Business Associate Agreement (BAA)

Introduction

This Business Associate Agreement ("BAA") is entered into by and between the Customer identified below ("Covered Entity") and Endo Mind, Inc. ("Business Associate"). This BAA is effective as of [Effective Date] and supplements the parties' agreement for the Services (the "Underlying Agreement"). If there is a conflict between this BAA and the Underlying Agreement regarding PHI, this BAA controls. The purpose of this BAA is to satisfy the requirements of the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, including 45 CFR Parts 160 and 164, as amended ("HIPAA").

1. Definitions

Except as otherwise defined in this BAA, capitalized terms have the meanings set forth in HIPAA.

• "Protected Health Information" or "PHI" means Protected Health Information as defined in 45 CFR 160.103.
• "Breach" has the meaning given in 45 CFR 164.402.
• "Security Incident" has the meaning given in 45 CFR 164.304.
• "Unsecured PHI" has the meaning given in 45 CFR 164.402.
• "Secretary" means the Secretary of the U.S. Department of Health and Human Services or the Secretary's designee.

2. Obligations of Business Associate

• Use and disclosure. Business Associate will not use or disclose PHI other than as permitted or required by this BAA or as required by law.
• Safeguards. Business Associate will use appropriate safeguards and comply with the Security Rule (45 CFR Part 164 Subpart C) to prevent use or disclosure of PHI other than as provided for by this BAA.
• Minimum necessary. Business Associate will request, use, and disclose only the minimum necessary PHI to accomplish the intended purpose, consistent with HIPAA requirements.
• Reporting. Business Associate will report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which it becomes aware, including Breaches of Unsecured PHI, in accordance with Section 5.
• Mitigation. Business Associate will mitigate, to the extent practicable, any harmful effect known to Business Associate of a use or disclosure of PHI by Business Associate in violation of this BAA.
• Access to records. Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of, Covered Entity available to the Secretary for purposes of determining Covered Entity's compliance with HIPAA, as required by 45 CFR 164.504(e)(2)(ii)(I).

3. Permitted Uses and Disclosures

Services. Business Associate may use and disclose PHI to perform functions, activities, or services for or on behalf of Covered Entity as specified in the Underlying Agreement, provided that such use or disclosure would not violate HIPAA if done by Covered Entity.

Management and administration. Business Associate may use PHI for the proper management and administration of Business Associate or to carry out Business Associate's legal responsibilities.

Disclosures for management and administration. Business Associate may disclose PHI for its proper management and administration or to carry out its legal responsibilities if (i) the disclosure is required by law, or (ii) Business Associate obtains reasonable assurances from the recipient that the PHI will remain confidential and will be used or further disclosed only as required by law or for the purpose for which it was disclosed, and the recipient notifies Business Associate of any breaches of confidentiality.

Data aggregation. Business Associate may use PHI to provide data aggregation services relating to the health care operations of Covered Entity, if and only to the extent permitted by the Underlying Agreement and HIPAA.

De identification. Business Associate may de identify PHI in accordance with 45 CFR 164.514. De identified information is not PHI. Business Associate may use de identified information for lawful purposes, including service improvement and security, unless the Underlying Agreement restricts such use.

No sale of PHI. Business Associate will not sell PHI.

Required by law. Business Associate may use or disclose PHI to the extent required by applicable law, provided that Business Associate gives Covered Entity notice of such requirement when legally permissible.

Health and safety. Business Associate may use or disclose PHI to avert a serious threat to health or safety if consistent with HIPAA and only to the extent required to prevent or lessen the threat.

4. Safeguards and Security

• Security program. Business Associate will maintain administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of electronic PHI.
• Access controls. Business Associate will use role based access, least privilege, and authentication controls to limit access to PHI.
• Transmission security. Business Associate will implement measures to guard against unauthorized access to PHI transmitted over electronic communications networks.
• Audit controls. Business Associate will implement mechanisms that record and examine activity in information systems that contain or use electronic PHI, consistent with the Services and configuration.
• Availability. Business Associate will maintain processes for backup and recovery appropriate to the Services and its environment.

5. Breach Notification

Notification. Business Associate will notify Covered Entity without unreasonable delay and in no event later than sixty (60) days after discovery of a Breach of Unsecured PHI, as required by 45 CFR 164.410. The parties may agree in the Underlying Agreement to a shorter notification period, which will control.

Content. To the extent available, notification will include: (i) identification of each individual whose Unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed; (ii) a brief description of what happened, including the date of the breach and the date of discovery; (iii) a description of the types of information involved; (iv) steps individuals should take to protect themselves; (v) steps Business Associate is taking to investigate, mitigate harm, and protect against further breaches; and (vi) any other information reasonably requested by Covered Entity for HIPAA compliance.

Security incidents. Business Associate will report Security Incidents as agreed by the parties. The parties acknowledge that unsuccessful attempts to access systems, such as pings and port scans, may occur and may not be reported unless they result in unauthorized access, use, or disclosure of PHI.

6. Subcontractors

Business Associate will ensure that any subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to the same restrictions and conditions that apply to Business Associate with respect to such PHI. Business Associate remains responsible for the acts and omissions of its subcontractors to the extent required by HIPAA.

7. Access, Amendment, and Accounting

Access. To the extent Business Associate maintains PHI in a designated record set, Business Associate will make PHI available to Covered Entity or, as directed by Covered Entity, to an individual, to meet Covered Entity's obligations under 45 CFR 164.524.

Amendment. Business Associate will make PHI available for amendment and incorporate any amendments as directed by Covered Entity to meet Covered Entity's obligations under 45 CFR 164.526.

Accounting of disclosures. Business Associate will document disclosures of PHI and provide information reasonably necessary for Covered Entity to respond to an accounting request under 45 CFR 164.528, to the extent such requirement applies.

Timeframes. Covered Entity will submit requests in writing. Business Associate will respond within timeframes reasonably necessary for Covered Entity to meet its legal obligations.

Direct requests. Business Associate will not respond directly to individual requests for access, amendment, or accounting unless directed in writing by Covered Entity.

8. Termination

Term. This BAA will remain in effect until terminated in accordance with this Section.

Termination for cause. If Covered Entity determines that Business Associate has violated a material term of this BAA, Covered Entity may: (i) provide an opportunity for Business Associate to cure the breach within a reasonable time, (ii) terminate this BAA and the Underlying Agreement if cure is not possible, or (iii) report the problem to the Secretary, as required by 45 CFR 164.504(e)(1)(ii).

Effect of termination. Upon termination, Business Associate will return or destroy PHI as provided in Section 9, unless infeasible.

9. Return or Destruction of PHI

Return or destroy. At termination of this BAA for any reason, Business Associate will, at Covered Entity's option and as feasible, return or destroy all PHI received from, or created or received on behalf of, Covered Entity that Business Associate still maintains in any form.

Infeasibility. If Business Associate determines that return or destruction is infeasible, Business Associate will provide Covered Entity with written notice and extend the protections of this BAA to such PHI and limit further uses and disclosures to those purposes that make return or destruction infeasible.

10. Miscellaneous

Regulatory references. A reference in this BAA to a section of HIPAA means the section as in effect or as amended.

Interpretation. The parties intend this BAA to comply with HIPAA. Any ambiguity will be resolved to permit compliance with HIPAA.

No third party beneficiaries. Nothing in this BAA creates rights in any third party.

Survival. Sections addressing confidentiality and restrictions on use and disclosure of PHI survive termination, consistent with HIPAA.

Notices. Notices under this BAA must be delivered pursuant to the notice provisions in the Underlying Agreement or, if none, by email to support@thyrahealth.com and to the notice address specified by the Covered Entity.

Signatures