Every organization that uses Nūr Evoke accepts this Business Associate Agreement before it can enter any client information. It is shown here so you can read it first. The copy accepted inside the application, with your organization's name filled in, is the one that applies.
This Business Associate Agreement ("Agreement") is entered into by and between your organization ("Covered Entity") and Nūr Evoke ("Business Associate"), and is effective as of the date of the Covered Entity's acceptance of this Agreement (the "Effective Date").
1. Purpose and Background
This Agreement governs the Protected Health Information ("PHI") that Covered Entity creates, receives, maintains, or transmits through Business Associate in connection with the services provided by Business Associate (the "Service"). Both parties are committed to complying with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), and their implementing regulations.
2. Definitions
Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in the HIPAA Rules (45 CFR Parts 160 and 164).
3. Obligations and Activities of Business Associate
a) Non-Disclosure: Business Associate agrees to not use or disclose PHI other than as permitted or required by this Agreement or as required by law. Business Associate will not sell PHI or use it for marketing purposes.
b) Safeguards: Business Associate agrees to use appropriate administrative, physical, and technical safeguards to prevent use or disclosure of the PHI other than as provided for by this Agreement. This includes maintaining encryption at rest and in transit, access controls with multi-factor authentication (MFA), audit logging, and utilizing HIPAA-eligible infrastructure.
c) Mitigation: Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Agreement.
d) Reporting: Business Associate agrees to report to Covered Entity any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, including breaches of unsecured PHI as required at 45 CFR 164.410, and any security incident of which it becomes aware. Such reports will be made without unreasonable delay and in no case later than thirty (30) days following the discovery of the breach.
e) Subcontractors: Business Associate ensures that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree in writing to the same restrictions, conditions, and requirements that apply to the Business Associate.
f) Right to Access: Business Associate agrees to make available PHI in a designated record set to the Covered Entity as necessary to satisfy Covered Entity's obligations under 45 CFR 164.524.
g) Amendment: Business Associate agrees to make any amendment(s) to PHI in a designated record set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526.
h) Accounting of Disclosures: Business Associate agrees to maintain and make available the information required to provide an accounting of disclosures to the Covered Entity as necessary to satisfy Covered Entity's obligations under 45 CFR 164.528.
i) HHS Audits: Business Associate agrees to make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of Health and Human Services (HHS) for purposes of determining compliance with the HIPAA Rules.
4. Permitted Uses and Disclosures by Business Associate
a) Service Provision: Business Associate may use or disclose PHI to perform functions, activities, or services for, or on behalf of, Covered Entity as specified in the underlying service agreement.
b) Management and Administration: Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities.
c) Minimum Necessary: Business Associate agrees to limit its uses and disclosures of PHI to the minimum necessary to accomplish the intended purpose.
5. Obligations of Covered Entity
a) Limitations in Notice of Privacy Practices: Covered Entity shall notify Business Associate of any limitation(s) in its notice of privacy practices, to the extent that such limitation may affect Business Associate's use or disclosure of PHI.
b) Notification of Restrictions: Covered Entity shall notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522.
c) Permissible Requests: Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the Privacy Rule if done by Covered Entity.
6. Term and Termination
a) Term: The Term of this Agreement shall be effective as of the Effective Date and shall terminate when all of the PHI provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity.
b) Termination for Cause: Business Associate authorizes termination of this Agreement by Covered Entity, if Covered Entity determines Business Associate has violated a material term of the Agreement and Business Associate has not cured the breach or ended the violation within a reasonable time specified by Covered Entity.
c) Obligations Upon Termination: Upon termination of this Agreement for any reason, Business Associate shall, if feasible, return or destroy all PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity. If such return or destruction is not feasible, Business Associate shall extend the protections of this Agreement to the information and limit further uses and disclosures.
7. Miscellaneous
a) Regulatory References: A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended.
b) Amendment: The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with the requirements of the HIPAA Rules.
c) Interpretation: Any ambiguity in this Agreement shall be interpreted to permit compliance with the HIPAA Rules.
Questions about this agreement: info@nurbhealth.com.