secretary of Health and Human Services, and to the media where required. Business Associate will provide the information Covered Entity needs to make those notifications.
Business Associate will make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary of Health and Human Services for purposes of determining Covered Entity's compliance with HIPAA. Business Associate will notify Covered Entity of any such request, unless prohibited.
1. Covered Entity will notify Business Associate of any limitation in its Notice of Privacy Practices that affects Business Associate's use or disclosure of PHI.
2. Covered Entity will notify Business Associate of any change in, or revocation of, an individual's permission to use or disclose PHI.
3. Covered Entity will notify Business Associate of any restriction on use or disclosure that it has agreed to under § 164.522.
4. Covered Entity will not request Business Associate to use or disclose PHI in any manner that would not be permissible under HIPAA if done by Covered Entity.
5. Covered Entity is responsible for configuring the Services appropriately, including access permissions, retention settings and recording policy, and for restricting PHI to features designed for it.
This Agreement takes effect on signature and continues until all PHI is destroyed or returned, or until the protections in section 10 are extended to it.
Covered Entity may terminate this Agreement and the Services if Business Associate materially breaches this Agreement and fails to cure within 30 days of written notice, or immediately if cure is not possible.
On termination, Business Associate will return or destroy all PHI it maintains in any form, and will retain no copies, except where return or destruction is infeasible.
Where it is infeasible — including PHI persisting in encrypted backups until those backups expire on their normal cycle — Business Associate will extend the protections of this Agreement to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for so long as it retains the PHI.
Business Associate will provide written certification of destruction on request.
- Interpretation. Any ambiguity is resolved to permit compliance with HIPAA.
- Amendment. The parties will amend this Agreement as necessary to comply with changes to HIPAA.
- Conflict. Where this Agreement conflicts with the Terms of Service or the Data Processing Agreement, this Agreement controls with respect to PHI.
- No third-party beneficiaries. Nothing confers rights on any person other than the parties.
- Governing law. As stated in the Terms of Service, except where HIPAA requires otherwise.
- Survival. Sections 6, 7, 10 and this section survive termination.
| Party | Signature block |
|---|---|
| Covered Entity | Name: ________________________ Title: ________________________ Entity: ______________________ Date: _________________________ Signature: ___________________________________________________ |
| Business Associate | Noxtill LLC Name: ________________________ Title: ________________________ Date: _________________________ Signature: ___________________________________________________ |