Business Associate Agreement

BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement ("Agreement") is entered into between the subscribing organization identified at signup ("Covered Entity") and THNK ("Business Associate"), effective on the date it is accepted electronically. 1. Definitions. Capitalized terms not defined here have the meanings given in the HIPAA Rules (45 CFR Parts 160 and 164), including "Protected Health Information" ("PHI"), "Electronic PHI", "Breach", "Security Incident", "Subcontractor" and "Unsecured PHI". 2. Permitted uses and disclosures. Business Associate may use and disclose PHI only to provide the THNK Med platform and support services to Covered Entity under the subscription, as required by law, or for Business Associate's proper management and administration as permitted by 45 CFR 164.504(e)(4). Business Associate will not use or disclose PHI in a manner that would violate the HIPAA Rules if done by Covered Entity, and will limit uses and disclosures to the minimum necessary. 3. Safeguards. Business Associate will implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of Electronic PHI, and will comply with Subpart C of 45 CFR Part 164 (the Security Rule). 4. Reporting. Business Associate will report to Covered Entity any use or disclosure of PHI not provided for by this Agreement, and any Security Incident, of which it becomes aware. Business Associate will notify Covered Entity of any Breach of Unsecured PHI without unreasonable delay and no later than sixty (60) calendar days after discovery, with the information required by 45 CFR 164.410. 5. Subcontractors. Business Associate will ensure that any Subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions and conditions that apply to Business Associate. 6. Individual rights. Within the time required by the HIPAA Rules, Business Associate will make PHI in a Designated Record Set available to Covered Entity for access (45 CFR 164.524) and amendment (45 CFR 164.526), and will provide information needed for an accounting of disclosures (45 CFR 164.528). 7. Covered Entity obligations. To the extent Business Associate carries out an obligation of Covered Entity under Subpart E of 45 CFR Part 164, it will comply with the requirements that apply to Covered Entity in performing that obligation. 8. Books and records. Business Associate will make its internal practices, books and records relating to PHI available to the Secretary of Health and Human Services for purposes of determining compliance with the HIPAA Rules. 9. Term and termination. This Agreement remains in effect while Business Associate maintains PHI for Covered Entity. Covered Entity may terminate the subscription if Business Associate materially breaches this Agreement and does not cure the breach within thirty (30) days of written notice. 10. Return or destruction. On termination, Business Associate will, at Covered Entity's choice, return or destroy all PHI it maintains, including by providing a complete export of Covered Entity's database. If return or destruction is infeasible, the protections of this Agreement continue for as long as the PHI is retained. 11. Miscellaneous. This Agreement will be interpreted to permit compliance with the HIPAA Rules and will be amended as needed to keep up with changes to them. Nothing in this Agreement creates rights for any third party. By accepting electronically, the signer confirms they are authorized to bind Covered Entity to this Agreement.