Business Associate Agreement

Capitalized terms used but not defined in this Agreement have the meanings given in HIPAA, including: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

“Protected Health Information” or “PHI” has the meaning given in 45 C.F.R. § 160.103, limited to information created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity. “Electronic PHI” is PHI in electronic form.

Business Associate agrees to:

• (a) not Use or Disclose PHI other than as permitted or required by this Agreement or as Required by Law;
• (b) use appropriate safeguards, and comply with Subpart C of 45 C.F.R. Part 164 with respect to Electronic PHI, to prevent Use or Disclosure of PHI other than as provided for by this Agreement;
• (c) report to Covered Entity any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, including any Breach of Unsecured PHI as required by 45 C.F.R. § 164.410, and any Security Incident of which it becomes aware. Breach notifications will be made without unreasonable delay and in no case later than ten (10) business days after discovery, and will include the information required by 45 C.F.R. § 164.410(c) to the extent available. The Parties agree that this section constitutes notice of the ongoing existence of unsuccessful Security Incidents — such as pings, port scans, denied log-in attempts, and denial-of-service attempts that do not result in unauthorized access to, or Use or Disclosure of, PHI — for which no further notice is required;
• (d) in accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees to the same restrictions, conditions, and requirements that apply to Business Associate with respect to that information;
• (e) make PHI in a Designated Record Set available to Covered Entity as necessary for Covered Entity to meet its obligations under 45 C.F.R. § 164.524. Covered Entity can generally access this information directly through the Services; Business Associate will otherwise provide it within fifteen (15) business days of Covered Entity’s written request;
• (f) make any amendment to PHI in a Designated Record Set as directed or agreed to by Covered Entity under 45 C.F.R. § 164.526, or take other measures necessary to satisfy Covered Entity’s obligations under that section;
• (g) maintain and make available the information required for Covered Entity to provide an accounting of Disclosures under 45 C.F.R. § 164.528;
• (h) to the extent Business Associate carries out one of Covered Entity’s obligations under Subpart E of 45 C.F.R. Part 164, comply with the requirements of Subpart E that apply to Covered Entity in the performance of that obligation;
• (i) make its internal practices, books, and records relating to PHI available to the Secretary for purposes of determining compliance with HIPAA; and
• (j) request, Use, and Disclose only the Minimum Necessary PHI to accomplish the intended purpose.

Business Associate may Use or Disclose PHI only as follows:

• (a) to perform the Services for, or on behalf of, Covered Entity as described in the Underlying Agreement, including features Covered Entity or its authorized users choose to enable;
• (b) as Required by Law;
• (c) for the proper management and administration of Business Associate or to carry out its legal responsibilities, provided that any Disclosure for these purposes is Required by Law, or Business Associate obtains reasonable assurances from the recipient that the information will remain confidential, will be Used or further Disclosed only as Required by Law or for the purpose for which it was Disclosed, and that the recipient will notify Business Associate of any instance in which the confidentiality of the information has been breached;
• (d) to provide Data Aggregation services relating to the Health Care Operations of Covered Entity, if requested by Covered Entity; and
• (e) to create de-identified information in accordance with 45 C.F.R. § 164.514(a)–(c).

Covered Entity agrees to:

• (a) notify Business Associate of any limitation in its Notice of Privacy Practices, any change in or revocation of an Individual’s permission, and any restriction on the Use or Disclosure of PHI it has agreed to under 45 C.F.R. § 164.522, to the extent such limitation, change, or restriction may affect Business Associate’s Use or Disclosure of PHI;
• (b) not request that Business Associate Use or Disclose PHI in any manner that would not be permissible under HIPAA if done by Covered Entity; and
• (c) configure and use the Services appropriately for PHI, including assigning user roles, managing who has access, and enabling only those optional features and third-party integrations it has determined are appropriate. Integrations and messaging channels that Covered Entity connects on its own initiative, and the third parties that operate them, are not Subcontractors of Business Associate.

Term. This Agreement takes effect when accepted by Covered Entity and remains in effect until the Underlying Agreement ends and all PHI has been returned or destroyed as described below, unless terminated earlier under this section.

Termination for cause. If either Party determines that the other has violated a material term of this Agreement, it may terminate this Agreement and the Underlying Agreement if the violating Party does not cure the violation within thirty (30) days after written notice.

Effect of termination. On termination, Business Associate will, at Covered Entity’s direction, return to Covered Entity (for example, as a data export) or destroy all PHI that Business Associate still maintains, and retain no copies. If return or destruction is infeasible — for example, for information in backups that are overwritten on a regular cycle — Business Associate will extend the protections of this Agreement to that PHI and limit further Uses and Disclosures to those purposes that make return or destruction infeasible, for as long as Business Associate maintains it.

Survival. Business Associate’s obligations under this section survive termination.

Regulatory references. A reference in this Agreement to a section of HIPAA means the section as in effect or as amended.

Amendment. The Parties agree to take action to amend this Agreement as necessary for compliance with HIPAA. Business Associate may publish an updated version of this Agreement; Covered Entity will be asked to accept it, and until it does, the most recent version it accepted continues to apply.

Interpretation. Any ambiguity in this Agreement will be resolved to permit compliance with HIPAA. If this Agreement conflicts with the Underlying Agreement regarding PHI, this Agreement controls.

No third-party beneficiaries. Nothing in this Agreement confers any rights or remedies on any person other than the Parties and their respective successors and permitted assigns.

Notices. Notices to Business Associate under this Agreement should be sent to support@castopia.ai and to Castopia Inc, 5193 Canoga Ave, Woodland Hills, CA 91364. Notices to Covered Entity will be sent to the owner email address on its account.