Business Associate Agreement
Effective
This Business Associate Agreement (“Agreement”) is entered into by and between the healthcare provider or practice that creates a Provider account on the SoloistHealth platform and accepts the SoloistHealth Terms of Service (“Covered Entity”) and Soloist Health LLC d/b/a SoloistHealth, a New York limited liability company (“Business Associate”), effective as of the date Covered Entity first accepts the Terms of Service (the “Effective Date”). Covered Entity and Business Associate may be referred to individually as a “Party” and collectively as the “Parties.”
Recitals. Business Associate provides software and related services to Covered Entity under the SoloistHealth Terms of Service (the “Underlying Agreement”). In providing those services, Business Associate may create, receive, maintain, or transmit Protected Health Information on behalf of Covered Entity. The Parties enter into this Agreement to comply with the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health (HITECH) Act, and their implementing regulations at 45 C.F.R. Parts 160 and 164 (collectively, “HIPAA”).
1. Definitions
Capitalized terms used but not defined here have the meanings given in HIPAA. As used in this Agreement: “Breach,” “Covered Entity,” “Business Associate,” “Designated Record Set,” “Disclosure,” “Electronic Protected Health Information (ePHI),” “Health Care Operations,” “Individual,” “Minimum Necessary,” “Protected Health Information (PHI),” “Required By Law,” “Secretary” (of HHS), “Security Incident,” “Subcontractor,” “Unsecured PHI,” and “Use” have the meanings set out in 45 C.F.R. §§ 160.103 and 164.402. “PHI” is limited to PHI that Business Associate creates, receives, maintains, or transmits for or on behalf of Covered Entity.
2. Permitted Uses and Disclosures by Business Associate
2.1 Business Associate may use or disclose PHI only as necessary to perform the services described in the Underlying Agreement, as Required By Law, or as otherwise permitted by this Agreement, and only in a manner that would not violate HIPAA if done by Covered Entity.
2.2 Business Associate may use PHI for its own proper management and administration and to carry out its legal responsibilities. Business Associate may disclose PHI for such purposes only if the disclosure is Required By Law, or Business Associate obtains reasonable assurances from the recipient that the PHI will remain confidential and used only as required by law or for the purpose disclosed, and that the recipient will notify Business Associate of any breach of confidentiality.
2.3 Business Associate will make uses, disclosures, and requests for PHI consistent with the Minimum Necessary standard.
2.4 Business Associate may provide Data Aggregation services relating to the Covered Entity’s Health Care Operations and may de-identify PHI in accordance with 45 C.F.R. § 164.514(a)–(c).
3. Obligations of Business Associate
Business Associate agrees to:
3.1 Not use or disclose PHI other than as permitted by this Agreement or as Required By Law.
3.2 Use appropriate safeguards, and comply with the HIPAA Security Rule (Subpart C of 45 C.F.R. Part 164) with respect to ePHI, to prevent use or disclosure of PHI other than as provided for by this Agreement. Without limiting the foregoing, Business Associate will encrypt ePHI at rest and in transit using industry standard encryption consistent with the guidance referenced in 45 C.F.R. §164.402, such that PHI involved in a security event is rendered Unsecured PHI only if the applicable encryption safeguards fail.
3.3 Report to Covered Entity any use or disclosure of PHI not permitted by this Agreement of which it becomes aware, any Security Incident, and any Breach of Unsecured PHI, without unreasonable delay and in no case later than ten (10) business days after discovery. The initial notification shall be provided within this window, and include the information reasonably available to Business Associate that Covered Entity needs to meet its breach-notification obligations under 45 C.F.R. § 164.404. The more detailed notification will follow as information becomes known. The Parties acknowledge that this Section does not require Business Associate to report, and the term “Security Incident” as used in this Section does not include, trivial and routine unsuccessful attempts to access, use, disclose, modify, or destroy PHI, including pings, port scans, denial-of-service attacks, and other unsuccessful attempts to penetrate Business Associate’s systems, provided such attempts do not result in unauthorized access, use, or disclosure of PHI.
3.4 Ensure that any Subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree in writing to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such PHI (i.e., flow-down business associate agreements).
3.5 Make PHI in a Designated Record Set available to Covered Entity (or, as directed, to the Individual) as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. § 164.524 (access).
3.6 Make PHI in a Designated Record Set available for amendment and incorporate any amendments as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. § 164.526.
3.7 Maintain and make available the information required to provide an accounting of disclosures as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. § 164.528.
3.8 To the extent Business Associate is to carry out one or more of Covered Entity’s obligations under Subpart E of 45 C.F.R. Part 164, comply with the requirements of Subpart E that apply to Covered Entity in the performance of those obligations.
3.9 Make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining compliance with HIPAA.
3.10 Insurance. During the Term, Business Associate will maintain cyber liability errors & omissions Insurance, including coverage for privacy and network security liability, with limits of not less than $1,000,000 per claim and in the aggregate, and will provide Covered Entity with a certificate of insurance upon request.
3.11 Audit Rights. No more than once per calendar year, and on at least 30 days’ prior written notice, Covered Entity may request that Business Associate provide a summary of its then-current security certifications, audit reports (e.g. SOC 2), or a completed security questionnaire sufficient to demonstrate compliance with this Agreement, in lieu of an on-site audit unless required by the Secretary or applicable law.
4. Obligations of Covered Entity
4.1 Covered Entity will notify Business Associate of any limitation(s) in its Notice of Privacy Practices, of any changes in or revocation of an Individual’s permission to use or disclose PHI, and of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by, to the extent any of these may affect Business Associate’s use or disclosure of PHI.
4.2 Covered Entity will not request Business Associate to use or disclose PHI in any manner that would not be permissible under HIPAA if done by Covered Entity, except as permitted under Section 2.2 (management and administration) or for Data Aggregation/de-identification if elected in Section 2.4.
4.3 Covered Entity is responsible for obtaining any consents or authorizations from Individuals required for Business Associate to provide the services, and for maintaining its own HIPAA compliance program.
4.4 Covered Entity acknowledges that any video sessions with Individuals are conducted on a video platform that Covered Entity selects, supplies, and controls (the “Provider Video Platform,” as defined in Section 5.7 of the Underlying Agreement). The Provider Video Platform is a vendor of Covered Entity, not a Subcontractor of Business Associate. Business Associate does not create, receive, maintain, or transmit the audio, video, chat, recordings, or other content of a video session and has no responsibility for the privacy or security of PHI on the Provider Video Platform. Business Associate’s obligations under this Agreement with respect to video appointments are limited to the meeting link and appointment information that Business Associate stores and transmits on Covered Entity’s behalf. Covered Entity is solely responsible for determining whether its Provider Video Platform is suitable for its practice under HIPAA and for obtaining any business associate agreement with that vendor that HIPAA requires.
5. Term and Termination
5.1 Term. This Agreement is effective as of the Effective Date and remains in effect until the Underlying Agreement terminates and all PHI is returned or destroyed as provided below, or until terminated as provided here.
5.2 Termination for Cause. If Covered Entity determines that Business Associate has materially breached this Agreement, Covered Entity may provide an opportunity to cure within 30 days and, if not cured, terminate the Underlying Agreement and this Agreement, or report the breach to the Secretary if termination is not feasible.
5.3 Effect of Termination. Upon termination, Business Associate will, if feasible, return or destroy all PHI it maintains in any form and retain no copies. If return or destruction is not feasible, Business Associate will extend the protections of this Agreement to the PHI, limit further uses and disclosures to those purposes that make return or destruction infeasible, and continue to comply with this Agreement for as long as it retains the PHI.
6. Miscellaneous
6.1 Regulatory References. A reference to a section of HIPAA means the section as in effect or amended.
6.2 Interpretation. Any ambiguity in this Agreement will be resolved to permit the Parties to comply with HIPAA. This Agreement controls over any conflicting term of the Underlying Agreement with respect to PHI.
6.3 No Third-Party Beneficiaries. Nothing in this Agreement confers any rights on any person other than the Parties.
6.4 Survival. Section 5.3 and any other provisions that by their nature should survive will survive termination.
6.5 Governing Law. This Agreement is governed by the laws of the State of New York and applicable federal law, to the extent not preempted by HIPAA.
6.6 Indemnification. Each Party will indemnify, defend, and hold harmless the other Party from and against any third-party claims, losses, fines, penalties, or reasonable expenses (including attorneys’ fees) arising from the indemnifying Party’s breach of this Agreement or violation of HIPAA, except to the extent caused by the indemnified Party’s own acts or omissions. This Section 6.6 shall be subject to the cap in Section 6.7.
6.7 Limitation of Liability. Except for liability arising from a Party’s willful misconduct: (a) neither Party’s aggregate liability arising out of or relating to this Agreement will exceed the greater of the fees paid by Covered Entity under the Underlying Agreement in the twelve (12) months preceding the event giving rise to the claim or one thousand U.S. dollars ($1,000); and (b) notwithstanding clause (a), each Party’s aggregate liability arising from its breach of its obligations under this Agreement with respect to PHI or confidentiality, including amounts payable under Section 6.6, will not exceed one million U.S. dollars ($1,000,000), and clause (a) does not apply to such liability. Neither Party will be liable for indirect, incidental, consequential, or punitive damages.
6.8 Notices. All notices under this Agreement must be in writing and delivered by email (with confirmation of receipt) or nationally recognized courier to the addresses and contact information as the Parties designate in writing from time to time, including for purposes of Section 3.3 breach reports.
6.9 Entire Agreement; Amendment; Severability; No Waiver. This Agreement, together with the Underlying Agreement, is the entire agreement of the Parties with respect to its subject matter and supersedes all prior agreements on that subject. This Agreement may be amended by Business Associate posting a revised version and giving Covered Entity at least thirty (30) days’ notice, in which case Covered Entity’s continued use of the Service after the effective date of the revised version constitutes acceptance, or by either Party by written notice to the extent necessary to comply with changes to HIPAA. If any provision of this Agreement is held unenforceable, the remaining provisions will remain in full force and effect. No failure or delay by either Party in exercising any right under this Agreement will operate as a waiver of that right.
6.10 Assignment; Counterparts; Electronic Signatures. Neither Party may assign this Agreement without the other Party’s prior written consent, except that Business Associate may assign this Agreement in connection with a merger, acquisition, or sale of substantially all of its assets. This Agreement may be executed in counterparts, including by electronic or digital signature, each of which is deemed an original.
7. Effective Date
This Business Associate Agreement is effective as of the Effective Date. Covered Entity’s acceptance of the Terms of Service constitutes its execution of this Agreement, and no separate signature is required. The person who creates the Provider account or accepts the Terms of Service on Covered Entity’s behalf represents that they are authorized to bind Covered Entity to this Agreement.