Business Associate Agreement

Covered Entity and Business Associate have entered or will enter into an arrangement under which Business Associate provides the Services and, in doing so, may create, receive, maintain, or transmit Protected Health Information on behalf of Covered Entity.

The parties enter into this Agreement to comply with the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (the Privacy, Security, and Breach Notification Rules at 45 CFR Parts 160 and 164), as amended by the HITECH Act (together, "HIPAA").

The Verq Check service is designed to de-identify clinical documentation within the end user's browser before transmission to Business Associate, so that Business Associate does not, in the ordinary course, create, receive, maintain, or transmit Protected Health Information. This Agreement nonetheless governs any Protected Health Information that Business Associate may create, receive, maintain, or transmit on behalf of Covered Entity in connection with the Services.

1. Definitions

Capitalized terms used but not otherwise defined in this Agreement have the meanings given to them in HIPAA. As used here: "Protected Health Information" or "PHI" and "Electronic PHI" or "ePHI" have the meanings in 45 CFR 160.103, limited to information Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity; and "Breach," "Covered Entity," "Business Associate," "Designated Record Set," "Individual," "Required By Law," "Secretary," "Security Incident," "Subcontractor," and "Unsecured PHI" have the meanings in 45 CFR Parts 160 and 164.

2. Permitted Uses and Disclosures

Business Associate may use or disclose PHI only as necessary to perform the Services, as permitted or required by this Agreement, or as Required By Law, and will not use or disclose PHI in a manner that would violate HIPAA if done by Covered Entity.

Business Associate may use PHI for its proper management and administration and to carry out its legal responsibilities. Business Associate may disclose PHI for those purposes only if the disclosure is Required By Law, or if Business Associate obtains reasonable written assurances from the recipient that the PHI will remain confidential and be used or further disclosed only as Required By Law or for the purpose for which it was disclosed, and that the recipient will notify Business Associate of any breach of confidentiality.

Business Associate may de-identify PHI in accordance with 45 CFR 164.514(a)-(c); de-identified information is not PHI and is not subject to this Agreement. Business Associate may provide data aggregation services relating to the health care operations of Covered Entity as permitted by 45 CFR 164.504(e)(2)(i)(B). Business Associate will limit its uses, disclosures, and requests of PHI to the minimum necessary to accomplish the intended purpose.

3. Obligations of Business Associate

Business Associate will: (a) not use or disclose PHI other than as permitted by this Agreement or as Required By Law; (b) use appropriate administrative, physical, and technical safeguards, and comply with the Security Rule with respect to ePHI, to prevent use or disclosure of PHI other than as provided by this Agreement, including encryption in transit (TLS 1.2 or higher) and at rest and least-privilege access controls; (c) report to Covered Entity any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, any Security Incident, and any Breach of Unsecured PHI, without unreasonable delay and in no event later than 72 hours after discovery; (d) in any such report, include to the extent known the nature of the event, the PHI involved, and the Individuals affected, and cooperate with Covered Entity's breach-response obligations; (e) ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to restrictions and conditions at least as protective as those that apply to Business Associate under this Agreement; (f) make PHI in a Designated Record Set available to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 CFR 164.524; (g) make amendments to PHI in a Designated Record Set as directed by Covered Entity pursuant to 45 CFR 164.526; (h) maintain and make available the information required to provide an accounting of disclosures under 45 CFR 164.528; (i) to the extent Business Associate carries out an obligation of Covered Entity under the Privacy Rule, comply with the requirements of the Privacy Rule that apply to that obligation; (j) make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining Covered Entity's compliance with HIPAA; and (k) mitigate, to the extent practicable, any harmful effect known to Business Associate of a use or disclosure of PHI in violation of this Agreement.

The parties acknowledge that routine, unsuccessful attempts to penetrate systems (such as pings, port scans, and failed log-in attempts) constitute Security Incidents only in the aggregate, and no additional report of them is required beyond this sentence unless one results in unauthorized access to, or use or disclosure of, PHI. Business Associate's current Subcontractors with potential access to data processed through the Services are listed on its Sub-Processors page, each engaged under a business associate agreement.

4. Obligations of Covered Entity

Covered Entity will: (a) notify Business Associate of any limitation in its notice of privacy practices, any change in or revocation of an Individual's permission to use or disclose PHI, and any restriction to the use or disclosure of PHI agreed to under 45 CFR 164.522, to the extent any of these affects Business Associate's use or disclosure of PHI; (b) not request Business Associate to use or disclose PHI in any manner that would not be permitted under HIPAA if done by Covered Entity, except as permitted under Section 2; and (c) ensure it has obtained any consents, authorizations, or permissions necessary for Business Associate to perform the Services, and submit through the Services only the documentation the Services require.

5. Term and Termination

This Agreement is effective upon Covered Entity's acceptance and remains in effect until terminated or until the underlying agreement for the Services ends, whichever is later.

If Covered Entity determines that Business Associate has breached a material term of this Agreement, Covered Entity may provide written notice and an opportunity to cure within 30 days; if Business Associate does not cure, Covered Entity may terminate this Agreement and the Services. Either party may terminate as otherwise provided in the underlying agreement.

Upon termination, Business Associate will return or destroy all PHI it maintains on behalf of Covered Entity and retain no copies, where feasible. Where return or destruction is not feasible, Business Associate will extend the protections of this Agreement to such PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for so long as it maintains the PHI. Given the service architecture described in the recitals, Business Associate ordinarily maintains no PHI to return or destroy.

6. Miscellaneous

References to sections of HIPAA mean the sections as in effect or as amended. The parties agree to take such action as is necessary to amend this Agreement from time to time as needed for compliance with HIPAA and other applicable law. Any ambiguity in this Agreement will be resolved to permit the parties to comply with HIPAA. There are no third-party beneficiaries to this Agreement. The obligations of Business Associate under Sections 3, 5, and 6 survive termination. This Agreement is governed by the laws of the State of Florida, without regard to its conflict-of-laws rules and without limiting the application of HIPAA. In the event of any conflict between this Agreement and any other agreement between the parties with respect to PHI, this Agreement controls.

7. Acceptance

By clicking to accept this Agreement at signup, the individual accepting represents that they are authorized to bind the Covered Entity, and this Agreement becomes effective for that Covered Entity as of the date of acceptance. Questions may be directed to privacy@verqhealth.com or security@verq.ai.

VerQ, Inc.
12620 Beach Blvd, Ste. #3-279
Jacksonville, FL 32246