Have a Question?
Terms & Conditions
Empowering Care Through AI-Driven Documentation.
DEFINITION
(B). Please read these terms of use carefully. By accessing and/or using the platform, you acknowledge that you have read, understood, and agree to be legally bound by these terms of use, and the terms and conditions of our privacy policy (the “Privacy Policy”), which is hereby incorporated into these terms of use and made a part hereof by reference (collectively, the “Agreement”). if you do not agree to any of the terms in this agreement, then please do not use the platform.
(C). If you accept or agree to the Agreement on behalf of a company or other legal entity, you represent and warrant that you have the authority to bind that company or other legal entity to the Agreement and, in such event, “you” and “your” will refer and apply to that company or other legal entity. We reserve the right, at our sole discretion, to modify, discontinue, or terminate the Platform, or to modify the Agreement, at any time and without prior notice. you are indicating that you agree to be bound by the modified Agreement. If the modified Agreement is not acceptable to you, your only recourse is to cease using the Platform.
(D). THE SECTIONS BELOW TITLED “BINDING ARBITRATION” AND “CLASS ACTION WAIVER” CONTAIN A BINDING ARBITRATION AGREEMENT AND CLASS ACTION WAIVER. THEY AFFECT YOUR LEGAL RIGHTS. PLEASE READ THEM CAREFULLY. (Capitalized terms not defined in these Terms of Use shall have the meaning set forth in our Privacy Policy).
1. RIGHT TO ACCESS AND USE THE PLATFORM
(1.a) Subject to the terms and conditions of this Agreement, QureNote AI hereby grants you during the Term of this Agreement a limited, non-exclusive, non-transferable, non-sublicensable, revocable right, to authorize your Authorized Users to access and use the Platform solely for your internal business purposes to evaluate the Platform.
(1.b) You will not authorize, permit, or encourage any third party to: (i) reverse engineer, decompile, disassemble, or otherwise attempt to discern the source code or interface protocols of the Platform; (ii) modify, adapt, or translate the Platform, or any portion or component thereof; (iii) make any copies of the Platform, or any portion or component thereof; (iv) resell, distribute, or sublicense the Platform, or any portion or component thereof; (v) remove or modify any proprietary markings or restrictive legends placed on the Platform; (vi) use the Platform, or any portion or component thereof in violation of any applicable law, in order to build a competitive product or service, or for any purpose not specifically permitted in this Agreement; (vii) introduce, post, or upload to the Platform any virus, worm, “black door,” Trojan Horse, or similar harmful code; (viii) save, store, or archive any portion of the services (including, without limitation, any data contained therein) outside the Platform other than those outputs generated through the intended functionality of the Platform without the prior, written permission of QureNote AI in each instance; (ix) use the Platform in connection with service bureau, timeshare, service provider or like activity whereby you operate the Platform for the benefit of a third party; or (x) circumvent any processes, procedures, or technologies that we have put in place to safeguard the Platform.
(1.c) If you violate this section, QureNote AI reserves the right in its sole discretion to immediately deny your access to the Platform, or any portion of thereof, without notice. QureNote AI reserves the right to change the availability of any feature, function, or content relating to the Platform, at any time, without notice or liability to you.
2. AUTHORIZED USERS
(2.a) Your employees and contractors who access and use the Platform on your behalf are referred to herein as “Authorized Users.” Each Authorized User must create an account by providing his/her email address and creating a password (collectively “Login Credentials”). Login Credentials cannot be shared between Authorized Users or by any Authorized User with a third party. Login Credentials must be kept confidential. You agree to immediately notify us of any unauthorized use or suspected unauthorized use of any Login Credentials.
(2.b) You are fully responsible for all activities, and use or misuse of the Platform, that is associated any Authorized User’s Login Credentials. You are also responsible for ensuring that your Authorized Users comply with these Terms of Use. You will promptly inform us of any need to deactivate or change any Login Credentials. We have the right to disable any Platform account username or password at any time for any reason, including if in our sole discretion we believe that you have failed to comply with these Terms of Use.
3. USE OF PERSONAL INFORMATION
(3.a) Your use of the Platform may involve the transmission to us of certain personal information. Our policies with respect to the collection and use of such personal information are governed according to our Privacy Policy, which is hereby incorporated by reference in its entirety.
4. OWNERSHIP
(4.a) The Platform contains material, such as software, text, graphics, images, sound recordings, audio visual works, and other material provided by or on behalf of QureNote AI (collectively referred to as the “Content”).
(4.b) The Content may be owned by us or by third parties. The Content is protected under both United States and foreign laws. Unauthorized use of the Content may violate copyright, trademark, and other laws. You have no rights in or to the Content, and you will not use the Content except as permitted under this Agreement. No other use is permitted without prior written consent from us. You must retain all copyright and other proprietary notices contained in the original Content on any copy you make of the Content. You may not sell, transfer, assign, license, sublicense, or modify the Content or reproduce, display, publicly perform, make a derivative version of, distribute, or otherwise use the Content in any way for any public or commercial purpose. The use or posting of the Content on any other website or in a networked computer environment for any purpose is expressly prohibited.
(4.c) If you violate any part of this Agreement, your permission to access and/or use the Content, and the Platform automatically terminates and you must immediately destroy any copies you have made of the Content. The trademarks, service marks, and logos of QureNote AI (the “QureNote AI Trademarks”) used and displayed on the Platform are registered and unregistered trademarks or service marks of QureNote AI. Other company, product, and service names located on the Platform may be trademarks or service marks owned by others (the “Third-Party Trademarks,” and, collectively with QureNote AI Trademarks, the “Trademarks”). Nothing on the Platform should be construed as granting, by implication, estoppel, or otherwise, any license or right to use the Trademarks, without our prior written permission specific for each such use. Use of the Trademarks as part of a link to or from any website is prohibited unless establishment of such a link is approved in advance by us in writing. All goodwill generated from the use of QureNote AI Trademarks inures to our benefit.
(4.d) Elements of the Platform are protected by trade dress, trademark, unfair competition, and other state and federal laws and may not be copied or imitated in whole or in part, by any means, including, but not limited to, the use of framing or mirrors. None of the Content may be retransmitted without our express, written consent for each and every instance.
5. YOUR DATA
YOUR DATA; USAGE DATA; DE-IDENTIFIED DATA; AGGREGATE DATA; AND OUTPUT
(5.a) For purposes of this Agreement, “Your Data” means any data and information that you and your Authorized Users submit to the Platform, including but not limited to, Patient Recordings (as defined below) and the personal information of Authorized Users; “Patient Recordings” means: (i) the audio and/or video recordings of the sessions between you (or your Authorized Users) and patient (and the patient’s parents, or other family members or friends, to the extent participating in such sessions) that you or your Authorized Users conduct and upload to the Platform; and (ii) the information and data collected and/or gathered by you (or your Authorized Users) during such sessions that you or your Authorized Users upload to the Platform; “Protected Health Information” or “PHI” means as that term is defined under the Health Insurance Portability and Accountability Act of 1996, as amended, and related regulation (“HIPAA”); “Usage Data” means anonymous, analytical data that QureNote AI collects concerning the performance and use of the Platform by you and your Authorized Users, including, without limitation, date and time that you access the Platform, the portions of the Platform visited, the frequency and number of times such pages are accessed, the number of times the Platform is used in a given time period and other usage and performance data; “Output” means the medical documentation generated by processing Your Data through the Platform and provided to you and your Authorized Users through the Platform.
(5.b) You own all right, title, and interest in and to Your Data and Output, including all modifications, improvements, adaptations, enhancements, or translations made thereto, and all intellectual rights therein.
(5.c) You hereby grant QureNote AI a non-exclusive, worldwide, fully paid-up, royalty-free right and license, with the right to grant sublicenses, to reproduce, execute, use, store, archive, modify, perform, display and distribute Your Data: (i) during the term of this Agreement, in furtherance of QureNote AI obligations hereunder; and (ii) for QureNote AI internal business purposes, including using such data to analyze, update, and improve the Platform and QureNote AI’s analytics capabilities. We will process any PHI included in Your Data in accordance with the Business Associate Agreement attached hereto as Schedule A (“BAA”). You will have sole responsibility for the accuracy, quality, and legality of Your Data. If the terms of this
(5.d) Agreement conflict with the terms of the BAA, the terms of the BAA shall control solely with respect to processing of PHI. By providing Your Data, you agree to be legally bound by the terms and conditions of the BAA, which is made part of this Agreement.
(5.e) Pursuant to Section 2.1 of the BAA, we have the right in our sole discretion to use De-identified Data and to disclose such De-identified Data to third parties. We will also link your De-identified Data with your customer ID and use it to customize and train our Platform based on your specific styles and requirements that can be identified from Your Data.
(5.f) Not withstanding anything to the contrary herein, we may use, and may permit our third-party service providers to access and use, Your Data, as well as any Usage Data that we may collect, in an anonymous and aggregated form (“Aggregate Data”) for the purposes of operating, maintaining, managing, and improving our products and services including the Platform. Aggregate Data does not identify you. You hereby agree that we may collect, use, publish, disseminate, sell, transfer, and otherwise exploit such Aggregate Data.
6. RETENTION OF YOUR DATA
(6.a) With respect to your Patient Recordings, you have the option in the Platform settings to choose to (i) retain your data in the Platform only for a period of thirty (30) days from the date it was submitted through the Platform; (ii) Patient Recordings can be deleted once they are processed by the Platform; (ii) with respect to Your Data pursuant to the foregoing sentence, then except as set forth in Section 16, after this thirty (30) day period, we will delete Your Data; (iii) Retain Your Data in the Platform for the Term of this Agreement. If you choose option Provided.
7. FEE AND PAYMENT
(7.a) Free Trial Period:
(i) Trial Period: Customers may use the services without charge starting from the Effective Date until the free trial expires. (ii) Post-Trial Period: After the Trial Period ends, unless the agreement is terminated, the Customer will pay the advertised monthly fee for the services.
(7.b) Fees and Billing
(i) Subscription Fees: Following the Trial Period, the Customer will be charged the monthly or annual fee then in effect. Customers with paid subscriptions must provide a valid credit card to the Provider or its third-party payment service provider (Stripe) for payment of applicable subscription fees.
(7.c) Incidental Charges
(i) Additional Costs: Customers may incur incidental charges for using the service, such as Internet access, data roaming, and other data transmission charges.
(7.d) Refunds and Cancellations
(i) No Refunds: No refunds or credits will be issued for partial periods of service, upgrades/downgrades, or unused periods with an active subscription. (ii) Cancellation: There are no charges for canceling a subscription. Paid subscriptions canceled before the end of the current billing cycle will not be charged again in the following cycle.
(7.e) Fee Increases
(i) Notice: Provider reserves the right to increase fees with or without advance notice to the Customer. (ii) Effective Date: Fee increases will not take effect until the start of the next subscription term. (iii) Agreement to Pay: Continued use of the services after the fee increase start date constitutes the Customer’s agreement to pay the increased fee.
(7.f) Taxes
(i) Responsibility: All amounts are exclusive of taxes, duties, and charges. The Customer is solely responsible for these charges, except for taxes on the Provider’s income. (ii) Updated Tax Rates: Provider will apply new tax rates without notice to the Customer.
(7.g) Payment Authorization
(i) Payment Method: All fees shall be charged to the payment method designated by the Customer upon signing up for the services. (ii) Automatic Processing: Customer authorizes QureNote AI to automatically process the fees as they become due. (iii) Payment Method Accuracy: Customer is responsible for providing an accurate, complete, and up-to-date payment method at all times. (iv) Third-Party Payment Processors: Customer acknowledges that QureNote AI uses third-party payment processors and agrees to their terms and conditions.
By using QureNote AI services, the Customer agrees to these fee and payment terms and conditions.
8. PLATFORM RULES
By accessing and/or using the Platform, you hereby agree to comply with the following guidelines:
(8.a) You will not use the Platform for any unlawful purpose; You will not access or use the Platform to collect any market research for a competing businesses; You will not upload, post, e-mail, transmit, or otherwise make available any content that: infringes any copyright, trademark, right of publicity, or other proprietary rights of any person or entity; or constitutes promotion or advertising of any third-party website, product or service; or is defamatory, libelous, indecent, obscene, pornographic, sexually explicit, invasive of another’s privacy, promotes violence, or contains hate speech (i.e., speech that attacks or demeans a group based on race or ethnic origin, religion, disability, gender, age, veteran status, and/or sexual orientation/gender identity); or discloses any sensitive information about another person, including that person’s e-mail address, postal address, phone number, credit card information, or any similar information.
(8.b) You will not impersonate any person or entity or falsely state or otherwise misrepresent your affiliation with a person or entity; You will not decompile, reverse engineer, or disassemble any software or other products or processes accessible through the Platform; You will not cover, obscure, block, or in any way interfere with any advertisements and/or safety features on the Platform; You will not circumvent, remove, alter, deactivate, degrade, or thwart any of the protections in the Platform.
(8.c) You will not use automated means, including spiders, robots, crawlers, data mining tools, or the like to download or scrape data from the Platform, directly or indirectly, except for Internet search engines (e.g., Google) and non-commercial public archives (e.g., archive.org) that comply with our robots.txt file; You will not take any action that imposes or may impose (in our sole discretion) an unreasonable or disproportionately large load on our technical infrastructure; and You will not interfere with or attempt to interrupt the proper operation of the Platform through the use of any virus, device, information collection or transmission mechanism, software or routine, or access or attempt to gain access to any data, files, or passwords related to the Platform through hacking, password or data mining, or any other means.
(8.d) We reserve the right, in our sole and absolute discretion, to deny you (or any device) access to the Platform, or any portion thereof, without notice.
9. RESTRICTIONS
(9.a) The Platform is available only for individuals aged 18 years or older. If you are under 18 years of age, then please do not access and/or use the Platform. By entering into this Agreement, you represent and warrant that you are 18 years or older.
10. FEEDBACK
(10.a) We welcome and encourage you to provide feedback, comments, and suggestions for improvements to the Platform and our services (“Feedback”). Although we encourage you to e-mail us, we do not want you to, and you should not, e-mail us any content that contains confidential information. With respect to any Feedback you provide, we shall be free to use and disclose any ideas, concepts, know-how, techniques, or other materials contained in your Feedback for any purpose whatsoever, including, but not limited to, the development, production and marketing of products and services that incorporate such information, without compensation or attribution to you.
11. NO WARRANTIES; LIMITATION OF LIABILITY
(11.a) The platform, the content and our services are provided on an “as is” and “as available” basis, and neither Qurenote AI nor Qurenote AI suppliers make any warranties with respect to the same or otherwise in connection with this agreement, and Qurenote AI hereby disclaims any and all express, implied, or statutory warranties, including, without limitation, any warranties of non-infringement, merchantability, fitness for a particular purpose, availability, error-free or uninterrupted operation, and any warranties arising from a course of dealing, course of performance, or usage of trade. to the extent that Qurenote AI and Qurenote AI suppliers may not as a matter of applicable law disclaim any implied warranty, the scope and duration of such warranty will be the minimum permitted under such law. the platform, the content, and the output are not intended to diagnose, treat, cure, or prevent any disease or health condition. you and your authorized users are solely responsible and liable for any medical conclusions or treatment decisions you make based upon any output provided and/or made available through the platform. the platform, the content and the output is not intended to be a substitute for professional medical advice, diagnosis or treatment. Qurenote AI does not warrant, guarantee or make any representation to you or any authorized user regarding the use or performance of the platform, or any component thereof or any output produced by the platform. Qurenote AI will have no liability for any harm or damage arising out of or in connection with any use of the platform, and/or the output. Qurenote AI is not responsible for any decisions taken by you or any of your authorized users based on the output produced and/or made available through the platform. you and each of your authorized users agrees that its use of the platform, the output, or any component thereof is entirely at his/her own risk.
(11.b) Without limiting the foregoing, we do not warrant, guarantee or make any representation, nor shall we be responsible for (i) the correctness, accuracy, reliability, completeness or currency of the platform; or (ii) any results achieved or action taken by you in reliance on the platform or the output of the platform. any decision, act or omission of yours that is based on the platform or output of the platform is at your own and sole risk. the platform and the output is provided as a convenience only and does not replace the need to review the output accuracy, completeness and correctness.
(11.c) In connection with any warranty, contract, or common law tort claims: (i) we shall not be liable for any incidental or consequential damages, lost profits, or damages resulting from lost data or business interruption resulting from the use or inability to access and use the platform, the content, the output, or any related services, even if we have been advised of the possibility of such damages; and (ii) any direct damages that you and your authorized users may suffer as a result of your use of the platform, the content, the output, or any related services shall be limited to the greater of one hundred dollars ($100) or the total fees paid by you to use in three (3) months immediately preceding the date on which the claim arises.
12. EXTERNAL SITES
(12.a) The Platform may contain links to third-party websites (“External Sites”). These links are provided solely as a convenience to you and not as an endorsement by us of the content on such External Sites. The content of such External Sites is developed and provided by others. You should contact the website administrator or webmaster for those External Sites if you have any concerns regarding such links or any content located on such External Sites. We are not responsible for the content of any linked External Sites and do not make any representations regarding the content or accuracy of materials on such External Sites. You should take precautions when downloading files from all websites to protect your computer from viruses and other destructive programs. If you decide to access linked External Sites, you do so at your own risk.
13. REPRESENTATIONS AND WARRANTIES
(13.a) You represent and warrant that you have: (i) all rights and permissions necessary to provide us with or grant us access to and use of Your Data, and (ii) obtained all necessary and appropriate consents,
(13.b) permissions, and authorizations in accordance with all applicable laws and regulations with respect to Your Data provided hereunder, including but not limited to, consents from patients, their patents and/or legal guardians, including consents to record patient’s visit sessions and authorization for the use, exchange and disclosure of any applicable PHI (collectively, “Consents”).
14. INDEMNIFICATION
(14.a) You will indemnify, defend, and hold QureNote AI, its affiliates, and our and their respective shareholders, members, officers, directors, employees, agents, and representatives (collectively, “QureNote AI Indemnitees”) harmless from and against any and all damages, liabilities, losses, costs, and expenses, including reasonable attorney’s fees (collectively, “Losses”) incurred by any QureNote AI Indemnitee in connection with a third-party claim, action, or proceeding (each, a “Claim”) arising from your or your Authorized User’ (i) breach of this Agreement, including but not limited to, any breach of your representations and warranties; (ii) misuse of the Platform, the Output, and/or the Content; (iii) negligence, gross negligence, willful misconduct, fraud, misrepresentation or violation of law; or (iv) violation of any third-party right, including without limitation any copyright, trademark, property, or privacy right; provided, however, that the foregoing obligations shall be subject to our: (v) promptly notifying you of the Claim; (vi) providing you, at your expense, with reasonable cooperation in the defense of the Claim; and (vii) providing you with sole control over the defense and negotiations for a settlement or compromise.
15. COMPLIANCE WITH APPLICABLE LAWS
(15.a) The Platform is based in the United States. We make no claims concerning whether the Platform may be viewed or be appropriate for use outside of the United States. If you access the Platform from outside of the United States, you do so at your own risk. Whether inside or outside of the United States, you are solely responsible for ensuring compliance with the laws of your specific jurisdiction.
16. TERM; TERMINATION
(16.a) Your right to access and use the Platform will commence upon your acceptance of these Terms of Use and will continue for the duration of the subscription plan that you selected at registration (the “Term”). Thereafter, the Term will automatically renew for consecutive terms equivalent to the duration of your subscription plan, unless either of us notifies the other at least thirty (30) days prior to the expiration of the then-current renewal term of its intention to not renew.
(16.b) We reserve the right to change, suspend, discontinue or terminate your access and use of all or any part of the Platform at any time without prior notice or liability. Sections 4, 5, 6, 7, and 9-21 shall survive the termination of these Terms of Use.
17. BINDING ARBITRATION
(17.a) In the event of a dispute arising under or relating to this Agreement, the Platform (each, a “Dispute”), such dispute will be finally and exclusively resolved by binding arbitration governed by the Federal Arbitration Act (“FAA”). NEITHER PARTY SHALL HAVE THE RIGHT TO LITIGATE SUCH CLAIM IN COURT OR TO HAVE A JURY TRIAL, EXCEPT EITHER PARTY MAY BRING ITS CLAIM IN ITS LOCAL SMALL CLAIMS COURT, IF PERMITTED BY THAT SMALL CLAIMS COURT RULES AND IF WITHIN SUCH COURT’S JURISDICTION. ARBITRATION IS DIFFERENT FROM COURT, AND DISCOVERY AND APPEAL RIGHTS MAY ALSO BE LIMITED IN ARBITRATION.
(17.b) All disputes will be resolved before a neutral arbitrator selected jointly by the parties, whose decision will be final, except for a limited right of appeal under the FAA.
18. CLASS ACTION WAIVER
(18.a) You agree that any arbitration or proceeding shall be limited to the Dispute between us and you individually. To the full extent permitted by law, (i) no arbitration or proceeding shall be joined with any other; (ii) there is no right or authority for any Dispute to be arbitrated or resolved on a class action-basis or to utilize class action procedures; and (iii) there is no right or authority for any Dispute to be brought in a purported representative capacity on behalf of the general public or any other persons. YOU AGREE THAT YOU MAY BRING CLAIMS AGAINST US ONLY IN YOUR INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE PROCEEDING.
19. EQUITABLE RELIEF
(19.a) You acknowledge and agree that in the event of a breach or threatened violation of our intellectual property rights and confidential and proprietary information by you, we will suffer irreparable harm and will therefore be entitled to injunctive relief to enforce this Agreement. We may, without waiving any other remedies under this Agreement, seek from any court having jurisdiction any interim, equitable, provisional, or injunctive relief that is necessary to protect our rights and property pending the outcome of the arbitration referenced above. You hereby irrevocably and unconditionally consent to the personal and subject matter jurisdiction of the federal and state courts in the State of Kansas for the purposes of any such action by us.
20. CONTROLLING LAW; EXCLUSIVE FORUM
(20.a) The Agreement and any action related thereto will be governed by the laws of the State of Kansas without regard to its conflict of law’s provisions.
(20.b) The Parties hereby consent and agree to the exclusive jurisdiction of the state and federal courts located in the State of Kansas for all suits, actions, or proceedings directly or indirectly arising out of or relating to this Agreement, and waive any and all objections to such courts, including but not limited to, objections based on improper venue or inconvenient forum, and each party hereby irrevocably submits to the exclusive jurisdiction of such courts in any suits, actions, or proceedings arising out of or relating to this Agreement.
21. MISCELLANEOUS
(21.a) You may not assign any of your rights, duties, or obligations under these Terms of Use to any person or entity, in whole or in part, without written consent from QureNote AI. Our failure to act on or enforce any provision of the Agreement shall not be construed as a waiver of that provision or any other provision in this Agreement. No waiver shall be effective against us unless made in writing, and no such waiver shall be construed as a waiver in any other or subsequent instance.
(21.b) Except as expressly agreed by us and you in writing, the Agreement constitutes the entire agreement between you and us with respect to the subject matter, and supersedes all previous or contemporaneous agreements, whether written or oral, between the parties with respect to the subject matter. The section headings are provided merely for convenience and shall not be given any legal import. This Agreement will inure to the benefit of our successors, assigns, licensees, and sublicensees.
Copyright 2024 QureNote AI. All rights reserved.
SCHEDULE – A
BUSINESS ASSOCIATE AGREEMENT
This Business Associate Agreement (“BAA”) is by and between QureNote AI, Inc. (“Business Associate”), and Customer (“Covered Entity”), and is effective as Effective Date.
WHEREAS, the pursuant to these Terms of Use Business Associate will provide certain services to, for, or on behalf of Covered Entity involving the use or disclosure of Protected Health Information (“PHI”), and pursuant to such Terms of Use, Business Associate may be considered a “business associate” of Covered Entity; and WHEREAS, Covered Entity and Business Associate intend to protect the privacy and provide for the security of PHI disclosed to Business Associate pursuant to the Provider Agreement in compliance with the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 (“HIPAA”) and the Standards for Privacy of Individually Identifiable Health Information promulgated thereunder by the U.S. Department of Health and Human Services at 45 CFR § 160 and § 164 (the “HIPAA Rules”), and the Health Information Technology for Economic and Clinical Health Act of 2009 (the “HITECH Act”), in each case as amended from time to time; and WHEREAS, the purpose of this BAA is to satisfy certain standards and requirements of the HIPAA Rules and the HITECH Act, as the same may be amended from time to time. NOW, THEREFORE, in consideration of the mutual promises below and the exchange of information pursuant to this BAA, the parties agree as follows:
1. Definitions.
Terms used but not otherwise defined in this BAA shall have the same meaning as set forth in 45 CFR Parts 160, 162 and 164, or the HITECH Act.
2. Obligations of Business Associate.
2.1 Permitted Uses and Disclosures:- Business Associate agrees to only Use or Disclose PHI as necessary in order to perform the services set forth in the Provider Agreement, as permitted under this BAA, or as Required by Law. Business Associate shall have the right to de-identify any and all PHI, provided that Business Associate implements a de-identification process that conforms to the requirements of 45 C.F.R. 164.514(a)-(c) (“De-identified Data”). Business Associate may Use or Disclose such De-identified Data to third parties at its discretion, as such De-identified Data does not constitute PHI and is not subject to the terms of this BAA. Business Associate shall own all right, title and interest in and to such De-identified Data.
2.2 Nondisclosure:- Business Associate shall not Use or further Disclose PHI other than as permitted or required by this BAA.
2.3 Safeguards:- Business Associate shall use appropriate safeguards to prevent Use or Disclosure of PHI other than as provided for by this BAA. Business Associate shall maintain a comprehensive written information privacy and security program that includes administrative, technical and physical safeguards appropriate to the size and complexity of the Business Associate’s operations and the nature and scope of its activities.
2.4 Reporting of Disclosures; Mitigation:- Business Associate shall report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which Business Associate becomes aware. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this BAA.
2.5 Business Associate’s Agents:- Business Associate shall ensure that any subcontractors, to whom it provides PHI received from (or created or received by Business Associate on behalf of) Covered Entity agree to the same restrictions and conditions that apply to Business Associate with respect to such PHI.
2.6 Availability of Information to Covered Entity:- Business Associate shall make available to Covered Entity (or, as directed by Covered Entity, to an Individual) such information as Covered Entity may request, and in the time and manner designated by Covered Entity, to fulfill Covered Entity’s obligations (if any) to provide access to, provide a copy of, and account for disclosures with respect to PHI pursuant to HIPAA and the HIPAA Rules, including, but not limited to, 45 CFR §§ 164.524 and 164.528. Requests for information must be submitted at least 14 days in advance of the due date.
2.7 Amendment of PHI:- Business Associate shall make any amendments to PHI in a Designated Record Set that the Covered Entity directs or agrees to at the request of Covered Entity or an Individual, and in the time and manner designated by Covered Entity, to fulfill Covered Entity’s obligations (if any) to amend PHI pursuant to HIPAA and the HIPAA Rules, including, but not limited to, 45 CFR § 164.526, and Business Associate shall, as directed by Covered Entity, incorporate any amendments to PHI into copies of such PHI maintained by Business Associate.
2.8 Internal Practices:- Business Associate shall make its internal practices, books and records relating to the use and disclosure of PHI received from Covered Entity (or created or received by Business Associate on behalf of Covered Entity) available to the Secretary, in a time and manner designated by Covered Entity or the Secretary, for purposes of the Secretary determining Covered Entity’s compliance with HIPAA and the HIPAA Rules.
2.9 Documentation of Disclosures for Accounting:- Business Associate agrees to document such disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528.
2.10 Access to Documentation for Accounting:- Business Associate agrees to provide to Covered Entity or an Individual, in a time and manner designated by Covered Entity, information documented in accordance with Section 2(i) of this BAA in a time and manner as to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528.
2.11 Notification of Breach:- During the Term of this BAA, Business Associate shall notify Covered Entity within ten (10) days of Discovery of any Breach of Unsecured PHI. Business Associate further agrees, consistent with Section 13402 of the HITECH Act, to provide Covered Entity with information necessary for Covered Entity to meet the requirements of said section, and in a manner and format to be specified by Covered Entity.
2.12 Minimum Necessary:- When using, disclosing, or requesting PHI from the Covered Entity, or in accordance with any provision of this BAA, Business Associate shall limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.
3. Obligations of Covered Entity.
3.1 Covered Entity shall be responsible for using appropriate safeguards to maintain and ensure the confidentiality, privacy and security of PHI transmitted to Business Associate pursuant to the BAA and this BAA, in accordance with the standards and requirements of HIPAA and the HIPAA Rules, until such PHI is received by Business Associate.
3.2 Upon request, Covered Entity shall provide Business Associate with the notice of privacy practices that Covered Entity produces in accordance with 45 CFR § 164.520, as well as any changes to such notice.
3.3 Covered Entity shall provide Business Associate with any changes in, or revocation of, permission by an Individual to use or disclose PHI, if such changes affect Business Associate’s permitted or required uses or disclosures.
3.4 Covered Entity shall notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR § 164.522, if such restriction affects Business Associate’s permitted or required uses or disclosures.
4. Term and Termination.
4.1 The Term of this BAA shall become effective as of the Effective Date and shall terminate when all of the PHI provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or, if it is infeasible to return or destroy PHI, protections are extended to such information, in accordance with the termination provisions of this Section. The provisions of this BAA shall survive termination of the BAA to the extent necessary for compliance with HIPAA and the HIPAA Rules.
4.2 Material Breach. A material breach by either party of any provision of this BAA shall constitute a material breach of the BAA, if such breach is not cured by the breaching party within thirty (30) days of receipt of notice describing the material breach.
4.3 Reasonable Steps to Cure Breach. If either party learns of an activity or practice of the other party that constitutes a material breach or violation of the other party’s obligations under the provisions of this BAA, then the non-breaching party shall notify the breaching party of the breach and the breaching party shall take reasonable steps to cure such breach or violation, as applicable, within a period of time which shall in no event exceed thirty (30) days. If the breaching party’s efforts to cure such breach or violation are unsuccessful, the non-breaching party shall either terminate the BAA, if feasible, or if termination of the BAA is not feasible and the breaching party has violated the HIPAA Rules, the non-breaching party may report the breaching party’s breach or violation to the Secretary.
4.4 Judicial or Administrative Proceedings. Either party may terminate the BAA, effective immediately, if the other party is named as a defendant in a criminal proceeding for an alleged violation of HIPAA, or a finding or stipulation that the other party has violated any standard or requirement of HIPAA or other security or privacy laws is made in any administrative or civil proceeding in which the party has been joined.
4.5 Effect of Termination.
(i). Except as provided in paragraph (16.b) of this Section or if required by law or regulation to be maintained by Business Associate, upon termination of the BAA for any reason, Business Associate shall return at Covered Entity’s expense, or destroy all PHI received from Covered Entity (or created or received by Business Associate on behalf of Covered Entity) that Business Associate still maintains in any form, and shall retain no copies of such PHI. This provision shall apply to PHI that is in the possession of subcontractors or agents of Business Associate.
(ii). In the event that Business Associate determines that returning or destroying the PHI is infeasible, Business Associate shall provide to Covered Entity notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the parties that return or destruction of PHI is infeasible, Business Associate shall extend the protections of this BAA to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such PHI. The obligations of Business Associate under this Section shall survive the termination of the BAA.
(iii). Amendment to Comply with Law. The parties acknowledge that state and federal laws relating to electronic data security and privacy are rapidly evolving and that amendment of the BAA may be required to provide for procedures to ensure compliance with such developments. The parties specifically agree to take such action as is necessary to implement the standards and requirements of HIPAA, the HIPAA Rules, the HITECH Act, and other applicable laws relating to the security or confidentiality of PHI. Upon the request of either party, the parties shall promptly enter into negotiations concerning the terms of an amendment to the BAA embodying written assurances consistent with the standards and requirements of HIPAA, the HIPAA Rules, the HITECH Act, or other applicable laws relating to security and privacy of PHI. Either party may terminate the BAA upon thirty (30) days’ written notice in the event the other party does not promptly enter into negotiations to amend the BAA when requested pursuant to this Section, or does not enter into an amendment to the BAA providing assurances regarding the safeguarding of PHI that satisfy the standards and requirements of HIPAA, the HIPAA Rules, the HITECH Act, or any other applicable laws relating to security and privacy of PHI.
(iv) No Third Party Beneficiaries. Nothing in this BAA is intended to confer, nor shall anything herein confer, upon any person other than Covered Entity, Business Associate and their respective successors and assigns, any rights, remedies, obligations or liabilities whatsoever and no other person or entity shall be a third party beneficiary of this BAA.
(v) Effect on BAA. Except as specifically required to implement the purposes of this BAA, or to the extent inconsistent with this BAA, all other terms of the BAA shall remain in full force and effect.
(vi) Interpretation. This BAA shall be interpreted as broadly as necessary to implement and comply with HIPAA, the HIPAA Rules and any other applicable law relating to security and privacy of PHI. Any ambiguity in this BAA shall be resolved in favor of a meaning that permits Covered Entity to comply with the HIPAA Rules.
(vii) Regulatory References. A reference in this BAA to a section in the HIPAA Rules or the HITECH Act means the section as in effect or as amended, and for which compliance is required.
