Business Associate Agreement

Capitalized terms used but not otherwise defined in this BAA have the meanings assigned to them under HIPAA, HITECH, and their implementing regulations at 45 C.F.R. Parts 160 and 164, as amended from time to time (collectively, the “HIPAA Rules”).

“Breach” has the meaning assigned to that term in 45 C.F.R. § 164.402.

“Designated Record Set” has the meaning assigned to that term in 45 C.F.R. § 164.501.

“Electronic Protected Health Information” or “ePHI” means Protected Health Information that is transmitted by or maintained in electronic media.

“Protected Health Information” or “PHI” has the meaning assigned to that term in 45 C.F.R. § 160.103, limited to information that BeeThere creates, receives, maintains, or transmits on behalf of Customer in connection with the Services.

“De-Identify” or “De-Identified” means to remove identifiers from PHI in accordance with 45 C.F.R. § 164.514(a)–(b), so that the information no longer identifies an individual and there is no reasonable basis to believe the information can be used to identify an individual.

“Security Incident” has the meaning assigned to that term in 45 C.F.R. § 164.304.

“Unsecured PHI” has the meaning assigned to that term in 45 C.F.R. § 164.402.

2.1 Provision of Services

BeeThere may use or disclose PHI only:

1. as necessary to provide the Services described in the Services Agreement;
2. as expressly permitted or required by this BAA;
3. as authorized in writing by Customer; or
4. as Required by Law.

BeeThere will not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by a Covered Entity, except for uses and disclosures expressly permitted under this BAA and the HIPAA Rules.

2.2 Management and Administration

BeeThere may use PHI as necessary for its proper management and administration or to carry out its legal responsibilities.

BeeThere may disclose PHI for these purposes only if:

1. the disclosure is Required by Law; or
2. BeeThere obtains reasonable written assurances from the recipient that:

• the PHI will remain confidential;
• the PHI will be used or further disclosed only as Required by Law or for the purpose for which it was disclosed; and
• the recipient will notify BeeThere of any instance of which it becomes aware in which the confidentiality of the PHI has been breached.

2.3 De-Identification

BeeThere may De-Identify PHI in accordance with 45 C.F.R. § 164.514(a)–(b).

Once information has been properly De-Identified in accordance with the HIPAA Rules, it will no longer constitute PHI under this BAA. BeeThere may use properly De-Identified information for lawful analytics, security, research, service improvement, and product-development purposes, subject to the Services Agreement and applicable law.

BeeThere will not attempt to re-identify De-Identified information except as permitted by the HIPAA Rules and expressly authorized in writing by Customer.

2.4 Minimum Necessary

BeeThere will make reasonable efforts to limit its uses, disclosures, and requests for PHI to the minimum necessary to accomplish the intended purpose, to the extent required by the HIPAA Rules.

2.5 Prohibited Uses

Except as expressly permitted by the HIPAA Rules, BeeThere will not:

1. sell PHI;
2. receive remuneration in exchange for PHI;
3. use PHI for marketing purposes unrelated to the Services;
4. use PHI for any purpose unrelated to providing or supporting the Services; or
5. use PHI to train a general-purpose or shared artificial intelligence model.

BeeThere will comply with all applicable requirements of Subpart C of 45 C.F.R. Part 164 with respect to ePHI.

BeeThere will implement and maintain reasonable and appropriate administrative, physical, and technical safeguards designed to:

1. protect the confidentiality, integrity, and availability of PHI;
2. prevent the use or disclosure of PHI other than as permitted by this BAA;
3. protect against reasonably anticipated threats or hazards to the security or integrity of ePHI; and
4. protect against reasonably anticipated impermissible uses or disclosures of ePHI.

These safeguards will include, as applicable:

• encryption of ePHI in transit and at rest;
• unique user identification;
• access controls based on role and legitimate business need;
• authentication controls;
• audit controls;
• workforce security and training;
• security risk analysis and risk management;
• incident-response procedures;
• contingency, backup, and recovery procedures; and
• periodic review and updating of security practices.

4.1 Impermissible Uses and Disclosures

BeeThere will report to Customer any use or disclosure of PHI not permitted by this BAA of which BeeThere becomes aware, without unreasonable delay and no later than five (5) business days after discovery.

4.2 Successful Security Incidents

BeeThere will report to Customer any successful Security Incident involving Customer’s PHI of which BeeThere becomes aware, without unreasonable delay and no later than five (5) business days after discovery.

The initial report may contain preliminary information and may be supplemented as additional information becomes available.

4.3 Unsuccessful Security Incidents

Customer acknowledges that unsuccessful Security Incidents routinely occur and do not necessarily result in unauthorized access to PHI.

Unsuccessful Security Incidents may include, without limitation:

• network pings;
• port scans;
• unsuccessful login attempts;
• unsuccessful denial-of-service attacks;
• attempted malware or firewall attacks that are blocked;
• unsuccessful attempts to access files, applications, accounts, or systems; and
• other similar unsuccessful events.

This Section constitutes BeeThere’s notice to Customer of such unsuccessful Security Incidents. BeeThere will not be required to provide separate notice of individual unsuccessful Security Incidents unless they materially affect the confidentiality, integrity, or availability of Customer’s PHI.

4.4 Breach Notification

Following discovery of a Breach of Unsecured PHI, BeeThere will notify Customer without unreasonable delay and in no event later than thirty (30) calendar days after discovery.

A Breach will be treated as discovered on the first day it is known to BeeThere or, by exercising reasonable diligence, would have been known to BeeThere.

To the extent known at the time of notification, BeeThere’s notification will include:

1. the identification of each individual whose Unsecured PHI was involved or is reasonably believed to have been involved;
2. a brief description of what occurred, including the date of the Breach and the date of its discovery, if known;
3. a description of the types of PHI involved;
4. any steps individuals should take to protect themselves from potential harm resulting from the Breach;
5. a description of the steps BeeThere has taken or intends to take to investigate the Breach, mitigate potential harm, and protect against further Breaches; and
6. any other information available to BeeThere that Customer or an applicable Covered Entity is required to include in an individual notification under 45 C.F.R. § 164.404(c).

If any required information is not available at the time of the initial notification, BeeThere will provide that information promptly as it becomes available.

Unless Required by Law or expressly authorized by Customer in writing, BeeThere will not notify affected individuals, the Secretary of the U.S. Department of Health and Human Services, the media, or other third parties of a Breach on Customer’s behalf.

BeeThere will reasonably cooperate with Customer in Customer’s investigation, risk assessment, mitigation, and legally required notifications relating to the Breach.

BeeThere will take reasonable steps to mitigate, to the extent practicable, any harmful effect known to BeeThere resulting from a use or disclosure of PHI in violation of this BAA or the HIPAA Rules.

BeeThere will ensure that each subcontractor that creates, receives, maintains, or transmits PHI on behalf of BeeThere enters into a written agreement requiring the subcontractor to:

1. comply with the same restrictions, conditions, and requirements concerning PHI that apply to BeeThere under this BAA;
2. implement reasonable and appropriate safeguards to protect PHI;
3. comply with all applicable requirements of Subpart C of 45 C.F.R. Part 164 with respect to ePHI;
4. report impermissible uses or disclosures, Security Incidents, and Breaches to BeeThere as required by the HIPAA Rules and the applicable subcontractor agreement; and
5. return, destroy, or continue to protect PHI upon termination of the subcontractor relationship, as required by the HIPAA Rules.

7.1 Access

To the extent BeeThere maintains PHI in a Designated Record Set, BeeThere will make such PHI available to Customer within fifteen (15) business days after receiving Customer’s written request, so that Customer or its applicable Covered Entity can meet its obligations under 45 C.F.R. § 164.524.

The PHI will be provided in the form and format maintained by BeeThere or in another mutually agreed form and format.

7.2 Amendment

To the extent BeeThere maintains PHI in a Designated Record Set, BeeThere will make such PHI available to Customer for amendment within fifteen (15) business days after receiving Customer’s written request.

BeeThere will incorporate amendments to PHI when directed by Customer, as necessary for Customer or its applicable Covered Entity to meet its obligations under 45 C.F.R. § 164.526.

7.3 Accounting of Disclosures

BeeThere will document disclosures of PHI and maintain information concerning such disclosures to the extent required for Customer or its applicable Covered Entity to respond to a request for an accounting of disclosures under 45 C.F.R. § 164.528.

BeeThere will make the required information available to Customer within fifteen (15) business days after receiving Customer’s written request.

7.4 Requests Received Directly from Individuals

If BeeThere receives a request directly from an individual for access to PHI, amendment of PHI, an accounting of disclosures, or another right under the HIPAA Rules, BeeThere will forward the request to Customer within five (5) business days unless BeeThere is expressly authorized or legally required to respond directly.

BeeThere will not independently deny an individual’s request unless expressly authorized by Customer or Required by Law.

BeeThere will make its internal practices, books, and records relating to the use and disclosure of PHI received from, created for, or received on behalf of Customer available to the Secretary of the U.S. Department of Health and Human Services in the time and manner designated by the Secretary for purposes of determining compliance with the HIPAA Rules.

To the extent BeeThere is required under the Services Agreement to perform one or more of Customer’s or an applicable Covered Entity’s obligations under Subpart E of 45 C.F.R. Part 164, BeeThere will comply with the requirements of Subpart E that apply to Customer or the applicable Covered Entity in the performance of those obligations.

Customer will notify BeeThere of:

1. any limitation in Customer’s or an applicable Covered Entity’s notice of privacy practices, to the extent the limitation may affect BeeThere’s use or disclosure of PHI;
2. any change in or revocation of an individual’s permission to use or disclose PHI, to the extent the change or revocation may affect BeeThere’s use or disclosure of PHI; and
3. any restriction on the use or disclosure of PHI that Customer or an applicable Covered Entity has agreed to or is required to follow, to the extent the restriction may affect BeeThere’s use or disclosure of PHI.

Customer will not request or direct BeeThere to use or disclose PHI in a manner that would violate the HIPAA Rules if done by Customer or an applicable Covered Entity, except to the extent such use or disclosure is expressly permitted for a Business Associate under the HIPAA Rules.

Customer is responsible for determining whether it is legally authorized to collect and submit PHI to the Services and for obtaining any consents, authorizations, or permissions required for Customer’s collection and submission of PHI.

As between the parties, Customer retains all right, title, and interest in and to Customer’s PHI.

BeeThere acquires no ownership interest in PHI by receiving, creating, maintaining, or transmitting PHI in connection with the Services.

Nothing in this Section limits BeeThere’s permitted use of properly De-Identified information in accordance with Section 2.3.

12.1 Term

This BAA begins on the Effective Date and remains in effect until the later of:

1. termination or expiration of the Services Agreement; or
2. the date on which all PHI provided by Customer to BeeThere, or created or received by BeeThere on behalf of Customer, has been returned, destroyed, or otherwise handled in accordance with Section 12.4.

12.2 Termination for Material Breach

Customer may terminate this BAA and the applicable Services Agreement if Customer determines that BeeThere has materially breached this BAA and BeeThere fails to cure the breach within thirty (30) days after receiving written notice.

If BeeThere determines that Customer has materially breached this BAA and Customer fails to cure the breach within thirty (30) days after receiving written notice, BeeThere may terminate this BAA and the applicable Services Agreement.

If a material breach cannot reasonably be cured, the non-breaching party may terminate this BAA and the applicable Services Agreement immediately upon written notice.

12.3 Action Following Known Violation

If Customer becomes aware of a pattern of activity or practice by BeeThere that constitutes a material breach of this BAA, Customer will take reasonable steps to cure the breach or end the violation.

If such steps are unsuccessful, Customer may terminate this BAA and the applicable Services Agreement. If termination is not feasible, Customer may report the violation to the Secretary of the U.S. Department of Health and Human Services as required by the HIPAA Rules.

12.4 Return or Destruction of PHI

Upon termination or expiration of this BAA, BeeThere will, if feasible:

1. return or destroy all PHI received from Customer or created, maintained, or received by BeeThere on Customer’s behalf; and
2. retain no copies of such PHI.

If BeeThere determines that return or destruction of some or all PHI is not feasible, BeeThere will:

1. notify Customer of the conditions that make return or destruction infeasible;
2. continue to extend the protections of this BAA to the retained PHI;
3. limit further uses and disclosures of retained PHI to the purposes that make return or destruction infeasible; and
4. securely destroy the retained PHI when destruction becomes feasible.

PHI maintained in encrypted backups may be retained until deleted through BeeThere’s ordinary backup-retention cycle, provided that the PHI remains protected under this BAA and is not restored or otherwise used except for disaster recovery, security, or legal-compliance purposes.

12.5 Survival

BeeThere’s obligations under Sections 4, 5, 7, 8, 11, 12.4, and any other provision that by its nature should survive will survive termination or expiration of this BAA for as long as BeeThere retains PHI.

13.1 Regulatory References

A reference in this BAA to a provision of the HIPAA Rules means the provision as currently in effect or as subsequently amended.

13.2 Amendment

The parties will take such action as is reasonably necessary to amend this BAA from time to time to comply with changes to the HIPAA Rules or other applicable law.

BeeThere may amend this BAA upon notice to Customer when reasonably necessary to comply with applicable law. Any material amendment unrelated to legal compliance will be made in accordance with the amendment provisions of the Services Agreement.

13.3 Order of Precedence

If there is a conflict between this BAA and the Services Agreement concerning the use, disclosure, safeguarding, return, or destruction of PHI, this BAA will control.

For matters not specifically governed by this BAA, the Services Agreement will control.

13.4 Liability

The allocation and limitation of liability between the parties will be governed by the Services Agreement, except to the extent that applying such provisions would be prohibited by applicable law.

13.5 Interpretation

Any ambiguity in this BAA will be interpreted in a manner that permits the parties to comply with the HIPAA Rules.

13.6 No Third-Party Beneficiaries

Nothing in this BAA is intended to confer any right, remedy, or obligation upon any person or entity other than the parties and their respective permitted successors and assigns.

13.7 Governing Law

This BAA will be governed by the laws specified in the Services Agreement. If the Services Agreement does not specify governing law, this BAA will be governed by the laws of the State of Delaware, without regard to its conflict-of-law principles, except to the extent preempted by federal law.

13.8 Electronic Acceptance

The parties agree that electronic acceptance of this BAA has the same legal effect as a handwritten signature.

BeeThere may maintain records of Customer’s acceptance, including the accepting user’s name, account, organization, date and time of acceptance, Internet Protocol address, and the version of this BAA accepted.

13.9 Authority

Each individual accepting or executing this BAA represents that they have the authority to bind the party on whose behalf they accept or execute it.