TERMS OF SERVICE
RUBICONMD PLATFORM TERMS OF SERVICE
Effective Date: September 11, 2024
RubiconMD and its affiliates (collectively, “RubiconMD” “we” or “us”) operates a platform that facilitates exchange of information between health care providers (the “Platform”). These Terms of Service (these “Terms”) constitute a binding legal agreement between you and RubiconMD that govern your access to and use of the Platform.
BY AGREEING TO THESE TERMS, YOU:
AFFIRM THAT HAVE READ AND UNDERSTAND THESE TERMS;
AGREE TO BE BOUND BY THESE TERMS WITHOUT LIMITATION OR QUALIFICATION; AND
AFFIRM THAT YOU ARE AT LEAST THE AGE OF LEGAL MAJORITY IN YOUR PLACE OF RESIDENCE AND OTHERWISE LEGALLY COMPETENT TO ENTER INTO CONTRACTS.
If you do not agree to all of these Terms without limitation or qualification, you are not authorized to access and use the Platform, and must not access or make any use of the Platform.
IMPORTANT DISCLAIMERS AND NOTES
(1) You acknowledge and agree that the Platform is provided for information purposes only, as described in the applicable Services Agreement. RubiconMD is not a health care provider, and the Platform does not provide or attempt to provide medical advice, assessments or treatment services.
(2) You represent and warrant that you are a health care provider or personnel of a medical practice who has entered into an agreement for services with RubiconMD or a professional entity that has obtained the right to use the Platform (a “Services Agreement”), and you desire to access and use the Platform (and the content and information provided through the Platform) for purposes of facilitating care to patients of your medical practice.
(3) You agree to access and use the Platform and all data and content accessed through the Platform for permitted purposes under the applicable Services Agreement, and solely as permitted pursuant to the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act provisions of the American Recovery and Reinvestment Act of 2009, Pub. Law No.111-5, and their implementing regulations (as amended from time to time, “HIPAA”).
(4) You acknowledge and agree that these Terms contain provisions that limit our liability to you and dictate terms for dispute resolution. The sections of these Terms entitled “Disclaimer of Warranties”, “Limitations of Liability”, “Waiver of Right to Pursue Class Action Claims”, “Limitation on Time to Bring an Action”, and “Waiver of Jury Trial; Agreement to Arbitrate Claims”, among others, limit our liability to you and require you to resolve any dispute with us through final and binding arbitration on an individual basis and not as part of any class or representative action. Please read these terms carefully.
MODIFICATION OF TERMS
The Effective Date of these Terms is set forth at the top of this page. Please note that we may change or supplement these Terms from time to time. If any such changes materially alter your rights, we will notify you of these changes by either posting notice on the Platform or by sending you an email to the email address we have on file for you. We will not make changes that have a retroactive effect unless we are legally required to do so. You and we both understand that sometimes there are issues with email communication. We are not responsible if any email notice gets caught by your SPAM filter and you do not see it, if you have given us the wrong email address (or failed to update your address) or if there are other communications issues that prevent email from reaching you. Therefore, we encourage you to frequently visit this page to monitor any changes. Your continued use of or access to the Platform following the posting of any changes to these Terms constitutes acceptance of those changes.
If you disagree with any changes to these Terms, you should terminate your use of the Platform. Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the amended Terms. The amended Terms supersede all previous versions of or agreements, notices or statements about the Terms.
Our Privacy Policy contains information about how we collect, use, protect and share your personal information (i.e., information that can be used to identify, contact or locate you) and other information collected by us in connection with your use of the Platform. Our use and disclosure of protected health information or “PHI” (as that term is defined under 45 C.F.R. § 160.103) will be governed by the business associate agreement we have executed with you or your medical practice, as applicable.
ELECTRONIC COMMUNICATIONS
When you use the Platform, you are communicating with us electronically, and you consent to receiving communications from us electronically, including messages posted to your account. You acknowledge and agree that all agreements, notices, disclosures, and other communications that we provide to you electronically satisfy any legal requirement that the same be in writing.
USE OF THE PLATFORM
The following rules apply to your use of the Platform:
▪ You will only use the Platform as expressly authorized in these Terms.
▪ You must be at least 18 years of age to use the Platform.
▪ You may use the Platform solely for purposes permitted under the Applicable Services Agreement.
▪ You will not share your login information (username, password, and/or touch ID) with any other person. Only you will access the Platform through your login information.
▪ You may not use the Platform to send unsolicited messages (also known as junk mail or SPAM) or messages that do not correctly identify the sender or alter the attribution of origin in electronic mail messages or postings.
▪ You will not access the Platform through automated methods.
▪ You are fully responsible for all uses of the Platform by anyone accessing the Platform using your access credentials. This includes access by any person that has obtained your access credentials through your failure to use appropriate measures to safeguard your use ID or password.
▪ You must immediately notify us in the event that (i) your password is lost or stolen or (ii) you become aware of any unauthorized use of your username and password or other breach of security that might affect the Platform or any Platform Content.
▪ You agree to provide us with accurate and truthful information during the registration process and you will update us if that information changes.
▪ You agree that all information you provide through the Platform is accurate and complete to the best of your knowledge.
▪ You understand and agree that other health care providers with whom you engage on the Platform are not our employees or agents.
▪ You must not imply or state, directly or indirectly, that you are affiliated with or endorsed by us.
▪ You agree that you will use the Platform only in a manner that complies with all HIPAA, federal, and state privacy and security laws and requirements and with the Business Associate Agreement entered into by and between us and you. In accordance with HIPAA, if the data or other information you input into the Platform (“Your Content”) includes PHI, you will provide only the minimum necessary PHI and only for permitted uses and disclosures, pursuant to 45 C.F.R. § 164.502. You will only input PHI into fields specifically designated as PHI- permitted fields on the Platform.
▪ If you receive or provide any PHI or other patient identifiable information through the Platform in violation of HIPAA or any other federal or state privacy or security laws, you will immediately notify us, and you will immediately return or securely destroy all such information.
▪ You represent and warrant that (i) you are legally authorized to provide Your Content, (ii) Your Content does not infringe, violate or misappropriate the rights (including rights of privacy and publicity and intellectual property rights) of any person or entity, and (iii) Your Content is not pornographic, violent, illegal, infringing of other people’s rights, slanderous or libelous. You acknowledge and agree that we reserve the right to remove any of Your Content that we determine is objectionable in our sole discretion.
▪ You must not remove, circumvent, disable, damage, or otherwise interfere with any: (i) security-related features of the Platform; (ii) features of the Platform that prevent or restrict use or copying of any content accessible through the Platform; or (iii) features of the Platform that enforce limitations on use of the Platform.
▪ You must not intentionally interfere with or damage operation of the Platform, or any other users’ enjoyment of them, by any means, including uploading or otherwise disseminating viruses, worms, or other malicious code.
▪ You must not attempt to gain unauthorized access to the Platform, other accounts, computer systems or networks connected to the Platform, or any part of it, through hacking, password mining or other improper or illegal means. You must not access or attempt to access other users’ accounts.
▪ You must not use any robot, spider, scraper, or other automated means to access the Platform for any purpose without our express prior written permission, or bypass our robot exclusion headers or other measures we may use to prevent or restrict access to the Platform, or modify the Platform in any manner or form.
▪ You must not make any use of the Platform or Platform Content that violates these Terms or any applicable law, including but not limited to the Stark Law and the Anti-Kickback Statute.
You understand that the Platform does not provide medical advice. You understand that we are not a health care provider, nor are we providing medical advice, diagnosis, or treatment services via the Platform. We provide the Platform solely for informational purposes to facilitate health care to your Patients. You are solely responsible for ensuring appropriate use of any information you obtain through the Platform in accordance with your professional medical judgement and applicable law.
We may make changes to or discontinue any aspect or feature of the Platform at any time without prior notice. You agree that we shall not be liable to you or any third party for any modification, suspension or discontinuance of any feature or component of the Platform.
BUYNOW eCONSULT SUBMISSION LIMIT
Each User may submit a maximum of four (4) eConsults per month. You understand that each User within Your organization should purchase an individual license to submit eConsults.
We reserve the right to increase or decrease the number of eConsults allowable per month in our sole discretion. We will provide thirty (30) days written notice of any such change.
BUYNOW FEES AND REFUNDS
We reserve the right to increase or decrease the cost of submitting an eConsult at any time in our sole discretion. We will provide thirty (30) days written notice of any such change.
There are no refunds for payment for use of the BuyNow Platform. If You Purchase 12 months of access to the BuyNow Platform you will continue to maintain access to the Platform until the end of your 12 month term.
OWNERSHIP OF THE PLATFORM AND PLATFORM CONTENT
As between you and us, we and/or our third party providers own the Platform and all information and data (excluding Your Content), text, photographs, audio, video and other materials and content available through the Platform (collectively, “Platform Content”), and you are granted only a limited right to use the Platform and Platform Content for purposes of facilitating health care to your Patients. We and our licensors exclusively own all rights, title and interests (including all intellectual property rights) in and to the Platform, Platform Content and all components thereof. We grant you a limited, non-exclusive, non-transferable right and license to access and use the Platform, solely for your personal, non-commercial use.
Except for the limited license granted to you as provided above or as otherwise expressly provided in these Terms, we reserve all other rights. We may revoke this license at any time for any reason without any further obligation to you. You may not (nor may you permit others to):
▪ copy, modify, create derivative works of, display, perform, distribute, transmit, download, upload, post, sell, rent, sublicense, transfer, or disclose any aspect of the Platform or any Platform Content, in whole or in part, in any form or by any means;
▪ mirror, frame, reverse engineer, reverse assemble, decompile or otherwise attempt to discover any source code or trade secrets within the Platform;
▪ use any metatags or any other “hidden text” utilizing the name “RubiconMD” without our prior written permission, in our sole discretion
As between you and us, you always remain the sole owner of Your Content. You agree that we may use Your Content for the purposes for which you provided it. The primary use of Your Content is to display it on the Platform for the purposes for which you provided it (e.g., seeking or providing feedback), and you grant us a nonexclusive right to use, store, display, perform and distribute Your Content for that purpose. We may also use Your Content to review performance, quality and effectiveness of the Platform, to perform data analysis, and we may take screen shots or frame certain areas of the Site for marketing and promotional purposes, and you agree that we and our service providers may use Your Content in this way. We also retain full ownership rights over any PHI de-identified in accordance with HIPAA. You are solely responsible for Your Content, including but not limited to the accuracy and reliability of the information provided on the Platform by you or any of your or your organization’s authorized Drafters. You agree that you will pay and indemnify us for all losses, liabilities, damages costs and expenses (including attorney’s fees and expenses) that we may incur in connection with any claim or allegation relating to Your Content. We are not responsible for storing or backing up Your Content. We are not responsible if Your Content is lost for any reason.
We are not obligated to monitor access or use of the Platform, Platform Content or Your Content or to review or edit the same, but we have the right to do so for the purpose of operating the Platform, ensuring compliance with these Terms and to comply with applicable law or other legal requirements. We reserve the right to monitor your use of the Platform at any time (with or without notice to you) to verify compliance with these Terms and/or any applicable law and to investigate, and cooperate with enforcement agencies in the investigation of, any suspected or alleged misuse of the Platform. We may refuse to post or remove any User Content that we determine violates these terms or is otherwise objectionable in our sole discretion and without liability to you.
All trademarks, trade names and logos appearing on or through the Platform (the “RubiconMD Trademarks”) are owned by us or licensed by us. You may not use or display any RubiconMD Trademarks in any manner without our prior written permission. We reserve all rights.
If you choose to provide us with any comments, suggestions, ideas or other feedback, you agree that we have an unrestricted right to use it, and you are not entitled to receive any compensation.
PLATFORM ACCESS AND UPDATES
We do not guarantee that the Platform or any aspect of the Platform is compatible with your operating system, browser, mobile device, or other software or equipment. If you access and use the Platform on a mobile device (for example, a tablet or smartphone), you must have wireless service through Wi-Fi or a participating wireless service provider and a compatible mobile device. You are responsible for all charges (including data and messaging charges) relating to use of the Platform through your mobile device. By using the Platform, you understand that certain information about your usage of the Platform may be communicated to us.
RubiconMD may, but is not obligated to, from time to time, in its sole discretion, develop and provide updates for our software, which may include upgrades, bug fixes, patches and other error corrections and/or new features (collectively, “Updates”). Updates may also modify or delete in their entirety certain features and functionality. You agree that RubiconMD has no obligation to provide any Updates or to continue to provide or enable any particular features or functionality.
LINKS TO THIRD PARTY SITES & SERVICES
The Platform may contain links to third party websites, products and/or services (“Linked Third Party Sites”). Such links do not constitute or imply RubiconMD’s approval, sponsorship or endorsement of any Linked Third Party Sites. RubiconMD is not responsible for and makes no representations or warranties, express or implied, regarding any Linked Third Party Sites. You access and use Linked Third Party Sites solely at your own risk. When you access and use a Linked Third Party Sites, you are subject to the terms and conditions of use and privacy policy for such Linked Third Party Sites. Any rights, claims or actions you may have in respect of a Linked Third Party Site can only be brought directly against the provider of that Linked Third Party Site.
TERMINATION
Either you or we may terminate your access to the Platform at any time, with or without cause. If you wish to terminate your account, you may do by emailing us at info@rubiconmd.com. It may take up to 3 business days before cancellation will take effect. We may terminate your right to use the Platform at any time by providing you with notice through the e-mail address we have on file at the time. We may deactivate, terminate or suspend your account or access to the Platform at any time: (a) if we, in our sole discretion, determine that you are or have been in violation of these Terms; (b) if we, in our sole discretion, determine that you have created risk or possible legal exposure for RubiconMD; (c) in response to requests by law enforcement or other government agencies; (d) upon discontinuance or material modification of the Platform, (f) upon the termination of the applicable Service Agreement; or (e) due to unexpected technical issues or problems.
Termination will not limit any of our other rights or remedies. Any provision that must survive in order to give proper effect to the intent and purpose of these Terms shall survive termination.
Termination of our relationship will terminate any rights and license we have provided to you in these Terms. In such event, you must immediately discontinue using the Platform. Any sections of these Terms which by their nature survive termination, will survive.
We have no obligation to store any of Your Content after termination. You agree that we will not have any obligation to store Your Content after termination of your account, and we shall have the right to permanently delete Your Content.
DISCLAIMER OF WARRANTIES
You understand and agree that we do not provide any warranties with respect to the Platform. THE PLATFORM (INCLUDING ALL PLATFORM CONTENT) IS PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS. TO THE FULLEST EXTENT PERMISSIBLE UNDER THE LAW, WE EXPRESSLY DISCLAIM ALL WARRANTIES, REPRESENTATIONS AND GUARANTEES OF ANY KIND, WHETHER ORAL OR WRITTEN, EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, INCLUDING, BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. You understand that we do not guarantee any particular response time but will use reasonable efforts to select a Consultant that will answer questions in a timely manner.
LIMITATIONS OF LIABILITY
RubiconMD’s liability to you is limited as set forth below. The limitations of liability will survive any termination or expiration of these terms.
YOU EXPRESSLY UNDERSTAND AND AGREE THAT, TO THE FULLEST EXTENT PERMITTED BY LAW, WE AS WELL AS OUR LICENSORS AND CONSULTANTS, ARE NOT LIABLE (UNDER ANY LEGAL THEORY, WHETHER IN CONTRACT, TORT, STRICT LIABILITY OR OTHERWISE) FOR ANY DIRECT, INDIRECT, INCIDENTAL, RELIANCE, SPECIAL, CONSEQUENTIAL OR EXEMPLARY DAMAGES, INCLUDING BUT NOT LIMITED TO, LOST PROFITS, LOSS OF DATA, LOSS OF USE, OR DAMAGE TO REAL, TANGIBLE OR INTANGIBLE PROPERTY. IN ADDITION, YOU AGREE THAT IN EVENT THAT ANY OF THE FOREGOING LIMITATIONS ARE NOT PERMITTED BY LAW, IN NO EVENT WILL WE OR OUR LICENSORS OR CONSULTANTS BE LIABLE FOR DIRECT DAMAGES, IN THE AGGREGATE, IN EXCESS OF THE GREATER OF (i) AMOUNTS PAID BY YOU OR PAYABLE TO YOU FOR USE OF THE PLATFORM IN THE PREVIOUS THREE MONTHS OR (i) TEN U.S. DOLLARS ($10.00).
If you have a dispute with another Platform user, that dispute is between you and that user. Even if we help facilitate resolution of the dispute, we are not responsible for the dispute and do not have any liability related to the dispute. You hereby release us from any and all claims, demands and damages (actual and consequential) of every kind and nature, known and unknown, arising out of or in any way connected with such disputes.
IF YOU ARE A CALIFORNIA RESIDENT, YOU WAIVE YOUR RIGHTS WITH RESPECT TO CALIFORNIA CIVIL CODE SECTION 1542, WHICH SAYS “A GENERAL RELEASE DOES NOT EXTEND TO CLAIMS WHICH THE CREDITOR DOES NOT KNOW OR SUSPECT TO EXIST IN HIS FAVOR AT THE TIME OF EXECUTING THE RELEASE, WHICH, IF KNOWN BY HIM MUST HAVE MATERIALLY AFFECTED HIS SETTLEMENT WITH THE DEBTOR.”
You acknowledge and agree that the above limitations of liability, together with the other provisions in these Terms that limit liability, are essential terms and that RubiconMD would not be willing to grant you the rights set forth in these Terms but for your agreement to the above limitations of liability.
USER INDEMNITY
You are responsible for your actions; you agree you will pay and indemnify us for all losses, liabilities, damages costs and expenses (including attorney’s fees and expenses) that we may incur based on your breach of these Terms or any other action or inaction by you. If we (or any of our employees, directors, agents or affiliates, or any Users) get sued or any other claim is made against us (or them) related to anything you do (including any breach by you of these Terms), you agree that you will you will defend us against the suit or claim if we request it.
GOVERNING LAW
These Terms shall be governed by, and construed in accordance with, the substantive laws of the State of New York without regard to the choice of law provisions of any jurisdiction. The United Nations Convention on Contracts for the International Sale of Goods does not apply to these Terms.
WAIVER OF RIGHT TO PURSUE CLASS ACTION CLAIMS.
You agree to only resolve disputes with us on an individual basis, and waive any right to pursue any claims on a class or consolidated basis or in a representative capacity.
LIMITATION ON TIME TO BRING AN ACTION.
You agree that regardless of any statute or law to the contrary, any claim or cause of action arising out of or related to the Platform brought by you must be filed within one (1) year after such claim or cause of action arose or such claim or cause of action will be forever barred.
WAIVER OF JURY TRIAL; AGREEMENT TO ARBITRATE CLAIMS.
By agreeing to these Terms, both you and we are waiving the right to a jury trial on any disputes that may arise.
You agree to arbitrate all disputes between you and us. If a dispute arises between you and us relating to the Platform or these Terms, you and we agree that the dispute shall be resolved by final and binding arbitration administered by the American Arbitration Association under its rules for consumer arbitrations (“AAA Rules”). You and we agree to the following rules relating to any arbitration proceeding:
YOU AND RUBICONMD WAIVE ANY RIGHT TO BRING SUCH CLAIMS BEFORE ANY COURT OF LAW. RIGHTS THAT YOU WOULD HAVE IF YOU WENT TO COURT, SUCH AS ACCESS TO DISCOVERY, MAY BE UNAVAILABLE OR LIMITED IN ARBITRATION.
The venue for all disputes arising under these Terms shall be in New York, New York but you and we may agree to conduct the arbitration by telephone, online and/or solely based on written submissions. You hereby waive any right to claim that such location is an inconvenient forum and covenant not to sue us in any other forum.
The arbitrator will have the power to grant whatever relief would be available in court under law or in equity (including attorney’s fees) and any award of the arbitrator will be final and binding on each of the parties.
The arbitrator will apply applicable law and the provisions of these Terms and the failure to do so will be deemed an excess of arbitral authority and grounds for judicial review.
Any judgment on the award rendered by the arbitrator may be entered in any court of competent jurisdiction.
You and we agree, to the extent practicable, to direct the arbitrator issue a decision within 120 days from the date the arbitrator is appointed. You and we acknowledge that if the arbitrator does not issue a decision within 120 days, such event will not limit or waive the powers of the arbitrator or this agreement to arbitrate.
All arbitration proceedings will be closed to the public and confidential and all records relating thereto will be permanently sealed, except as necessary to obtain court confirmation of the arbitration award.
The award of the arbitrator will be in writing and will not include any statement setting forth the reasons for the disposition of any claim.
Either you or we may seek an injunction at any time from any court of competent jurisdiction as necessary to protect the rights or property of you or us pending the completion of arbitration.
Payment of all filing, administration and arbitrator fees will be governed by the AAA Rules. If, however, you are able to demonstrate that the costs of arbitration will be prohibitive for you as compared to the costs of litigation, RubiconMD will pay as much of the filing, administration and arbitrator fees as the arbitrator deems necessary to prevent the arbitration from being cost-prohibitive for you. If the arbitrator determines that the claim(s) you assert in the arbitration are frivolous, you agree to reimburse RubiconMD for all fees associated with the arbitration that RubiconMD paid on your behalf which you otherwise would be obligated to pay under the AAA Rules.
INTERNATIONAL USE
The Platform is intended for use in the United States of America only. If you visit the Platform or contact us from outside of the United States of America, please be advised that (i) any information you provide to us or that we automatically collect will be transferred to the United States of America; and (ii) that by using our Platform or submitting information, you explicitly authorize its transfer to and subsequent processing in the United States of America in accordance with these Terms.
GENERAL LEGAL TERMS
▪ Violations of Terms. Please report violations of these Terms by sending an e-mail to info@rubiconmd.com.
▪ Assignment. These Terms inure to the benefit of and will be binding upon our and your permitted successors and assigns. You must not transfer any of your rights or obligations under these Terms to anyone else without our prior written consent. All of our rights and obligations under these Terms are freely assignable by us.
▪ Notice. RubiconMD may provide you with notices, including those regarding changes to the Terms, by postings on the Platform. You agree that we may also send you notice via email to the email address you have provided, and we are not responsible for your failure to receive notice if email is quarantined by your email security system (e.g., “junk” or “spam” folder) or if you fail to update your email address.
▪ Amendment. Except as described in the section entitled Modification of Terms, these Terms may not be amended unless in writing and signed by you and us
▪ Waiver. Our failure to exercise or enforce any right or provision of these Terms shall not constitute a waiver of such right or provision. Waivers are effective only if in writing and signed by us.
▪ Severability. If any provision of these Terms is found by a court of competent jurisdiction to be invalid, such provision will be limited or eliminated to the minimum extent necessary, and the other provisions of these Terms remain in full force and effect.
▪ Independent Contractor. You agree that no joint venture, partnership, employment, or agency relationship exists between you and RubiconMD as a result of the Terms or use of the Platform.
▪ Headings. The heading references herein are for convenience purposes only, do not constitute a part of the Terms, and shall not be deemed to limit or affect any of the provisions hereof.
▪ Form of Agreement. A printed version of these Terms and of any related notice given in electronic form shall be admissible in arbitral, judicial or administrative proceedings based upon or relating to these Terms to the same extent and subject to the same conditions as other business documents and records originally generated and maintained in printed form.
Questions and Comments
If you have a question or comment regarding the Platform, please contact us via email at info@rubiconmd.com. Your input is valuable to us.
BUSINESS ASSOCIATE AGREEMENT
I. INTRODUCTION.
This Client BUSINESS ASSOCIATE AGREEMENT (“Agreement”) is by and between RubiconMD, Inc., with legal notice to: c/o CT Corporation System, 28 Liberty Street, New York, NY 10005 (“BUSINESS ASSOCIATE”) and the party clicking through to accept this Agreement (“Client,” and together with Business Associate, the “Parties”), and constitutes a binding agreement among the Parties. By accepting this Agreement, Client agrees to be bound by the terms of this Agreement. This Agreement shall be effective on the date on which Client clicks through to accept this Agreement (the “Effective Date”).
If an individual is entering into this Agreement on behalf of a company, organization or another legal entity (an “Entity”), such individual is agreeing to this Agreement for that Entity and representing to Company that such individual has the authority to bind such Entity and its affiliates to these Terms, in which case the term “Client” as used herein will refer to such Entity and its affiliates.
II. RECITALS.
A. Pursuant to a separate written agreement (“Terms of Service”), Business Associate engaged Client to provide certain services on its behalf and/or on behalf of one or more Covered Entities, as defined below. In connection with Client providing services to Business Associate, Client may, on behalf of Business Associate, create, receive, maintain, or transmit certain Protected Health Information or “PHI”, as defined below, of such Covered Entities.
B. Business Associate is contractually obligated to the Covered Entities to protect and secure any PHI that Business Associate receives from or on behalf of the Covered Entities in accordance with HIPAA, as defined herein.
C. Business Associate and Client intend to protect the privacy and provide for the security of PHI disclosed pursuant to this Agreement in compliance with the Health Insurance Portability and Accountability Act of 1996, Subtitle D of the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”), and regulations and other guidance promulgated under both laws by the U.S. Department of Health and Human Services (collectively, “HIPAA”), as well as other applicable federal and state laws.
D. The purpose of this Agreement is to satisfy certain standards and requirements of HIPAA including, but not limited to, 45 C.F.R. §§ 164.308(b), 164.314(a), 164.502(e) and 164.504(e).
NOW THEREFORE, in consideration of the mutual promises below and the exchange of information pursuant to this Agreement, the parties agree as follows:
III. DEFINITIONS.
A. “Covered Entity” shall mean a covered entity, as that term is defined at 45 C.F.R.
§ 160.103, with respect to whom Business Associate meets the definition of business associate set forth in 45 C.F.R. § 160.103.
B. “ePHI” shall have the meaning given to the term “electronic protected health information” under the Security Rule at 45 C.F.R. § 160.103, as applied to the information created, received, maintained, or transmitted by Client from or on behalf of Business Associate.
C. “Individual” shall have the meaning given to such term under the Privacy Rule, including, but not limited to, 45 C.F.R. § 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 C.F.R. § 164.502(g).
D. “Privacy Rule” shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 C.F.R. Part 160 and Part 164, Subparts A and E.
E. “Protected Health Information” or “PHI” shall have the meaning given to such term under the Privacy Rule, including, but not limited to, 45 C.F.R. § 160.103, as applied to the information created, received, maintained, or transmitted by Client from or on behalf of Business Associate.
F. “Secretary” shall mean the Secretary of the U.S. Department of Health and Human Services or his or her designee.
G. “Security Rule” shall mean the Security Standards for the Protection of Electronic Protected Health Information at 45 C.F.R. Part 160 and Part 164, Subparts A and C.
H. “Subcontractor” shall have the meaning given to the term “subcontractor” at 45
C.F.R. § 160.103.
I. Any other capitalized terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in HIPAA. Any inconsistency in the definition of a capitalized term shall be resolved in favor of a meaning that permits compliance with HIPAA.
IV. PERMITTED USES AND DISCLOSURES OF PHI.
Except as otherwise limited in this Agreement, Client may do any or all of the following:
A. Use or Disclosure Under this Agreement. Use or disclose PHI to perform functions, activities, or services pursuant to the Terms of Service for, or on behalf of, Business Associate in its capacity as a business associate (as that term is defined at 45 C.F.R. § 160.103), provided that such use or disclosure would not violate the Privacy Rule or any applicable state law if done by a Covered Entity. Notwithstanding the above, Client may use and disclose PHI for the purposes identified in paragraphs (B), (C), and (E) of this Section IV.
B. Use for Administration/Legal Responsibilities. Client may use PHI, but only to the minimum extent necessary, for the proper management and administration of Client or to carry out the legal responsibilities of Client.
C. Disclosure for Administration/Legal Responsibilities. Client may disclose PHI, but only to the minimum extent necessary, for the proper management and administration of Client or to carry out the legal responsibilities of Client, provided that:
- The disclosures are Required by Law; or
- Client obtains reasonable assurances from the agent, person, or other entity, including a Subcontractor, to whom the PHI is disclosed that it shall remain confidential and shall be used or further disclosed only as Required by Law or for the purpose for which it was disclosed to the agent, person, or other entity, including a Subcontractor (which purpose must be consistent with the limitations imposed upon Client pursuant to this Agreement), and that the agent, person, or other entity, including a Subcontractor, agrees to promptly notify Client of any instances of which it is aware in which the confidentiality of the information has been breached.
D. Use for Reporting of Violations. Use PHI to report violations of law to appropriate federal, state, and local authorities, consistent with 45 C.F.R. § 164.502(j).
V. OBLIGATIONS AND ACTIVITIES OF Client.
A. Limited by this Agreement and Law. Client may not use or disclose PHI other than as permitted or required by this Agreement or as Required by Law.
B. Compliance with HIPAA. To the extent that Client, pursuant to this Agreement, is responsible for carrying out an obligation of a Covered Entity under HIPAA, Client shall comply with the requirements of HIPAA that apply to the Covered Entity in the performance of such obligation.
C. Appropriate Safeguards. Client shall use appropriate administrative, physical, and technical safeguards and, where applicable, comply with the Security Rule, to prevent use or disclosure of PHI other than as provided for by this Agreement.
D. Reporting of Improper Use or Disclosure, Breach of Unsecured PHI, or Security Incident. Client shall report within twenty-four (24) hours to Business Associate (1) any use, access, acquisition or disclosure of PHI not provided for by this Agreement of which it becomes aware and (2) any Security Incident of which it becomes aware, including, with respect to (1) and (2), Breaches of Unsecured PHI (“Breaches”) as required by 45 C.F.R. § 164.410. With respect to (1), Client shall report the use or disclosure even if it determines that the disclosure does not constitute a Breach. All such reports shall be made to Business Associate without unreasonable delay after becoming aware of such issue(s), and in any event not to exceed twenty-four (24) hours following a Discovery of a Breach. In the case of a Breach, Client shall provide Business Associate with the information required pursuant to 45 C.F.R. § 164.410(c) and shall reimburse Business Associate for all costs, expenses and damages (including reasonable attorney’s fees) associated with any notification process required under HITECH or state breach notification laws.
In the event of any inadvertent disclosure of PHI by Business Associate to Client that is not required for Client to provide services in accordance with the Terms of Service, Client shall report such disclosure within twenty-four (24) hours to Business Associate, and shall immediately return or destroy all such PHI in accordance with HIPAA.
E. Subcontractors. Client may not subcontract any services that require it to disclose PHI that it has received by or on behalf of Business Associate or the Covered Entity unless authorized in the Terms of Service or this Agreement. If Client does disclose PHI to a Subcontractor or allows a Subcontractor to create, receive, maintain, or transmit PHI or ePHI on its behalf, Client must, in accordance with 45 C.F.R. §§ 164.308(b)(2) and 164.502(e)(1)(ii), ensure that such Subcontractor agrees to the same restrictions, conditions, and requirements that apply to Client with respect to such information by entering into a written arrangement with Subcontractor that complies with 45 C.F.R. §§ 164.314(a) and 164.504(e). If Client becomes aware of a pattern of activity or practice of a Subcontractor that would constitute a material breach or violation of the written agreement between Client and Subcontractor, Client shall (1) take reasonable steps to cure such breach or end the violation, as applicable, or terminate such written agreement with such Subcontractor, and (2) promptly report such material breach or violation by the Subcontractor to Business Associate in writing.
F. Access to PHI. To the extent that Client maintains PHI in a Designated Record Set, Client shall provide access to such PHI to Business Associate within five (5) business days of a request.
G. Amendment of PHI. To the extent that Client maintains PHI in a Designated Record Set, Client shall make any amendment(s) to such PHI within five (5) business days of a request.
H. Accounting of Disclosures. Client shall provide to Business Associate an accounting of the disclosures of an Individual’s PHI within five (5) business days of a request and as necessary to satisfy the Business Associate’s and Covered Entity’s obligations under 45 C.F.R. 164.528.
I. Access to Records. Client shall make its internal policies and practices, books and records relating to the use and disclosure of PHI that is received from, or created or received by Client on behalf of, Business Associate available to Business Associate and/or the Secretary for purposes of determining compliance with HIPAA.
J. Mitigation. Client agrees to mitigate, to the extent practicable and required by law, any harmful effect that is known to Client of a use or disclosure of PHI by Client (or by any other person to whom Client has disclosed PHI) in violation of the requirements of this Agreement.
K. Minimum Necessary. Client agrees that it shall comply with HIPAA’s minimum necessary requirements. To the extent practicable, Client shall limit a request, use or disclosure of PHI to a Limited Data Set.
L. Documentation. All documentation that is required by this Agreement and HIPAA shall be retained by Client for six (6) years from the date of creation or when it was last in effect, whichever is later.
M. De-identified Information. Client is not permitted to de-identify PHI and use it for its own purposes, unless specified by Business Associate in writing or if specifically required or permitted under the Terms of Service.
VI. TERM AND TERMINATION.
A. Term. The term of this Agreement shall commence as of the effective date of this Agreement, and shall continue in full force and effect from year to year, but shall terminate as of the earliest occurrence of any of the following:
- The Terms of Service is terminated;
- This Agreement is terminated for cause as described in paragraph (B) below;
- The parties mutually agree to terminate this Agreement; or
- This Agreement is terminated under applicable federal, state, or local law.
B. Termination for Cause. Upon Business Associate’s determination of a breach of a material term of this Agreement by Client, Business Associate shall provide Client written notice of that breach and afford Client an opportunity to cure the breach; provided, however, that if Client fails to cure the breach within five (5) days of receipt of such notice, Business Associate may terminate this Agreement. Client agrees and acknowledges that Business Associate has the right, in its sole discretion, to report the breach to the Secretary.
C. Effect of Termination
- Upon termination of this Agreement for any reason, Client shall return or destroy all PHI received from, or created, received, maintained, or transmitted by Client on behalf of, Business Associate that Client still maintains in any form, as well as the documentation required by 45 C.F.R. § 164.530(j)(1) (all of which shall be collectively referred to as PHI for purposes of this Section VI.C.). Client shall retain no copies of such PHI.
- Notwithstanding the foregoing, if Business Associate determines that return or destruction of all PHI is not feasible, Client shall:
(i) Retain only that PHI that is necessary for Client to continue its proper management and administration or to carry out its legal responsibilities;
(ii) Return to Business Associate or destroy the remaining PHI that Client still maintains in any form;
(iii) Extend the protections of this Agreement to any retained PHI, continue to use appropriate safeguards, and comply with the Security Rule with respect to ePHI in order to prevent use or disclosure of the retained PHI other than as provided for in this Section VII.C.(2), for as long as Client retains the PHI;
(iv) Not use or disclose the PHI retained by Client other than for the purposes for which such PHI was retained and subject to the same conditions set forth in Sections IV.B. and IV.C. of this Agreement that applied prior to termination; and
(v) Return to Business Associate or destroy the PHI retained by Client when it is no longer needed by Client for its proper management and administration or to carry out its legal responsibilities. - These provisions shall apply to PHI that is in the possession of subcontractors or agents of Client.
- Any PHI that Client destroys shall be destroyed in accordance with HIPAA.
VII. MISCELLANEOUS.
A. Regulatory References. A reference in this Agreement to a section in HIPAA means the section as in effect or as amended at the time this Agreement is executed or amended.
B. Amendment; No Waiver. Upon the effective date of any federal statute amending or expanding HIPAA, any guidance or temporary, interim final or final regulations promulgated under HIPAA, or under any federal statute amending or expanding HIPAA (collectively, the “HIPAA Regulations”) that are applicable to this Agreement or any amendments to the HIPAA Regulations, this Agreement shall be automatically amended, such that the obligations imposed on Business Associate and Client shall remain in compliance with such requirements, unless the parties agree by mutual consent. Except as provided otherwise in this paragraph (B), no waiver, change, modification, or amendment of any provision of this Agreement shall be made unless it is in writing and is signed by the parties hereto. The failure of either party at any time to insist upon strict performance of any condition, promise, agreement, or understanding set forth herein shall not be construed as a waiver or relinquishment of the right to insist upon strict performance of the same condition, promise, agreement, or understanding at a future time.
C. Survival. All of the respective rights and obligations of Client under Section V.L. (Documentation) and Section VI.C. (Effect of Termination) of this Agreement shall survive the termination of this Agreement.
D. Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits compliance with HIPAA. The titles and headings set forth at the beginning of each section hereof are inserted for convenience of reference only and shall in no way be construed as a part of this Agreement or as a limitation on the scope of the particular provision to which it refers. In the event of an inconsistency between the provisions of this Agreement and the mandatory terms of HIPAA, as may be expressly amended from time-to-time by the Secretary, or as a result of interpretations by the Secretary, a court, or another regulatory agency with authority over the parties, the interpretation of the Secretary, such court, or regulatory agency shall prevail.
E. Indemnification. Client shall indemnify and hold Business Associate harmless from all claims, damages, liabilities, judgments and costs, including reasonable attorneys’ fees, which Business Associate may incur in connection with the performance or breach of Client’s responsibilities, obligations, warranties, and representations contained in this Agreement. This provision shall survive the termination or expiration of this Agreement and the completion or earlier termination of the Services.
F. Entire Agreement. This Agreement sets forth the entire understanding between the parties and supersedes any previous or contemporaneous understandings, commitments, representations, warranties, or agreements, written or oral, regarding the subject matter hereof. No representations, agreements, or understandings of any kind, either written or oral, except as set forth or incorporated by reference into this Agreement, have been relied upon in entering into this Agreement, nor shall any such representations, agreements, or understandings be binding upon the parties unless expressly contained herein or therein.
G. Relationship of Parties. The parties to this Agreement are independent contractors. None of the provisions of this Agreement are intended to create, nor shall they be interpreted or construed to create, any relationship between Business Associate and Client other than that of independent contractors. Except as otherwise expressly set forth herein, neither party, nor any of its representatives, shall be deemed to be the agent, employee, or representative of the other party.
H. No Third-Party Beneficiaries. This Agreement is between the parties hereto. Nothing express or implied in this Agreement is intended to confer, nor shall anything herein confer, any rights, remedies, obligations, or liabilities whatsoever upon any person other than Business Associate and Client and any respective successors and assigns.
I. Invalid or Unenforceable Provision. The provisions of this Agreement shall be severable. The invalidity or unenforceability of any particular provision or portion of such provision of this Agreement shall be construed, in all respects, as if such invalid or unenforceable provision or portion of such provision had been omitted, and shall not affect the validity and enforceability of the other provisions hereof or portions of that provision.
J. Nonassignability, Benefits and Burdens. Neither party may assign its rights, or delegate its duties or obligations, under this Agreement without the prior written consent of the other party, which consent shall not be unreasonably withheld. This Agreement shall be binding upon, and shall inure to the benefit of, the parties hereto and their respective successors.
K. Applicable Law. Except to the extent preempted by applicable federal law, all questions concerning the construction, validity, and interpretation of this Agreement, or the rights and obligations of the parties arising under or relating to this Agreement or the subject matter hereof, shall be governed by the laws of New York.
L. Notices. All notices under this Agreement shall be in writing and shall be deemed given when personally delivered, or three days after being sent by prepaid certified or registered U.S. mail to the address of the party to be noticed as set forth herein or to such other address as such party last provided to the other by written notice. Each party reserves the right to change the address for receiving notice during the term of this Agreement upon written notice to the other parties.
M. Counterparts. This Agreement may be executed in separate counterparts, none of which need contain the signatures of both parties, and each of which, when so executed, shall be deemed to be an original, and such counterparts shall together constitute and be one and the same instrument.
N. Effect. The terms and provisions of this Agreement shall supersede any other conflicting or inconsistent terms and provisions in the Terms of Service to the extent of such conflict or inconsistency.
