Business Associate Agreement
The terms of this Agreement are entered into by and between Companion Medical Scribe AI, owned by Nationwide Psychiatry PLLC, and the applicable healthcare provider (“Customer”) who has accepted the Terms of Use. This Agreement is incorporated by reference into and made a part of Companion Medical Scribe AI’s Terms of Use. However, the terms of this Agreement only apply if and to the extent that Companion Medical Scribe AI receives, creates, maintains, or transmits Protected Health Information pertaining to Customer in connection with the Services Agreement (described below) that Companion Medical Scribe AI, as a Business Associate, performs for or on behalf of Customer, as a Covered Entity. In this context, Companion Medical Scribe AI is referred to as a “Business Associate” and the customer is referred to as a “Covered Entity” in its capacity as a Covered Entity. Each Covered Entity and Business Associate is a “Party,” and the two together are referred to as the “Parties.”
Recitals
WHEREAS Business Associate may create, receive, maintain, or transmit Protected Health Information (described below) in connection with the services being provided under the Services Agreement, and Covered Entity has accepted Business Associate’s Terms of Use (the “Services Agreement”). As a result, a written agreement that complies with applicable HIPAA requirements is required. The
WHEREAS, in accordance with the Health Insurance Portability and Accountability Act of 1996 and its subsequent amendments to its implementing regulations (45 C.F.R. Parts 160–64) (collectively, “HIPAA”); and
WHEREAS, WHEREAS, Business Associates and Covered Entities wish to use this Agreement to fulfill HIPAA’s responsibilities and to handle other HIPAA-related issues.
Consent
NOW, THEREFORE, NOW Therefore, with the intention of becoming legally bound, the Parties agree as follows, taking into account the mutual agreements and undertakings of the Parties, as well as any other good and valuable consideration, the sufficiency of which is hereby accepted, to the degree that HIPAA applicable to each Party:
1. Definitions:
When used in this Agreement, the following terms shall imply the following:
Information created, received, maintained, or transmitted by or on behalf of a Covered Entity is the only information that qualifies as “Electronic Protected Health Information,” or “ePHI,” according to 45 C.F.R. § 160.103.
The term “individual” will mean the same as “individual” in 45 C.F.R. §160.103, and it will include anybody who meets the requirements to be a personal representative under 45 C.F.R. §164.502(g).
“Protected Health Information” or “PHI” will mean the same thing as “protected health information” under 45 C.F.R. § 160.103, with the exception of information developed, maintained, or received on behalf of a Covered Entity or received from a Covered Entity. To be clear, ePHI will be included in PHI.
The term “subcontractor” will mean the same as it does in 45 C.F.R. §160.103, with the exception of any person or organization that generates, receives, keeps, or transmits PHI on behalf of a business associate.
The definition of any capitalized term that is not specified here will be the same as that found in 45 C.F.R. Parts 160 and 164, if applicable. Although they are not capitalized, the phrases “use,” “disclose,” and “discovery,” or their derivatives, will also have the same meanings as those specified in HIPAA.
2. responsibilities and actions of a business associate.
Except as allowed or required by this Agreement, the Services Agreement, or as required by law, Business Associates promise not to use or disclose PHI.
In order to prevent use or disclosure of the PHI beyond what is permitted by this Agreement, the Business Associate agrees to implement the necessary safeguards and, if applicable, to adhere to Subpart C of 45 C.F.R. Part 164 with regard to Electronic PHI.
Any use or disclosure of PHI not permitted by this Agreement, including but not limited to breaches of unsecured PHI as mandated by 45 C.F.R. 164.410 and any security incident of which it learns, shall be reported to the Covered Entity by the Business Associate.
Business Associate undertakes to make sure that any Subcontractors who produce, receive, maintain, or transmit PHI on Business Associate’s behalf consent in writing to essentially the same limitations, terms, and specifications that apply to Business Associate under this Agreement with regard to such PHI.
Uses and Disclosures Permitted by Business Associates.
PHI may only be used or disclosed by Business Associates as required to fulfill its responsibilities under the Services Agreement.
PHI may be used by business associates to fulfill their legal obligations or for appropriate management and administration.
If the disclosures are mandated by law or the business associate has reasonable assurances from the individual to whom the information is disclosed that the information will remain confidential, the business associate may disclose PHI for the purpose of proper management and administration or to fulfill its legal obligations.
responsibilities of the covered entity.
If there are any limitations in the Covered Entity’s notice of privacy practices under 45 C.F.R. 164.520 that could impact Business Associate’s use or disclosure of PHI, Covered Entity is required to promptly inform Business Associate of them.
If an individual’s permission to use or disclose their PHI changes or is revoked, the Covered Entity must tell Business Associate before the revocation takes effect, to the extent that the changes may impact Business Associate’s use or disclosure of PHI.
Termination.
The term of this agreement will begin on the day that the Covered Entity creates a Companion Medical Scribe AI account (the “Effective Date”) and end when the Covered Entity deactivates its Companion Medical Scribe AI account to end the Services Agreement or when either Party terminates this agreement for good reason.
Other.
Regulatory References: Any mention of HIPAA in this Agreement refers to the current or modified version of the law.