An all-in-one advanced EHR that keeps visits moving. Book a demo.
Download PDF
This Edvak Business Associate Agreement ("BAA") is entered into between Edvak Technologies Inc. ("Business Associate" or "Edvak") and the customer identified on an Order Form that incorporates this BAA ("Customer"). This BAA applies where Customer is a Covered Entity or a Business Associate under HIPAA, becomes effective on the BAA Effective Date, is incorporated into the Agreement formed by that Order Form (the "Main Agreement"), and governs Edvak's creation, receipt, maintenance, and transmission of Protected Health Information on Customer's behalf.
1.1 HIPAA Terms. "Breach", "Covered Entity", "Designated Record Set", "Disclosure", "Individual", "Required by Law", "Secretary", "Security Incident", "Unsecured PHI", "Use", and other terms defined in the HIPAA Rules have the meanings given in the HIPAA Rules, whether or not capitalized, unless otherwise specified.
1.2 Other Terms. "BAA Effective Date" means the date the Order Form incorporating this BAA is executed, unless the Order Form states otherwise. "Data Disposition Period" is defined in Section 5.3. "HIPAA" means the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations. "HIPAA Rules" means the Privacy, Security, and Breach Notification Rules at 45 C.F.R. Parts 160 and 164. "HITECH Act" means the Health Information Technology for Economic and Clinical Health Act, codified at 42 U.S.C. §§ 17921–17954, and its implementing regulations. "HHS" means the U.S. Department of Health and Human Services. "Protected Health Information" or "PHI" means protected health information or electronic protected health information (as defined in the HIPAA Rules) that Edvak creates, receives, maintains, or transmits on Customer's behalf in connection with the Main Agreement. "Response Period" means ten days. "Subcontractor" is defined in Section 3.9. "Unsuccessful Security Incident" means an attempted but failed Security Incident, such as pings or broadcast attacks on a firewall, port scans, denial of service attacks, unsuccessful login attempts, or interception of encrypted information where the key is not compromised.
Edvak provides Customer with cloud-based electronic health record, practice management, and related services under the Main Agreement — including, where selected on an Order Form, revenue cycle management services — which involve creating, receiving, maintaining, and transmitting PHI on Customer's behalf.
3.1 Permitted Uses and Disclosures. Edvak: (a) may Use and Disclose PHI to perform functions, activities, and services for or on behalf of Customer as specified in the Main Agreement; (b) will not Use or Disclose PHI other than as permitted or required by the Main Agreement, this BAA, or as Required by Law; (c) may Use PHI for Edvak's proper management and administration and to carry out its legal responsibilities; (d) may Disclose PHI for Edvak's proper management and administration and to carry out its legal responsibilities, provided the disclosure is Required by Law or Edvak obtains reasonable assurances that the information will be held confidentially, Used or further Disclosed only as Required by Law or for the purpose of the disclosure, and that Edvak will be notified of any breaches of confidentiality; and (e) may provide data aggregation services relating to Customer's health care operations as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B).
3.2 De-Identification. Edvak may de-identify PHI in accordance with 45 C.F.R. § 164.514(a)–(c). Information de-identified in accordance with that standard is no longer PHI, and Edvak may use it as permitted by the Main Agreement, including the Edvak AI Terms. Edvak will not attempt, or permit any third party to attempt, to re-identify de-identified information.
3.3 Safeguards. Edvak will implement and maintain appropriate administrative, physical, and technical safeguards designed to prevent Use or Disclosure of PHI other than as permitted by this BAA, that reasonably and appropriately protect the confidentiality, integrity, and availability of PHI that Edvak creates, receives, maintains, or transmits on Customer's behalf, and Edvak will comply with the Security Rule as applicable to business associates.
3.4 Data Location. Edvak will store PHI only on systems located in the United States. Any access to PHI by Edvak personnel located outside the United States is subject to the safeguards described in this BAA and the Main Agreement, including the access controls stated in the RCM Services Attachment where it applies.
3.5 Event Reporting. Edvak will report to Customer:
(a) any Use or Disclosure of PHI by Edvak (including its employees or Subcontractors) not permitted under this BAA of which it becomes aware, without unreasonable delay and no later than the Response Period after becoming aware;
(b) any Security Incident affecting PHI of which it becomes aware, without unreasonable delay and no later than the Response Period after becoming aware, except that for Unsuccessful Security Incidents this Section serves as notice and no further notice is required; and
(c) any Breach of Unsecured PHI of which it becomes aware, without unreasonable delay and no later than the Response Period after becoming aware. Each Breach report will, to the extent possible, identify each Individual whose Unsecured PHI has been or is reasonably believed to have been Breached and include other information reasonably requested by Customer; Edvak will supplement its report as information becomes available and will cooperate with Customer's reasonable requests for information needed to evaluate the Breach and meet Customer's own notification obligations.
3.6 Records for the Secretary. Edvak will make its internal practices, books, and records relating to the Use and Disclosure of PHI available to the Secretary for purposes of determining Customer's compliance with the HIPAA Rules and, if permitted by law, will promptly notify Customer of requests by the Secretary relating to Customer and provide Customer copies of documents produced in response.
3.7 Access and Amendment. The Service is designed to give Customer direct access to PHI in Designated Record Sets so that Customer can fulfill its obligations under 45 C.F.R. §§ 164.524 and 164.526. To the extent Customer cannot do so through the Service, within the Response Period following Customer's request Edvak will make the requested PHI in a Designated Record Set available to Customer, and will make amendments to PHI as directed by Customer, to enable Customer to meet those obligations.
3.8 Accounting of Disclosures. Edvak will document Disclosures of PHI and provide such information to Customer as necessary to permit Customer to respond to an Individual's request for an accounting of Disclosures in accordance with 45 C.F.R. § 164.528 and Section 13405(c) of the HITECH Act.
3.9 Subcontractors. Edvak may Disclose PHI to one or more subcontractors (each, a "Subcontractor"), and may allow a Subcontractor to create, receive, maintain, or transmit PHI on its behalf, provided Edvak first enters into a written agreement obligating the Subcontractor to comply with restrictions and conditions at least as protective as those that apply to Edvak under this BAA.
3.10 Mitigation. Edvak will mitigate, to the extent practicable, any harmful effect known to Edvak of a Use or Disclosure of PHI by Edvak in violation of this BAA.
3.11 Customer Obligations. To the extent Edvak carries out an obligation of Customer under the Privacy Rule, Edvak will comply with the requirements of the Privacy Rule that apply to Customer in the performance of that obligation.
3.12 Minimum Necessary. Edvak will Use, Disclose, and request the minimum necessary amount of PHI to accomplish the purpose of the Use, Disclosure, or request, in accordance with the HIPAA Rules.
3.13 HITECH Compliance. Edvak will comply with the requirements of the HITECH Act that are applicable to business associates.
Customer: (a) is responsible for implementing appropriate privacy and security safeguards to protect its PHI in accordance with the HIPAA Rules, including safeguards required of Customer under the Main Agreement; (b) will inform Edvak of any limitation in Customer's notice of privacy practices to the extent the limitation may affect Edvak's Use or Disclosure of PHI; (c) will inform Edvak of any changes in, or revocation of, an Individual's permission to use or disclose PHI, and of any restriction agreed to under 45 C.F.R. § 164.522, in each case to the extent it affects Edvak's Use or Disclosure of PHI; and (d) will not request or cause Edvak to Use or Disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Customer.
5.1 Duration. This BAA commences on the BAA Effective Date and terminates upon expiration or termination of the Main Agreement.
5.2 Termination for Breach. If either party determines that the other has materially breached this BAA, the non-breaching party will provide written notice, and if the breaching party does not cure the breach within 30 days, the non-breaching party may terminate the Main Agreement to the extent it involves PHI. If cure is not possible, the non-breaching party may terminate immediately upon notice.
5.3 Disposition of PHI. Within 60 days after expiration or earlier termination of this BAA (the "Data Disposition Period"), Edvak will, if feasible, return PHI to Customer (including through the export process described in the Main Agreement) or destroy all PHI it still maintains in any form and retain no copies. If return or destruction is not feasible (including for PHI retained in routine backups or as retention is required by law), Edvak will extend the protections of this BAA to that PHI and limit further Uses and Disclosures to the purposes that make return or destruction infeasible, for as long as the PHI is retained.
6.1 Relationship to Main Agreement. This BAA is incorporated into the Main Agreement. In the event of a conflict between this BAA and any other part of the Main Agreement with respect to PHI, this BAA controls. Otherwise, this BAA is construed under and in accordance with the Main Agreement, and the parties acknowledge that the limitation of liability provisions of the Main Agreement (including the Increased Cap applicable to breaches of this BAA) apply to this BAA.
6.2 Regulatory Changes; Interpretation. The parties will negotiate in good faith to amend this BAA as necessary for compliance with changes to the HIPAA Rules or other Applicable Laws. Any ambiguity in this BAA will be interpreted to permit compliance with the HIPAA Rules. Nothing in this BAA is intended to make either party the agent of the other for purposes of the federal common law of agency, except as expressly stated in the Main Agreement.
6.3 No Third-Party Beneficiaries. Nothing in this BAA confers any rights on any Individual or other third party.
6.4 Independent Contractors. The parties are independent contractors. Neither party will represent itself as the agent or legal representative of the other except as expressly stated in the Main Agreement.
