Version 2.1 · Form of agreement — incorporated by reference into the Master Subscription Agreement
This Business Associate Agreement (this "BAA") is entered into as of the effective date identified in the applicable Order Form or Master Subscription Agreement (the "Effective Date") by and between the customer identified in the applicable Order Form, in its capacity as a Covered Entity or Business Associate, as applicable ("Customer"), and Flow EHR, Inc., a Delaware corporation doing business as FlowEHR ("Business Associate"). Customer and Business Associate are each a "Party" and together the "Parties."
Recitals
A. Customer is a Covered Entity or Business Associate, as applicable, under the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act and their implementing regulations (collectively, "HIPAA"), or has agreed to be treated as one under Section 16.7.
B. The Parties have entered into the FlowEHR Master Subscription Agreement (which incorporates the Common Paper Cloud Service Agreement Standard Terms Version 2.1) and one or more Order Forms, under which Business Associate provides services to Customer (collectively, the "Underlying Agreement").
C. In providing the Services under the Underlying Agreement, Business Associate may create, receive, maintain, or transmit Protected Health Information on behalf of Customer.
D. The Parties intend this BAA to satisfy the requirements of 45 C.F.R. § 164.504(e), as applicable to the Parties' relationship.
Accordingly, the Parties agree as follows:
1. Definitions
1.1 HIPAA Terms
Capitalized terms used but not otherwise defined in this BAA have the meanings given to them under HIPAA.
1.2 Additional Definitions
For purposes of this BAA:
- "Breach" has the meaning set forth in 45 C.F.R. § 164.402.
- "Breach Notification Rule" means Subpart D of 45 C.F.R. Part 164.
- "Data Aggregation" has the meaning set forth in 45 C.F.R. § 164.501.
- "De-Identified Data" means information that has been de-identified in accordance with 45 C.F.R. § 164.514(a)–(b).
- "Designated Record Set" has the meaning set forth in 45 C.F.R. § 164.501.
- "Discovery" means the first day on which a Breach or other event is known to Business Associate or, by exercising reasonable diligence, would have been known to Business Associate, consistent with 45 C.F.R. § 164.410(a)(2).
- "ePHI" means Electronic Protected Health Information.
- "HHS" means the U.S. Department of Health and Human Services.
- "Individual" has the meaning set forth in 45 C.F.R. § 164.501 and includes a personal representative where applicable.
- "PHI" means Protected Health Information created, received, maintained, or transmitted by Business Associate on behalf of Customer in connection with the Services. PHI does not include De-Identified Data.
- "Privacy Rule" means 45 C.F.R. Part 160 and Part 164, Subparts A and E.
- "Required by Law" has the meaning set forth in 45 C.F.R. § 164.103.
- "Security Incident" has the meaning set forth in 45 C.F.R. § 164.304, as applied to ePHI created, received, maintained, or transmitted by Business Associate on behalf of Customer.
- "Security Rule" means 45 C.F.R. Part 160 and Part 164, Subparts A and C.
- "Services" means the services provided by Business Associate to Customer under the Underlying Agreement.
- "Unsecured PHI" has the meaning set forth in 45 C.F.R. § 164.402.
2. Permitted Uses and Disclosures of PHI
2.1 Provision of Services
Business Associate may use or disclose PHI only (a) as necessary to perform the Services for Customer described in the Underlying Agreement, (b) as expressly permitted by Sections 2.2, 2.3 and 2.6, or (c) as Required by Law. Business Associate will not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Customer, except for the uses and disclosures permitted by Sections 2.2 and 2.3.
2.2 Management and Administration
Business Associate may use PHI for the proper management and administration of its business and to carry out its legal responsibilities. Business Associate may disclose PHI for these purposes only if the disclosure is Required by Law or Business Associate obtains reasonable assurances that the recipient will hold the PHI confidential and use or further disclose it only as Required by Law or for the purpose for which it was disclosed, and will notify Business Associate of any breach of confidentiality of which the recipient becomes aware.
2.3 De-Identification and Data Aggregation
Business Associate may de-identify PHI in accordance with 45 C.F.R. § 164.514(a)–(b). De-Identified Data is not PHI. Business Associate will not attempt to re-identify De-Identified Data and will contractually prohibit any permitted recipient from attempting to re-identify it.
Business Associate may use De-Identified Data only as permitted under the Underlying Agreement and any applicable Data Handling and AI Schedule. The use, ownership, retention, disclosure, model-development, benchmarking, and other commercial rights relating to De-Identified Data and Usage Data are governed by the Underlying Agreement, not this BAA.
Business Associate may use PHI to provide Data Aggregation services relating to Customer's Health Care Operations, as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B).
2.4 Minimum Necessary
Business Associate will not use or further disclose PHI other than as permitted or required by this BAA or as Required by Law. To the extent applicable, Business Associate will make reasonable efforts to use, disclose, or request only the minimum PHI necessary to accomplish the intended purpose.
2.5 Availability to Customer
Upon Customer's written request, Business Associate will make PHI in a Designated Record Set, if any, maintained by Business Associate available to Customer in the time and manner reasonably necessary for Customer to meet its obligations under 45 C.F.R. § 164.524, subject to the Underlying Agreement.
Business Associate is not required to create or maintain PHI in a Designated Record Set except to the extent the Services do so in the ordinary course.
2.6 Reporting Violations of Law
Business Associate may use PHI to report violations of law to appropriate federal or state authorities, as permitted by 45 C.F.R. § 164.502(j)(1).
2.7 Customer's Obligations Carried Out by Business Associate
To the extent Business Associate carries out one or more of Customer's obligations under Subpart E of 45 C.F.R. Part 164, including where the Services provide Individuals with access to PHI through a patient portal or deliver Customer's notice of privacy practices, Business Associate will comply with the requirements of Subpart E that apply to Customer in the performance of those obligations.
3. Safeguards
Business Associate will use appropriate safeguards to prevent use or disclosure of PHI other than as permitted by this BAA. Business Associate will implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI that it creates, receives, maintains, or transmits on behalf of Customer, in accordance with the Security Rule.
Business Associate will maintain reasonable policies, procedures, and workforce training designed to support compliance with this BAA and the Security Rule.
3.1 Location of PHI
Business Associate will store PHI only in the United States. Personnel of Business Associate, and of its subcontractor Hike Health, who are located in India may access PHI remotely, solely to provide, maintain, and support the Services. That access is limited to personnel who need it, and is subject to:
- Business Associate-managed access controls;
- multi-factor authentication;
- audit logging;
- HIPAA workforce training; and
- written confidentiality obligations.
PHI will not be downloaded to, or persistently stored on, any device or system outside the United States, other than transient display and memory caching necessary for remote access. Business Associate will give Customer notice under MSA Modification 4.8 before personnel in any additional country may access PHI, and Customer may object under that Modification.
4. Impermissible Uses, Disclosures, and Security Incidents
4.1 Notice of Impermissible Use or Disclosure; Security Incident
Business Associate will report to Customer any use or disclosure of PHI not permitted by this BAA and any Security Incident involving Customer's ePHI without unreasonable delay, and in no event later than five (5) business days after Discovery. The initial report will include the facts then known, and Business Associate will supplement it as further information becomes available.
4.2 Unsuccessful Security Incidents
The Parties acknowledge that unsuccessful security incidents are deemed reported by this Section 4.2, and Business Associate is not required to provide additional notice of such unsuccessful incidents. Unsuccessful security incidents include pings and other broadcast attacks on a firewall, port scans, unsuccessful log-on attempts, unsuccessful denial-of-service attempts that do not degrade the availability or integrity of the Services or ePHI, and packet sniffing or other network-monitoring activities that do not result in unauthorized access, use, disclosure, modification, destruction, or loss of PHI.
4.3 Cooperation
Business Associate will reasonably cooperate with Customer in investigating and mitigating a reportable impermissible use or disclosure or Security Incident, to the extent reasonably necessary for Customer to meet its obligations under HIPAA and applicable law.
5. Breach of Unsecured PHI
5.1 Notice
Business Associate will notify Customer in writing of any Breach of Unsecured PHI without unreasonable delay and in no event later than five (5) business days after Discovery, except to the extent a law-enforcement official requires a delay under 45 C.F.R. § 164.412.
5.2 Content and Updates
The notice will include, to the extent known and available at the time, the information required by 45 C.F.R. § 164.410(c), including the nature of the Breach, the types of Unsecured PHI involved, the Individuals affected if known, the steps Business Associate has taken or will take to investigate and mitigate the Breach, and recommended steps for Customer to take where appropriate. Business Associate will provide supplemental information as it becomes available.
5.3 External Notification
Unless Required by Law or expressly authorized in writing by Customer, Business Associate will not provide notice to affected Individuals, the Secretary of HHS, media, or other third parties on Customer's behalf. Customer is responsible for determining and carrying out its external notification obligations, except to the extent the Parties expressly agree otherwise in writing.
5.4 Costs and Liability
To the extent a Breach results from Business Associate's breach of this BAA or applicable law, Business Associate will reimburse Customer for reasonable, documented third-party costs incurred by Customer to meet its Breach-notification obligations. All claims, costs, damages, and liabilities arising under this Section 5 are subject to the limitations of liability stated in the Underlying Agreement.
6. Mitigation
Business Associate will take reasonable measures, to the extent practicable and within its control, to mitigate known harmful effects of a use or disclosure of PHI by Business Associate or its subcontractors in violation of this BAA.
7. Subcontractors
7.1 Downstream Obligations
In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate will ensure that each subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate enters into a written business associate agreement that complies with 45 C.F.R. §§ 164.504(e) and 164.314(a), under which the subcontractor agrees to the same restrictions and conditions on the use and disclosure of PHI that apply to Business Associate under this BAA and to comply with Subpart C of 45 C.F.R. Part 164. Business Associate's obligations under Sections 4 and 5 run from Business Associate's own Discovery, whatever a subcontractor's reporting period.
7.2 Subprocessor List and Notice
Business Associate will maintain a current list of material subcontractors that process PHI and will provide notice of material additions in accordance with the Underlying Agreement.
Customer may object to a material addition only on reasonable, documented privacy or security grounds. If the Parties cannot resolve a reasonable objection, Business Associate may offer a commercially reasonable alternative or Customer may terminate the affected Services in accordance with the Underlying Agreement.
7.3 Responsibility
Business Associate remains responsible for its subcontractors' performance of the obligations applicable to them under this BAA.
8. Security Documentation
Upon Customer's reasonable written request and subject to Customer's confidentiality obligations, Business Associate will provide security documentation customarily made available to similarly situated customers. Such documentation may include a summary of Business Associate's then-current administrative, physical, and technical safeguards and any independent third-party security assessment materials that Business Associate is permitted to disclose.
Except as expressly stated in an Order Form or other written agreement signed by Business Associate, Business Associate makes no representation that it maintains a SOC 2 Type II attestation, HITRUST certification, AT-C 315 report, or other certification or audit report, and this BAA does not require Business Associate to obtain any such item.
9. Access by Individuals
To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate will make that PHI available to Customer in the time and manner reasonably requested by Customer to enable Customer to satisfy its obligations under 45 C.F.R. § 164.524.
If an Individual requests access to PHI directly from Business Associate, Business Associate will forward the request to Customer within five (5) business days. Customer is solely responsible for determining whether and how to respond to an Individual's request, including whether an applicable exception permits or requires denial.
10. Amendment of PHI
To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate will, upon Customer's written instruction, make an amendment to that PHI or otherwise enable Customer to make the amendment, in the time and manner reasonably necessary for Customer to meet its obligations under 45 C.F.R. § 164.526.
If an Individual sends an amendment request directly to Business Associate, Business Associate will forward the request to Customer within five (5) business days. Customer is solely responsible for determining whether and how to respond to an Individual's amendment request.
11. Accounting of Disclosures
Business Associate will document disclosures of PHI to the extent required for Customer to respond to an accounting-of-disclosures request under 45 C.F.R. § 164.528. Upon Customer's written request, Business Associate will provide the information reasonably necessary for Customer to respond to such request within ten (10) business days.
If an Individual sends an accounting request directly to Business Associate, Business Associate will forward the request to Customer within five (5) business days.
12. Books and Records
Business Associate will make its internal practices, books, records, agreements, policies, and procedures relating to the use and disclosure of PHI available to the Secretary of HHS, upon request, for purposes of determining compliance with HIPAA.
13. Customer Obligations
Customer will:
(a) notify Business Associate of any limitation in Customer's notice of privacy practices under 45 C.F.R. § 164.520, to the extent that limitation may affect Business Associate's use or disclosure of PHI;
(b) notify Business Associate of any change in, or revocation of, an Individual's authorization or permission to use or disclose PHI, to the extent the change or revocation may affect Business Associate's use or disclosure of PHI;
(c) notify Business Associate of any restriction on the use or disclosure of PHI to which Customer has agreed under 45 C.F.R. § 164.522, to the extent the restriction may affect Business Associate's use or disclosure of PHI;
(d) not request Business Associate to use or disclose PHI in a manner that would not be permissible under HIPAA if done by Customer, except that Business Associate may use or disclose PHI for Data Aggregation, proper management and administration, and de-identification as expressly permitted by this BAA and the Underlying Agreement; and
(e) obtain and maintain all notices, consents, authorizations, and permissions required by applicable federal, state, and local law for Customer's use of the Services, including for recording clinical encounters, ambient documentation, transcription, telehealth, and patient communications.
14. PHI and Data Ownership
Nothing in this BAA transfers ownership of PHI or Customer Data to Business Associate. As between the Parties, ownership and permitted uses of Customer Data, De-Identified Data, and Usage Data are governed by the Underlying Agreement.
PHI that has been de-identified in accordance with Section 2.3 is no longer PHI under HIPAA, but its use remains subject to the Underlying Agreement.
15. Term and Termination
15.1 Term
This BAA becomes effective on the Effective Date and remains in effect for so long as Business Associate creates, receives, maintains, or transmits PHI on behalf of Customer.
15.2 Termination for Material Breach
If either Party knows of a material breach of this BAA by the other Party, the non-breaching Party will provide written notice and an opportunity to cure within thirty (30) days, to the extent cure is feasible. If the breach is not cured within that period, the non-breaching Party may terminate the affected Services or the Underlying Agreement to the extent feasible. If termination is not feasible, the non-breaching Party may report the problem to the Secretary of HHS as required by HIPAA.
15.3 Effect of Termination
Upon termination of the Underlying Agreement or this BAA, Business Associate will return or destroy PHI, if feasible, in accordance with the data-export and deletion provisions of the Underlying Agreement.
Business Associate may retain: (a) PHI contained in routine backup or archival media until deleted in the ordinary course of Business Associate's backup-retention practices; (b) records required to be retained by applicable law, including security and audit logs; and (c) De-Identified Data created in accordance with this BAA and the Underlying Agreement.
With respect to retained PHI, Business Associate will continue to extend the protections of this BAA and will limit further uses and disclosures to those purposes that make return or destruction infeasible or that are otherwise Required by Law. If return or destruction is infeasible for reasons other than ordinary backup or archival retention, Business Associate will provide Customer written notice describing the conditions making return or destruction infeasible.
This Section 15.3 survives termination of this BAA.
16. General Provisions
16.1 Relationship to Underlying Agreement; Order of Precedence
This BAA forms part of the Underlying Agreement. In the event of a conflict between this BAA and the Underlying Agreement, this BAA controls solely with respect to PHI and the Parties' HIPAA obligations. The limitations of liability in the Underlying Agreement apply to claims arising under this BAA only to the extent expressly stated in the Underlying Agreement.
16.2 No Third-Party Beneficiaries
Except as expressly stated in this BAA or as provided by applicable law, this BAA does not create rights in favor of any third party.
16.3 Regulatory References
A reference in this BAA to HIPAA or a HIPAA regulation means that law or regulation as amended, renumbered, or replaced from time to time.
16.4 Notices
Notices under this BAA will be delivered in accordance with the notice provisions of the Underlying Agreement.
16.5 Amendment
The Parties will negotiate in good faith to amend this BAA as reasonably necessary to comply with changes in applicable law. Except as Required by Law, no amendment or waiver is effective unless it is in writing and signed by authorized representatives of both Parties.
16.6 Counterparts; Electronic Signatures
This BAA may be executed in counterparts, including by electronic signature or electronic record. Each counterpart is deemed an original, and all counterparts together constitute one instrument. The Parties may execute this BAA by signing an Order Form that incorporates it.
16.7 Customers That Are Not Covered Entities
If Customer is not a Covered Entity or a Business Associate under HIPAA, the Parties nonetheless agree that this BAA governs Business Associate's handling of patient information that Customer submits to the Services, as if that information were PHI and Customer were a Covered Entity. This Section creates contractual obligations only. It is not an admission by either Party that HIPAA applies to Customer.