Business Associate Agreement

Terms used but not otherwise defined in this Agreement have the meaning given in the Health Insurance Portability and Accountability Act of 1996, its implementing regulations at 45 CFR Parts 160 and 164, and the Health Information Technology for Economic and Clinical Health Act ("HITECH"), collectively "HIPAA." "Covered Entity" means the organisation entering into this Agreement through its founding account owner. "Business Associate" means Nelson Holdings LLC, a limited liability company, doing business as TherapiSync. "Protected Health Information" or "PHI" means individually identifiable health information Business Associate creates, receives, maintains, or transmits on Covered Entity's behalf through the Service, as that term is defined at 45 CFR 160.103.

Business Associate will not use or disclose PHI other than as permitted or required by this Agreement or as required by law. Business Associate will use appropriate administrative, physical, and technical safeguards, consistent with the HIPAA Security Rule, to prevent use or disclosure of PHI other than as this Agreement provides.

Business Associate will report to Covered Entity any use or disclosure of PHI not permitted by this Agreement, and any Security Incident affecting PHI, of which it becomes aware, in accordance with Section 4 below.

Business Associate will ensure that any subcontractor that creates, receives, maintains, or transmits PHI on Business Associate's behalf agrees, in writing, to restrictions and conditions at least as stringent as those that apply to Business Associate under this Agreement — see Section 5.

Business Associate will make available the information required for Covered Entity to respond to an individual's request for access to, or accounting of disclosures of, their PHI, as described in Section 6.

Business Associate will make its internal practices, books, and records relating to its use and disclosure of PHI available to the Secretary of Health and Human Services, on request, for purposes of determining Covered Entity's compliance with HIPAA.

Business Associate may use or disclose PHI only as necessary to perform the Service described in TherapiSync's Terms of Service, as otherwise permitted or required by this Agreement, or as required by law. Business Associate may use PHI for its own proper management and administration, or to carry out its own legal responsibilities, provided any disclosure for such a purpose is either required by law or is made with reasonable assurances that the recipient will keep the information confidential and notify Business Associate of any breach.

Business Associate will not de-identify PHI, and will not use PHI to create a limited data set, except as this Agreement or Covered Entity separately authorizes in writing.

Business Associate will notify Covered Entity without unreasonable delay, and in no case later than the deadline HITECH imposes on Covered Entity for its own notification obligations, after discovering a Breach of unsecured PHI. The notification will include, to the extent then known, the identification of each individual whose PHI was involved and any other information Covered Entity needs to meet its own breach notification obligations under 45 CFR 164.404.

Business Associate will report to Covered Entity any Security Incident of which it becomes aware, understanding that this Section constitutes notice of the ongoing existence of routine, unsuccessful attempts of the kind described at 45 CFR 164.304's definition of Security Incident (e.g. pings, port scans, failed login attempts) without further reporting.

Business Associate will require any subcontractor it engages to create, receive, maintain, or transmit PHI on its behalf to agree, by written contract, to the same restrictions and conditions that apply to Business Associate under this Agreement with respect to that PHI.

Within a reasonable time of a request, Business Associate will provide Covered Entity with access to PHI it holds so Covered Entity can meet its obligations under 45 CFR 164.524, will make any amendment to PHI that Covered Entity directs or agrees to under 45 CFR 164.526, and will maintain and make available the information required for an accounting of disclosures under 45 CFR 164.528.

This Agreement takes effect when Covered Entity's founding account owner accepts it and continues for as long as Business Associate creates, receives, maintains, or transmits PHI on Covered Entity's behalf through the Service. Either party may terminate this Agreement for the other's material breach, if the breach is not cured within a reasonable time after written notice.

On termination, Business Associate will, at Covered Entity's election, return or destroy all PHI it still holds, or, if neither is feasible, extend the protections of this Agreement to that PHI for as long as it is retained.

This Agreement will be interpreted to permit Covered Entity to comply with HIPAA, and any ambiguity will be resolved in favor of that interpretation. Nothing in this Agreement is intended to, or should be construed to, confer any right or benefit on anyone other than the parties and their respective successors.

This Agreement, together with the Terms of Service, is the entire agreement between the parties regarding PHI and supersedes any prior discussion of a Business Associate Agreement between them.

This Agreement is governed by the laws of the State of Idaho, without regard to its conflict-of-laws rules — the same governing law as the Terms of Service.