Last Modified: November 1st, 2020
THERAPY LAYER DOES NOT PROVIDE MEDICAL SERVICES OR ADVICE, INCLUDING VIA THE PLATFORM. IF YOU ARE (OR SOMEONE ELSE IS) EXPERIENCING A MEDICAL EMERGENCY, CALL 911 IMMEDIATELY.
YOU ACKNOWLEDGE AND AGREE THAT:
PLEASE READ THESE TERMS OF SERVICE CAREFULLY BEFORE USING OUR SERVICES OR OUR PLATFORM.
These terms of service (the "Terms of Service for Organizations") describe your rights and responsibilities when using the Therapy Layer Relay application (the "App" when accessed via mobile application, the "Website" when accessed via web browser, or the "Platform" when considered as a whole or accessed via SMS or any other means) as part of a coordinated service to connect and communicate with your Clients. These Terms of Service for Organizations, our Privacy Policy, our Business Associate Agreement (if applicable) (attached hereto as Attachment A), and any other terms agreed to in writing by you and us (referred to collectively as the "Terms") govern your use of the Platform. Your Clients' use of the Platform, or use of the Platform by any entity in the role of a Client on the Platform with respect to your organization, will be governed by a different set of terms. By accessing or using the Platform, you acknowledge that you have read, understood, and agreed to be legally bound by and comply with these Terms. If you do not agree with any of these Terms, you may not use the Platform. You understand and agree that satisfying the above requirements does not guarantee that you will access, use, or provide services through the Platform.
In these Terms, the terms "you" and "yours" refer to the entity, including any medical practice group or other health care provider organization, on whose behalf these Terms are entered into. The terms "we", "our", "us", and "Therapy Layer" collectively refer to Therapy Layer Corporation. Even though you may have arrived to the Platform through a website or mobile application operated or controlled by a third party, including by an affiliate of Therapy Layer, you understand and agree that these Terms are entered into between you and Therapy Layer. You also understand and agree that the Platform and any services provided through these Terms are provided solely by Therapy Layer, and no other parent, subsidiary, or affiliate of Therapy Layer. Any person using or accessing the Platform for or on behalf of you represents and warrants that they have the authority to download the App or use the Website and agree to these Terms on your behalf.
If you downloaded the App from the Apple App Store: These Terms incorporate by reference Apple's Licensed Application End User License Agreement (https://www.apple.com/legal/internet-services/itunes/dev/stdeula/), for purposes of which you are the "end user".
If you downloaded the App from the Google Play Store: These Terms incorporate by reference Google's Android Market Terms of Service (https://www.google.com/intl/en_gb/mobile/android/market-tos.html).
If you accessed the Platform through the Website: These Terms apply.
Conditioned upon your continued compliance with these Terms, Therapy Layer grants you, and other members of your organization, the right to access and use the Platform. To access and use all or part of the Platform, you are required to register and create an account. Any registration information you provide to Therapy Layer must be accurate, current, and complete. Your access credentials, such as your username and password, cannot be shared with or used by any person or entity except for you. You will be responsible for keeping your account, including access credentials, secure from unauthorized third-party access or use, and you must promptly notify Therapy Layer of any suspected or actual breach or unauthorized use thereof. You are responsible for all access to and use of the Platform using your credentials, including all acts and omissions. Therapy Layer may immediately suspend your account and access to the Platform if you violate, or Therapy Layer reasonably suspects that you have violated, these Terms. Upon termination of your account, your access to the Platform will be terminated with immediate effect.
We reserve the right, in our sole discretion, to amend these Terms, in whole or in part, at any time and for any reason, without penalty or liability to you or any third party. If we determine our changes to these Terms are material, we will make reasonable efforts to notify you of such changes. However, you should check the Terms regularly to determine if any changes have been made. You can determine when the Terms were last revised by referring to the "Last Modified" notation above. If you use the Platform after the amended Terms have been posted, you will be deemed to have agreed to the amended Terms. If any of the provisions of these Terms are not acceptable to you, your sole and exclusive remedy is to discontinue your use of the Platform.
You understand and agree that Therapy Layer makes the Platform available to facilitate communication between you, your Clients, and other entities. Such communications may include, but are not limited to, secure messaging, voicemail, file sharing, and video calls. The Platform enables you, your Clients, and other entities to communicate information, including health information (such as past or present health conditions, medications, ailments, and images) and personal information (such as names, locations, and demographic information). The Platform does not provide for emergency calling services (e.g., 911).
You understand and agree that the Platform enables communications and other data transmissions across multiple channels and to multiple endpoints, a number of which involve transmission that does not occur exclusively through and on the Platform ("Unsecure Communications"). Unsecure Communications include, but are not limited to, email, Short Message Service (SMS) text messages, e-faxing, and voice communications, which may include transmission and/or storage via unsecured networks, devices, or channels. Unsecure Communications may not be encrypted or otherwise protected by Therapy Layer or third parties and could be intercepted or otherwise accessed by unauthorized third parties. You assume all responsibility for any unauthorized access to PHI, as that term is defined in HIPAA (as defined below), or other information of your Clients, you, or any other person or entity resulting from any such Unsecure Communications. In no event will Therapy Layer have any liability to you, your Clients, or any other person or entity for any such unauthorized access.
As a condition of your use of the Platform, you agree to the following:
You must have a compatible mobile device or computer, access to the Internet, and certain necessary software and hardware, as we may stipulate from time to time in our sole discretion, in order to use the Platform. Fees and charges may apply to your use of the mobile services and to the Internet. Therapy Layer is not responsible for those or any other fees.
You will not use, or encourage or permit others to use, our Platform except as expressly permitted in these Terms. You will not, and will not encourage or permit others to:
To the extent applicable, you understand and agree that Therapy Layer will be a "business associate" of yours (as defined in the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, and its related regulations and amendments from time to time (collectively, "HIPAA")) for purposes of HIPAA, pursuant to our Business Associate Agreement (Attachment A).
As between Therapy Layer and you, Therapy Layer is the sole and exclusive owner of all right, title, and interest in and to the Platform and its general content, features, and functionality (including, without limitation, all information, software, text, displays, images, video, audio, selection, arrangement, and look and feel), and all intellectual property rights therein, and any suggestions, ideas, or other feedback provided by you which relates to the Platform. Any copy, modification, revision, enhancement, adaptation, translation, or derivative work of the Platform shall be owned solely and exclusively by Therapy Layer or its licensors, including all intellectual property rights therein. Subject to your compliance with these Terms, Therapy Layer grants you an internal, limited, revocable, nonexclusive, and nontransferable license to view, download, access, and use the Platform and its content, solely for your internal use. You are not permitted to reproduce, publish, transmit, distribute, display, modify, create derivative works from, sell or participate in any sale of, or exploit in any way, in whole or in part, any such content for commercial use. No other right, title, or interest in or to the Platform is transferred to you, and all rights not expressly granted are reserved by us, our affiliates, or our licensors. Notwithstanding the foregoing and except as set forth in Section I10.B, Therapy Layer will not have any right, title, or interest in or to any Health Data (as defined below) or User Data (as defined below).
Certain names, logos, and other materials displayed in and through the Platform may constitute trademarks, trade names, service marks, or logos ("Trademarks") of Therapy Layer or its affiliates. You are not authorized to use any such Trademarks without the express written permission of Therapy Layer or its affiliates. Ownership of all such Trademarks and the goodwill associated therewith remains with us or our affiliates.
The Platform may allow you, your Clients, or other entities (collectively, "These Entities") to enter, submit, or otherwise transmit to Therapy Layer information or other data related to any of These Entities. The Platform may also contain information or other data, related to any of These Entities, that was created on the Platform by any of These Entities. All such data is "Health Data" when it would qualify, in context, as PHI were it the property of a Covered Entity, as those terms are defined in HIPAA. All such data that is not Health Data is "User Data".
To the extent that any User Data is not the property of Therapy Layer, you hereby grant and agree to grant to Therapy Layer, our service providers, and our successors and assigns a fully transferable and sublicensable right and license to use, copy, reproduce, modify, create derivative works of, analyze, perform, display, distribute, and otherwise disclose to third parties any such User Data for the purposes of: (1) providing services to you; (2) conducting research or analyses of such data; and (3) designing, developing, implementing, modifying, and/or improving new, current, or future features, products, and services of Therapy Layer using such data.
You hereby grant and agree to grant to Therapy Layer, our service providers, and our successors and assigns the fully transferable and sublicensable right and license to use, copy, produce, reproduce, modify, create derivative works of, analyze, perform, display, distribute, and otherwise disclose to third parties any de-identified Health Data for the purposes of: (i) providing services to you; (2) conducting research or analyses of such data; and (3) designing, developing, implementing, modifying, and/or improving new, current, or future features, products, and services of Therapy Layer using such data. For the avoidance of doubt, the terms of the Business Associate Agreement (Attachment A) will control, when applicable, with regard to Health Data.
In addition to the foregoing, our collection, usage, and disclosure of any such User Data and Health Data will be subject to our Privacy Policy.
Your use of the Platform may begin with a free trial. If we offer you a free trial, these Terms will govern your use of the Platform. Therapy Layer reserves the right, in its sole discretion, to determine eligibility for free trials. As your free trial period ends, Therapy Layer may contact you, including, without limitation, via email, telephone call, SMS text messaging, or through the Platform, to discuss potential subscription plans and features. If you choose to subscribe to the Platform, payment for any such subscription may take place through a separate website or service provider and not through the Platform. If you do not enter into a subscription plan, Therapy Layer may immediately terminate your account and/or your access to the Platform.
Therapy Layer understands the importance of confidentiality and privacy regarding your information. Please see our Privacy Policy at https://www.therapylayer.com/privacy for a description of how we may collect, use, and disclose your information in connection with the Platform.
Therapy Layer does not provide any recommendation, advice, certification, approval, endorsement, or other specific knowledge or statement related to the fitness, quality, or any other aspect of any third-party organization or other entity, or of the goods or services of any such organization or entity, with regard to any health care purpose, regardless of whether the organization or entity may use the Platform or have any other association with Therapy Layer. Any references or materials related to such a third party that may be present on the Platform are solely for your convenience and are used at your own risk. We are not liable to you in any way, either directly or indirectly, for any content, errors, damage, or loss caused by or in connection with the use of or reliance on third parties or their goods or services.
The Platform may also contain hyperlinks or references to other websites or other services ("Linked Sites") operated by third parties. The Linked Sites may not be under our control; therefore, we are not responsible for the information, products, or services described thereon, or for the content of any Linked Site, including, without limitation, any link contained in a Linked Site, or any changes or updates to a Linked Site. We are providing these Linked Sites to you only as a convenience, and the inclusion of any link does not necessarily imply endorsement of the Linked Site or any association with its operators. Your use of these Linked Sites is at your own risk, and we are not liable to you in any way, either directly or indirectly, for any content, errors, damage, or loss caused by or in connection with use of or reliance on information contained in or provided to Linked Sites.
You may have arrived to the Platform through a Linked Site, including a Linked Site controlled by a parent, subsidiary, or affiliate of Therapy Layer. You understand and agree that we are not responsible for the information, products, or services described on those Linked Sites and that only these Terms will apply to your use of or access to the Platform.
To the fullest extent permitted by applicable law and except as set forth in this Section, Therapy Layer, its Related Persons, and licensors will not be liable to you or to any party under any legal or equitable theory, whether in tort (including negligence), contract, strict liability, or otherwise, for any indirect, punitive, special, incidental, or consequential loss or damage, including lost profits, loss of data or loss of goodwill, service interruption, mobile phone damage, or system failure, or the cost of substitute products or services, or for any damages for personal or bodily injury or emotional distress, including death, arising out of or in connection with any access or use of (or inability to use) the Platform. This is true even if Therapy Layer or its Related Persons have been advised of the possibility of such damages or losses. To the fullest extent permitted by applicable law and subject to this Section, in no event shall the total liability of Therapy Layer and its Related Persons for any damages, claims, or losses arising under these Terms exceed the total amount of payments actually paid by you to us, if any, in the preceding twelve (12) months prior to the date the liability first arose.
You agree to indemnify, defend, and hold Therapy Layer and any of its Related Persons, licensors, and suppliers harmless from and against any and all third-party claims, demands, liabilities, costs, or expenses, including attorneys' fees and costs, arising from or related to: (1) any breach by you of these Terms, (2) your use of any aspect of the Platform in an unauthorized manner, (3) communications or other information or data that you failed to view, listen to, or otherwise receive and/or react to in a timely manner, regardless of whether or not it was caused in part by us or any of our affiliates, officers, directors, agents, representatives, employees, successors, or assigns, (4) your use of Call Recording for any purpose or in any capacity, whether intentional or unintentional, or whether authorized or unauthorized, and/or (5) a violation by you of any and all applicable laws, rules, or regulations.
Therapy Layer reserves the right at any time and for any reason to modify, or temporarily or permanently discontinue, the Platform, or any portion thereof, with or without notice. You agree that Therapy Layer shall not be liable to you or to any third party for any modification, suspension, or discontinuance of the Platform. Without limiting the foregoing, we will make reasonable efforts to notify you in advance of any discontinuation of the Platform in its entirety.
The Terms will remain in full force and effect as long as you continue to access or use the Platform. You may terminate the Terms by discontinuing use of the Platform and notifying us; such termination will be deemed to take effect on the last day of the current billing cycle for your account and Therapy Layer will not provide you with a refund for any such termination. Your permission to use the Platform automatically terminates if you violate these Terms.
Except for termination or suspension by us subject to Sections 2 or 10, we may terminate or suspend any of the rights granted by these Terms and your access to our Platform for any reason upon thirty (30) days written notice to you. Notwithstanding the foregoing, we may immediately terminate these Terms and your access to our Platform if required by applicable regulatory authorities or if we determine that any change in any applicable federal, state, or local government laws, rules, or regulations would render unlawful the conduct under these Terms of you or us. If we terminate these Terms in the absence of a threatened or actual violation or breach of these Terms by you, we will refund to you any unused portion of prepaid payments made by you, if any, for subscription time past the later of: a) your last actual date of usage of the Platform, or b) thirty (30) days after our written notice of termination to you. The amount of any such refund will be calculated pro rata, based on the fees paid, the actual time length of the services, and the originally contemplated time length of the services, in days. We will issue such refund within ninety (90) days of our notice of termination.
The following Sections survive the expiration or termination of these Terms for any reason whatsoever: 7 (Restrictions on Use), 13 (Disclaimer), 14 (Limitation of Liability), 15 (Indemnification), 18 (Governing Law; Dispute Resolution; Arbitration; Class Action Waiver), and 20 (Miscellaneous).
Subject to applicable law, Therapy Layer reserves the right to maintain, delete, or destroy all communications and materials posted or uploaded to the Platform in its sole discretion.
PLEASE READ THIS SECTION CAREFULLY BECAUSE IT REQUIRES YOU AND THERAPY LAYER TO RESOLVE ALL DISPUTES BETWEEN US THROUGH BINDING INDIVIDUAL ARBITRATION AND LIMITS THE MANNER IN WHICH YOU CAN SEEK RELIEF FROM THERAPY LAYER.
The Platform is controlled and operated by us from the United States, and is not intended to subject us to the laws or jurisdiction of any state, country, or territory other than that of the United States. These Terms will be governed by the laws of the State of California without regard to conflicts of law principles.
You and Therapy Layer agree that all claims and disputes relating in any way to your use of our Platform, or arising out of or in connection with these Terms, shall be resolved by binding arbitration, to the fullest extent permitted by applicable law, on an individual basis, except for any dispute in which either party seeks equitable relief for the alleged unlawful use of copyrights, trademarks, trade names, logos, trade secrets, or patents, or any dispute already pending at the time you first agree to these Terms. You also agree that any arbitration will take place in San Francisco, California.
IN THE EVENT ARBITRATION IS CONTRARY TO APPLICABLE LAW, YOU AND THERAPY LAYER WAIVE ANY CONSTITUTIONAL OR STATUTORY RIGHT TO GO TO COURT AND HAVE A TRIAL IN FRONT OF A JUDGE OR A JURY. You and Therapy Layer are instead electing to have claims and disputes resolved by arbitration. Arbitration is the referral of a claim or dispute to one or more persons charged with reviewing the claim or dispute and making a final binding determination to resolve it instead of having it decided by a judge or jury in court. Arbitration procedures are typically more limited, more efficient, and less costly than rules applicable in court and are subject to very limited review by a court. The arbitrator's award shall be binding and may be entered as a judgment in any court of competent jurisdiction.
YOU AND THERAPY LAYER AGREE THAT ALL CLAIMS AND DISPUTES WITHIN THE SCOPE OF THIS ARBITRATION AGREEMENT MUST BE ARBITRATED OR LITIGATED ON AN INDIVIDUAL BASIS AND NOT ON A CLASS BASIS. CLAIMS AND DISPUTES OF MORE THAN ONE CUSTOMER OR USER CANNOT BE BROUGHT AS A CLASS OR OTHER TYPE OF REPRESENTATIVE ACTION, WHETHER WITHIN OR OUTSIDE OF ARBITRATION, OR ON BEHALF OF ANY INDIVIDUAL OR OTHER GROUP. UNLESS BOTH YOU AND THERAPY LAYER AGREE OTHERWISE, THE ARBITRATOR MAY NOT CONSOLIDATE OR JOIN MORE THAN ONE PERSON'S OR PARTY'S CLAIMS AND MAY NOT OTHERWISE PRESIDE OVER ANY FORM OF A CONSOLIDATED, REPRESENTATIVE, OR CLASS PROCEEDING. ALSO, THE ARBITRATOR MAY AWARD RELIEF (INCLUDING MONETARY, INJUNCTIVE, AND DECLARATORY RELIEF) ONLY IN FAVOR OF THE INDIVIDUAL PARTY SEEKING RELIEF AND ONLY TO THE EXTENT NECESSARY TO PROVIDE RELIEF NECESSITATED BY THAT PARTY'S INDIVIDUAL CLAIM(S) OR DISPUTE. ANY RELIEF AWARDED CANNOT AFFECT OTHER THERAPY LAYER USERS OR CUSTOMERS.
The Federal Arbitration Act governs the interpretation and enforcement of this dispute resolution provision. Any arbitration between you and Therapy Layer will be initiated through the American Arbitration Association ("AAA") and will be governed by the AAA Consumer Arbitration Rules. The AAA Rules and filing forms are available at www.adr.org.
You agree that your use of the Platform or Therapy Layer will comply with the federal CAN-SPAM Act, HIPAA, the Telephone Consumer Protection Act, and other federal, state, or local laws and regulations that affect your utilization of the Platform or Therapy Layer.
The Terms set forth the entire understanding and agreement between you and us with respect to the subject matter hereof. If any provision of the Terms is found by a court of competent jurisdiction to be invalid, the parties nevertheless agree that the court should endeavor to give effect to the parties' intentions as reflected in the provision, and the other provisions of the Terms shall remain in full force and effect. Headings are for reference only and in no way define, limit, construe, or describe the scope or extent of such section. Our failure to act with respect to any failure by you or others to comply with these Terms does not waive our right to act with respect to subsequent or similar failures. You may not assign or transfer your rights or obligations under these Terms without our prior written consent, and any assignment or transfer in violation of this provision shall be null and void. Except as otherwise set forth in these Terms: (a) any notice given by us to you will be provided via email to the email address used to register your account and/or, in our sole discretion, to the email address of the person listed as your organization's administrator on the Platform, and will be deemed to be both written and fully given on the date of sending; and (b) any notice given by you to us will be provided as set forth in Section 22.
Therapy Layer reserves the right to remove any content or any other material or information available on or through our Platform, at any time, for any reason. Therapy Layer otherwise complies with the provisions of the Digital Millennium Copyright Act ("DMCA") applicable to Internet service providers (17 U.S.C. § 512, as amended), and responds to clear notices of alleged copyright infringement. This Section describes the procedure that should be followed to file a notification of alleged copyright infringement with Therapy Layer.
If you have objections to copyrighted content or material made available on or through our Platform, you may submit a notification to us as set forth in Section 22, with such notification marked with attention to our Designated Agent, the Therapy Layer Compliance Officer.
Any notification to Therapy Layer under 17 U.S.C. § 512(c) alleging copyright infringement must include the following information:
If you have any questions or concerns, or if you wish to provide notice to us under these Terms, please contact us by one of the following means:
Any notice required or permitted to be given by you to us under these Terms will be given in writing by certified mail with return receipt requested, overnight delivery by a nationally recognized carrier, or by email upon our confirmation of receipt, and will be deemed fully given on the date of actual delivery.
This "Attachment A – Business Associate Agreement" (the "Agreement") is incorporated into and a part of the "Therapy Layer Corporation: Relay – Terms of Service for Organizations" ("Terms of Service"), where applicable. The term "Covered Entity" shall refer to you and "Business Associate" to Therapy Layer as such terms are defined in the Terms of Service. In the event that you are a Business Associate and we are your subcontractor Business Associate under HIPAA, "Covered Entity" shall refer to you in your capacity as a Business Associate of one or more Covered Entities, and "Business Associate" shall refer to us as your subcontractor Business Associate. In the event that you are neither a Covered Entity nor a Business Associate under HIPAA, this Agreement shall not apply.
A. Whereas, the U.S. Department of Health and Human Services issued regulations on "Standards for Privacy of Individually Identifiable Health Information" comprising 45 C.F.R. Parts 160 and 164, Subparts A and E (the "Privacy Standards"), "Security Standards for the Protection of Electronic Protected Health Information" comprising 45 C.F.R. Parts 160 and 164, Subpart C (the "Security Standards"), "Standards for Notification in the Case of Breach of Unsecured Protected Health Information" comprising 45 C.F.R. Parts 160 and 164, Subpart D (the "Breach Notification Standards"), and "Rules for Compliance and Investigations, Impositions of Civil Monetary Penalties, and Procedures for Hearings" comprising 45 C.F.R. Part 160, Subparts C, D, and E (the "Enforcement Rule"), promulgated pursuant to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the Health Information Technology for Economic and Clinical Health Act ("HITECH Act") (the Privacy Standards, the Security Standards, the Breach Notification Standards, and the Enforcement Rule are collectively referred to herein as the "HIPAA Standards").
B. Whereas, in conformity with the HIPAA Standards, Business Associate has, and/or will create, receive, maintain, or transmit certain Protected Health Information ("PHI") of Covered Entity pursuant to the services provided under the Terms of Service.
C. Whereas, Covered Entity is required by the HIPAA Standards to obtain satisfactory assurances that Business Associate will appropriately safeguard all PHI created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity.
D. Whereas, the parties hereto desire to enter into this Agreement to memorialize their obligations with respect to PHI pursuant to the requirements of the HIPAA Standards.
Now, therefore, Covered Entity and Business Associate agree as follows:
This Agreement supplements, modifies, and amends the Terms of Service, whether oral or written, between the parties involving the disclosure of PHI by Covered Entity to Business Associate, or the creation, receipt, maintenance, or transmission of PHI by Business Associate on behalf of Covered Entity. The terms and provisions of this Agreement shall supersede any other conflicting or inconsistent terms and provisions in the Terms of Service between the parties, including all exhibits or other attachments thereto and all documents incorporated therein by reference.
Business Associate and Covered Entity agree to amend this Agreement to the extent necessary to allow either Business Associate or Covered Entity to comply with the HIPAA Standards promulgated or to be promulgated by the Secretary of the Department of Health and Human Services ("Secretary") or other related regulations or statutes.
Except as otherwise specified herein, capitalized terms used but not defined in this Agreement will have the same meaning as those terms in the HIPAA Standards.
Except as otherwise limited by the Terms of Service or this Agreement, Business Associate may:
(a) Use or disclose PHI to perform functions, activities, or services for, or on behalf of, Covered Entity, provided that such use or disclosure would not violate the Privacy Standards if done by Covered Entity;
(b) Use PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate;
(c) Use PHI to de-identify PHI in accordance with 45 C.F.R. § 164.502(d), including for reporting and process improvement purposes;
(d) Provide Data Aggregation services relating to the Health Care Operations of Covered Entity if required under the Terms of Service; and
(e) Disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided that (1) the disclosure is Required by Law or (2) Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and will be used or further disclosed only as Required by Law or for the purpose for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.
Business Associate agrees to not use or further disclose PHI other than as permitted or required by this Agreement or as Required by Law. Business Associate will also comply with any further limitations on uses and disclosures of PHI by Covered Entity in accordance with 45 C.F.R. § 164.522, provided that Covered Entity communicates such limitations to Business Associate.
Business Associate agrees to use appropriate safeguards to prevent use or disclosure of PHI other than as provided for by this Agreement. Business Associate agrees to comply with applicable provisions of 45 C.F.R. Part 164, Subpart C with respect to electronic PHI that it creates, receives, maintains, or transmits on behalf of Covered Entity.
Business Associate agrees to report to Covered Entity any use or disclosure of PHI not provided for by this Agreement of which Business Associate becomes aware. Additionally, Business Associate shall report to Covered Entity any Security Incident of which Business Associate becomes aware. At the request of Covered Entity, Business Associate will identify the date and nature and scope of the Security Incident, Business Associate's response to the Security Incident, and the identification of the party responsible for causing the Security Incident, if known. Notwithstanding the foregoing, the parties acknowledge and agree that this Section 3.4 constitutes notice by Business Associate to Covered Entity of the ongoing existence and occurrence or attempts of unsuccessful Security Incidents for which no additional notice to Covered Entity shall be required. Unsuccessful Security Incidents means, without limitation, pings and other broadcast attacks on Business Associate's firewall, port scans, unsuccessful log-on attempts, denial of service attacks, and any combination of the above, so long as no such incident results in unauthorized access, use, or disclosure of Covered Entity's electronic PHI.
Business Associate agrees to notify Covered Entity of any Breach of Unsecured Protected Health Information without undue delay and within no more than sixty (60) calendar days of the date Business Associate discovers the Breach. Business Associate will provide such information to Covered Entity as required by Covered Entity and the Breach Notification Standards.
Business Associate shall obtain and maintain a written agreement with each agent or subcontractor that creates, receives, maintains, or transmits Covered Entity's PHI on behalf of Business Associate. Under the agreement, such agent or subcontractor shall agree to the same restrictions and conditions that apply to Business Associate pursuant to this Agreement with respect to such PHI.
Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Agreement or the HIPAA Standards.
If Business Associate maintains PHI in a Designated Record Set, as defined in 45 C.F.R. § 164.501, and upon request of Covered Entity, Business Associate agrees to provide access to such PHI in a Designated Record Set to Covered Entity in order for Covered Entity to comply with the requirements under 45 C.F.R. § 164.524. If Business Associate receives a direct request from an Individual for access to PHI, it will promptly forward the request to Covered Entity to fulfill. Further, if the PHI that is the subject of a request for access is maintained in one or more Designated Record Sets electronically and if the Individual requests an electronic copy of such information, the Business Associate shall promptly provide access to the PHI in the electronic form and format requested, if it is readily producible in such form and format; or, if not, in a readable electronic form and format as agreed to by Covered Entity and the Individual.
If Business Associate maintains PHI in a Designated Record Set, Business Associate agrees to make available PHI for amendment and incorporate any amendments to PHI in a Designated Record Set, in order for Covered Entity to comply with 45 C.F.R. § 164.526. If Business Associate receives a direct request from an Individual for amendment to PHI, it will promptly forward the request to Covered Entity to fulfill.
Business Associate will promptly make its internal practices, books, and records, including policies and procedures relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of Covered Entity, available to Covered Entity, or at the request of the Secretary of the U.S. Department of Health and Human Services, for purposes of determining Covered Entity's compliance with the Privacy Standards.
Business Associate agrees to document and make available promptly information required to provide an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528 and the HITECH Act. Business Associate further agrees to promptly provide Covered Entity such information upon request to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI, in accordance with 45 C.F.R. § 164.528 and the HITECH Act.
Business Associate acknowledges that it will limit the use, disclosure, or request of PHI to perform or fulfill a function required or permitted under this Agreement to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request, as specified by the HIPAA Standards and any relevant guidance issued by the U.S. Department of Health and Human Services.
Except for the purposes set forth in the Terms of Service and as otherwise provided by law, Business Associate agrees not to directly or indirectly receive remuneration in exchange for any PHI of an Individual.
If Business Associate agrees to carry out an obligation of Covered Entity under 45 C.F.R. Part 164, Subpart E, Business Associate agrees to comply with the requirements of 45 C.F.R. Part 164, Subpart E that apply to Covered Entity in the performance of such obligations.
If Business Associate conducts any Standard Transactions on behalf of Covered Entity, Business Associate shall comply with the applicable requirements of 45 C.F.R. Part 162.
For the avoidance of doubt, the terms of Section 4(B), "Unsecure Communications", of the Terms of Service shall apply without restriction to all matters contemplated in or otherwise within the scope of this Agreement, including without limitation PHI.
This Agreement shall become effective upon Covered Entity's acceptance of the Terms of Service and, unless otherwise terminated as provided herein, shall have a term that shall run concurrently with that of the last expiration date or termination of the Terms of Service.
Upon Covered Entity's knowledge of a material breach of this Agreement by Business Associate, Covered Entity may terminate this Agreement by terminating the Terms of Service pursuant to the terms thereof.
Upon termination of this Agreement, Business Associate shall either return or destroy all PHI received from Covered Entity or created or received by Business Associate on behalf of Covered Entity and which Business Associate still maintains in any form. Business Associate shall not retain any copies of such PHI. Notwithstanding the foregoing, to the extent that Business Associate determines that it is not feasible to return or destroy such PHI, the terms and provisions of this Agreement shall survive termination and such PHI shall be used or disclosed solely for such purpose or purposes which prevented the return or destruction of such PHI.
Any notices or communications to be given pursuant to this Agreement will be made pursuant to the terms of the Terms of Service.
A reference in this Agreement to a section in the HIPAA Standards means the section then in effect.
The parties agree to take such action as may be necessary to amend this Agreement from time to time to ensure the parties comply with the requirements of the HIPAA Standards and any other applicable law or regulation. Any amendment to this Agreement proposed by either party will not be effective unless mutually agreed to in writing by both parties.
Nothing express or implied in this Agreement is intended to confer, nor will anything herein confer, upon any person other than the parties and the respective successors or assigns of the parties, any rights, remedies, obligations, or liabilities whatsoever.
Any ambiguity in this Agreement shall be resolved to permit the parties to comply with the HIPAA Standards. In the event of any inconsistency or conflict between this Agreement and the Terms of Service, the terms and conditions of this Agreement shall govern and control.
This Agreement shall be governed by and construed in accordance with the same internal laws as that of the Terms of Service.
