1. Relationship to the MSA
This BAA supplements the Master Services Agreement. Capitalized HIPAA terms not defined here have the meanings given in the HIPAA Rules. If Customer is not a Covered Entity or PatientLock does not act as its Business Associate for the purchased service, this BAA does not expand the service to require PHI processing.
2. Permitted uses and disclosures
PatientLock may use or disclose PHI only as necessary to perform services for Covered Entity, as permitted by this BAA, or as required by law. PatientLock may use PHI for its proper management and administration and may disclose PHI for those purposes when permitted by 45 C.F.R. § 164.504(e).
3. Safeguards
PatientLock will use appropriate administrative, physical, and technical safeguards to prevent use or disclosure of PHI other than as permitted by this BAA and will comply with applicable provisions of the HIPAA Security Rule with respect to ePHI.
4. Reporting
PatientLock will report to Covered Entity any use or disclosure of PHI not permitted by this BAA of which PatientLock becomes aware, including breaches of unsecured PHI as required by 45 C.F.R. § 164.410, and will report Security Incidents as required by the HIPAA Rules and the parties' agreement.
5. Subcontractors
PatientLock will require subcontractors that create, receive, maintain, or transmit PHI on PatientLock's behalf to agree to restrictions and safeguards that apply to PatientLock with respect to that PHI.
6. Individual rights and HHS access
To the extent PatientLock maintains the relevant PHI, PatientLock will provide reasonable assistance required for Covered Entity to satisfy applicable HIPAA obligations concerning access, amendment, and accounting of disclosures. PatientLock will make internal practices, books, and records relating to PHI available to the Secretary of HHS as required by law.
7. Minimum necessary
PatientLock will limit uses, disclosures, and requests for PHI to the minimum necessary when the HIPAA Rules require the minimum-necessary standard.
8. Termination and return or destruction
If either party becomes aware of a material breach of this BAA, the parties will follow the cure and termination provisions required by the HIPAA Rules and the MSA. At termination, PatientLock will return or destroy PHI when feasible. If return or destruction is infeasible, PatientLock will extend this BAA's protections to retained PHI and limit further use or disclosure to the purpose that makes return or destruction infeasible.
9. Interpretation and liability
This BAA will be interpreted to permit compliance with HIPAA and HITECH. Liability is governed by the MSA except where applicable law requires otherwise. Customer-specific terms may be documented in an executed BAA addendum.