2021-018 - Laserfiche WebLink

Home Browse Search

A TRUE COPY CERTIFICATION ON LAST PAGE J.R. SMITH, CLERK BUSINESS ASSOCIATE AGREEMENT (FOR HIPAA) If a Customer is a Covered Entity or a Business Associate and includes Protected Health Information in Customer Data (as such terms are defined below), execution of a license agreement that includes Luminare's Terms of use ("Agreement") will incorporate the terms of this HIPAA Business Associate Agreement ("BAA") into that agreement. If there is any conflict between a provision in this BAA and a provision in the Agreement, this BAA will control. WHEREAS, Covered Entity and Business Associate have executed the Agreement pursuant to which Business Associate provides services (the "Agreement Services") for Covered Entity that may require Business Associate to access or create health information that is protected by state and/or federal law; WHEREAS, Business Associate and Covered Entity desire that Business Associate obtain access to such information in accordance with the terms specified herein; and NOW THEREFORE, in consideration of the mutual promises set forth in this BAA and other good and valuable consideration, the sufficiency and receipt of which are hereby severally acknowledged, the parties agree as follows: 1. Definitions. Unless otherwise specified in this BAA, all capitalized terms not otherwise defined shall have the meanings established in Title 45, Parts 160 and 164, of the United States Code of Federal Regulations, as amended from time to time, and/or in the American Recovery and Reinvestment Act of 2009 ("ARRA"). For purposes of clarification, the following terms shall have the definitions set forth below: 1.1 "Privacy Standards" shall mean the Standards for Privacy of Individually Identifiable Health Information as set forth in 45 C.F.R. Parts 160 and 164. 1.2 "Security Standards" shall mean the Security Standards for the Protection of Electronic Protected Health Information as set forth in 45 C.F.R. Parts 160 and 164. 2. Business Associate Obligations. Business Associate may receive from Covered Entity health information that is protected under applicable state and/or federal law, including without limitation, Protected Health Information ("PHI"). Business Associate agrees not to Use or Disclose (or permit the Use or Disclosure of) PHI in a manner that would violate the requirements of the Privacy Standards or the Security Standards if the PHI were used or disclosed by Covered Entity in the same manner. Business Associate shall use appropriate safeguards to prevent the Use or Disclosure of PHI other than as expressly permitted under this BAA. 3. Use of PHI. Business Associate may use PHI as necessary (i) for performing the Agreement Services, (ii) for the proper management and administration of the Business Associate, or (iii) for carrying out its legal responsibilities, provided in each case that such Uses are permitted under federal and state law. Covered Entity shall retain all rights in the PHI not granted herein. 4. Disclosure of PHI. Business Associate may Disclose PHI as necessary (i) to perform the Agreement Services, (ii) for the proper management and administration of the Business Associate, or (iii) to carry out its legal responsibilities, provided that either (a) the Disclosure is Required by Law or (b) the Business Associate obtains reasonable assurances from the person to whom the information is Disclosed that the information will be held confidential and further Used and Disclosed only as Required by Law or for the purpose for which it was Disclosed to the person, and such person agrees to immediately notify the Business Associate of any instances of which it is aware that the confidentiality of the information has been breached. 5. Reports. Business Associate agrees to report to Covered Entity: 5.1 Any Use or Disclosure of PHI not authorized by this BAA within five (5) days of the Business Associate becoming aware of such unauthorized Use or Disclosure; 5.2 Any Security Incident within five (5) days of the Business Associate becoming aware of the Security Incident; and 5.3 Each report of a Breach of Unsecured PHI Discovered by Business Associate, to the extent Business Associate accesses, maintains, retains, modifies, records, stores, destroys or otherwise holds, Uses or Discloses Unsecured calendar days unless delayed for law enforcement purposes, shall be made without delay and in no case later than thirty ( ) y after Discovery of the Breach, and shall include the identification of each Individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired or Disclosed during such Breach. Notwithstanding