THIS SERVICE AND APP IS NOT INTENDED FOR USE BY INDIVIDUALS UNDER 18 YEARS OLD.
This sets forth the terms and conditions (collectively “Agreement”) upon which you may use the PracticePal software application, related services and information, and all updates, enhancements, and upgrades provided to you (collectively the “Service” or “App”) by PracticePal and/or its authorized vendors, distributors, developers (collectively “PracticePal,” “We,” “Us” or “Our”). “You,” “your,” “yourself,” “Customer” or “User” means you, as an individual, and the organization that your represent (e.g., “Your Organization” as defined herein).
PLEASE READ THIS AGREEMENT CAREFULLY IN ITS ENTIRETY BEFORE USING THE SERVICE. IF YOU DO NOT AGREE TO BE BOUND BY THIS AGREEMENT (INCLUDING THE APPLICABLE BUSINESS ASSOCIATE AGREEMENT (“BAA”) SET FORTH HEREIN) PLEASE DO NOT USE THE SERVICE OR APP. THIS AGREEMENT CONTAINS WARRANTY DISCLAIMERS AND OTHER PROVISIONS THAT LIMIT PRACTICEPAL’s LIABILITY TO YOU.
BY ACCEPTING THIS AGREEMENT, BY (1) CLICKING A BOX INDICATING ACCEPTANCE, (2) EXECUTING AN ORDER FORM THAT REFERENCES THIS AGREEMENT, OR (3) USING FREE SERVICE, YOU -- INCLUDING THE ORGANIZATION OR ENTITY (E.G., YOUR PRACTICE) YOU REPRESENT (INCLUDING, BUT NOT LIMITED TO ITS OWNERS, EMPLOYEES OR AGENTS)[COLLECTIVELY “YOUR ORGANIZATION”] AGREE TO THE TERMS OF THIS AGREEMENT, INCLUDING BUT NOT LIMITED TO THE BUSINESS ASSOCIATE AGREEMENT SET FORTH AND INCORPORATED HEREIN.
IF THE INDIVIDUAL USER ACCEPTING THIS AGREEMENT IS ACCEPTING ON BEHALF OF YOUR ORGANIZATION OR A COMPANY OR OTHER LEGAL ENTITY, SUCH INDIVIDUAL REPRESENTS THAT THEY HAVE THE AUTHORITY TO BIND SUCH ENTITY AND ITS AFFILIATES TO THESE TERMS AND CONDITIONS, IN WHICH CASE THE TERM “CUSTOMER” SHALL REFER TO SUCH ENTITY AND ITS AFFILIATES. IF THE INDIVIDUAL ACCEPTING THIS AGREEMENT DOES NOT HAVE SUCH AUTHORITY, OR DOES NOT AGREE WITH THESE TERMS AND CONDITIONS, SUCH INDIVIDUAL MUST NOT ACCEPT THIS AGREEMENT AND MAY NOT USE THE SERVICE.
IF YOU OR YOUR ORGANIZATION REGISTERS AS A BETA TESTER, FOR A FREE TRIAL OF THE PRACTICEPAL APP OR FOR FREE SERVICE, THE APPLICABLE PROVISIONS OF THIS AGREEMENT WILL ALSO GOVERN THAT FREE TRIAL OR THOSE FREE SERVICE.
2. PERMITTED USE AND RESTRICTIONS
Grant of License and Reservations. Subject to the terms of this Agreement, PracticePal hereby grants you, during the Term of this Agreement, the non-exclusive, non-transferable, worldwide right to use the Service, solely for your own internal business purposes in connection with your provision of care to your patients or customers including transmitting, accessing, managing, collecting, and displaying Protected Health Information (defined in Section 8 below). As further set forth in Section 3, Service and App are licensed, not sold, to you by PracticePal for use only under the terms of this Agreement. PracticePal reserves all rights not expressly granted to you. The rights granted in this Agreement are limited to PracticePal’s intellectual property rights in the App and do not include any other patents or intellectual property rights. You may own the media on which the App is stored, but PracticePal retains ownership of the App itself.
Restrictions. You shall not (i) license, sublicense, sell, resell, transfer, assign, distribute or otherwise commercially exploit or make available to any third party the Service or the content provided by or on behalf of PracticePal through the Service (the “Content”) in any way; (ii) modify or make derivative works based upon the Service or the Content; (iii) create Internet “links” to the Service or “frame” or “mirror” any Content on any other server or wireless or Internet-based device; or (iv) reverse engineer or access the Service in order to (a) build a competitive product or service, (b) build a product using similar ideas, features, functions or graphics of the Service, or (c) copy any ideas, features, functions or graphics of the Service. You further agree to not use the Service to do the following:
- Transmit, access, or communicate any data that you do not have the right to transmit, access, or communicate under applicable Law (as defined in herein below), including the Health Insurance Portability and Accountability Act of 1996 as modified by the Health Information Technology for Economic and Clinical Health Act and all rules, regulations, and related laws and acts promulgated under and in connection therewith (collectively, “HIPAA”), under similar more stringent state laws, or under a contractual or fiduciary relationship;
- infringes any patent, trademark, trade secret, copyright or other proprietary rights of any party.
- Transmit or communicate any data that contains software viruses or any other computer code, files, or programs designed, intended, or likely to interrupt, destroy or limit the functionality of any computer software or hardware or any telecommunications equipment;
- Interfere with or disrupt or circumvent the Service or App;
- Intentionally or unintentionally violate any applicable local, state, national or international Law, including laws relating to securities exchange and any regulations, requirements, procedures or policies in force from time to time relating to the Service;
- Transmit or communicate any data that is unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, invasive of another’s privacy, hateful or racially, ethnically or otherwise objectionable;
- Use the Service or App while driving or in a manner that endangers yourself or others; and/or
- Impair your ability to provide medical treatment at the standard of care.
You agree that PracticePal may publish, modify and amend any and all Content appearing within www.practicepal.io and all other internet domains or content feeds owned, managed, or controlled by US, including Content consisting of promotions, advertisements and listings for non-competing local businesses, or products and services offered by PracticePal.
3. INTELLECTUAL PROPERTY RIGHTS AND CUSTOMER DATA
Ownership. You acknowledge and agree that, subject to the license grants contained in this Agreement, PracticePal, or its licensors, retains all right, title and interest, including all related intellectual property rights, in and to the PracticePal technology, the Content and the Service and any suggestions, ideas, enhancement requests, feedback, recommendations (collectively, “Feedback”) or other information provided by you or any other party relating to the Service. You retain all right, title and interest to any and all patient or customer data, including consumer review data, captured by the PracticePal system (“Customer Data”) or provided to PracticePal, subject to PracticePal’s right to use such Customer Data to provide the Service to you. You grant PracticePal a royalty-free, irrevocable, non-exclusive, perpetual, worldwide license to use, modify, aggregate, prepare derivative works, publish, distribute and sublicense the consumer review data and any surveys PracticePal conducts on your behalf.
No Rights Except As Expressly Conveyed. This Agreement is not a sale and does not convey to you any rights of ownership in or related to the PracticePal Service, PracticePal technology, PracticePal Content, or PracticePal intellectual property except for the limited licenses granted to you under this Agreement. Any and all software, algorithms, applications, source codes, processes, and related programming, engineering or technological matter developed or created by PracticePal or its licensors (and all copyrights, patents, trademarks, service marks trade secrets, trade dress, and other proprietary rights related thereto) shall remain the sole, exclusive and perpetual property of PracticePal or its licensors. PracticePal works with third parties to offer its customers additional products and services from time to time. PracticePal collects anonymized, aggregate data in order to provide such additional product and services to you and you agree to permit us to use such anonymized, aggregate data.
Trademarks. The trademarks, service marks, trade names, trade dress, service names or logos associated with the Service (collectively, the “Marks”) are trademarks of PracticePal or its licensors, and no right or license is granted to use them. You hereby acknowledge PracticePal or its licensors’ perpetual and exclusive ownership of and title to the Marks and the goodwill attaching thereto. You agree not to use or attempt to register any Mark that is confusingly or deceptively similar to the Marks.
4. CUSTOMER RESPONSIBILITY: REGISTRATION, LOGIN INFORMATION, PASSWORDS, AUTHORIZED USE.
Authorized Use. Except as expressly set forth in this Agreement, you will protect the confidentiality of the Service, and will not distribute or otherwise make available the Service, or any portion of the Service, in any form to any third party (persons or entities that are not owners, directors, officers, employees or agents of Your Organization). Any rights you may possess in the Service expire upon expiration or termination of this Agreement. You will employ the security measures necessary to prevent unauthorized users from accessing the Service including your user ID(s) and password(s) (“Login Information”). You are solely responsible for the maintenance and protection of your Login Information, including but not limited to your transmission or sharing of Login Information with your employees, agents, or representatives. You accept responsibility for, and will be liable for all access to the Service in connection with your Login Information. Without the prior written consent of PracticePal, you will not utilize the services of any third party to assist you in using the Service. Further, you will be responsible for all activities that occur under or in connection with your account and your use of the Service.
Account. You are solely responsible for any and all activity occurring under your user accounts and shall abide by all applicable local, state, national and foreign laws, treaties and regulations in connection with your use of the Service, including those related to data privacy, international communications and the transmission of technical or personal data. You also will choose a password and a user name. You are entirely responsible for maintaining the confidentiality of your password and account. You agree to notify PracticePal immediately of any unauthorized use of your account or any breach of security. PracticePal will not be liable for any loss that you may incur as a result of someone else using your password or account, either with or without your knowledge. You warrant and represent that: (i) the content to be transmitted by or on your behalf does not constitute SPAM; (ii) the content to be transmitted by or on your behalf is not illegal, threatening, hateful, vulgar, obscene, libelous or defamatory and does not and will not infringe upon any trademark, patent, copyright, trade secret or other proprietary, publicity or privacy right of any third party; and (iii) you have complied and will comply with all applicable laws and regulations respecting your execution and performance of this Agreement. If you are using any Content featuring a model or property with a subject that would be unflattering or unduly controversial to a reasonable person, you must accompany such use with a statement that indicates that (a) the Content is being used for illustrative purposes only and (b) any person depicted in the Content is a model.
5. THIRD-PARTY TECHNOLOGY AND WEBSITES
The PracticePal Service receives data from third-party software systems, which you will designate in the process of setting up the Service, subject to the following terms and conditions:
Third Party Technology. Any and all third party technology provided, made available, linked to, or otherwise accessible through Service (“Third Party Technology”) is provided solely as a convenience to you and is not under the control of PracticePal. PracticePal does not endorse, recommend, or otherwise make any representations or warranties with respect to any Third Party Technology. PracticePal does not have any responsibility or liability to you for any Third Party Technology which you access and you use at your own risk. Further, you agree to comply with any and all terms and conditions applicable to the use of Third Party Technology and otherwise ensure that you have obtained all rights, licenses, and clearances that may be necessary to use such Third Party Technology.
Third Party Websites. This Service may contain links to other independent third party websites (“Linked Websites”). These Linked Websites are provided solely as a convenience to our visitors. Such Linked Websites are not under the control of PracticePal, and PracticePal is not responsible for and does not endorse the content of such Linked Websites, including any information or materials contained on such Linked Websites. PracticePal does not have any responsibility or liability for any information, data, communications or materials available on such third-party sites. You therefore access these Linked Websites at your own risk.
Changes to Third-Party Technology and Websites. If you elect to change, upgrade or materially alter the third party software system from which PracticePal receives data, PracticePal does not guarantee that all Customer Data or Service functionality will be preserved. You are responsible for communicating any changes in data structure, management system, or hardware upgrades that may impact PracticePal’s ability to receive and process Customer Data. In addition, you are responsible for providing PracticePal with accurate instructions and information regarding the third party systems and databases with which the Service will interface, and you bear all responsibility for incomplete, inaccurate or otherwise faulty information regarding third party systems and databases belonging to you as conveyed to PracticePal in connection with set up or maintenance of the Service.
6. CUSTOMER DATA
PracticePal does not own any Customer Data, information or material that you submit to the Service in the course of using the Service. Except in accordance with this Agreement, if applicable, or as required by law, Customer Data in identifiable form will not be disclosed, sold, assigned, licensed or otherwise disposed of by PracticePal to any third party. You, not PracticePal, shall have sole responsibility for the accuracy, quality, integrity, legality, reliability, appropriateness, and intellectual property ownership or right to use of all Customer Data, and, except as provided in this Agreement or as required by law, PracticePal shall not be responsible or liable for the deletion, correction, destruction, damage, loss or failure to store any Customer Data, or for the improper or erroneous upload or extraction of any Customer Data. PracticePal reserves the right to withhold, remove and/or discard Customer Data without notice for any breach, including, without limitation, your non-payment as specified in this Agreement. Upon termination for cause, your right to access or use Customer Data immediately ceases, and, except as set forth in the Section titled “Listing services”, below, PracticePal shall have no obligation to maintain or forward any Customer Data. Notwithstanding the foregoing, if you are part of a franchise organization which has or later executes an agreement with PracticePal, and the franchisee has granted the franchisor access to their data, your Customer Data may be shared with your franchisor, and/or franchise association.
PracticePal may, but has no obligation to, monitor any content created by you using the Service. PracticePal may disclose any information necessary or appropriate to satisfy PracticePal’s legal obligations, protect PracticePal or its customers, or operate the Service properly. PracticePal, in its sole discretion, may refuse to post, remove, or require you to remove, any of your content, in whole or in part, alleged to be unacceptable, undesirable, inappropriate, or in violation of this Agreement. PracticePal may, in its discretion, also require you to place all or any portion of your content behind password protection. If PracticePal has requested you content be or have placed behind password protection, you may not publish the password or similar information in any way that limits the effectiveness of the password. If PracticePal requests that you place any of your content behind password protection and you fail to do so promptly, PracticePal may (a) place such content behind password protection itself, or (b) immediately terminate this Agreement.
7. NO MEDICAL ADVICE OR TREATMENT
PracticePal does not provide medical advice, diagnosis, or treatment. You acknowledge and agree that the Service is merely a conduit of information related to patients and the provision of healthcare to patients by independent third party healthcare providers including yourself, physicians, physician assistants, nurses, paramedics, emergency care responders, other physician extenders, healthcare systems, healthcare facilities, or other providers of healthcare services (collectively, “Healthcare Provider(s)”). You acknowledge and agree that the Healthcare Providers are solely responsible for and will have complete authority, responsibility, supervision, and control over the provision of all medical services, advice, instructions, treatment decisions, and other professional health care services performed, and that all diagnoses, treatments, procedures, and other professional health care services will be provided and performed exclusively by or under the supervision of Healthcare Providers as they, in their sole discretion, deem appropriate. You further acknowledge and agree that PracticePal does not provide or endorse any medical advice on or through the Service and no information obtained through the Service can be so construed or used. PracticePal will have and exercise absolutely no control, authority, or supervision over the provision of any medical services or other professional health care services. The use of the Service or App, all text, graphics, images, audio content, audiovisual content, data, other materials and any other information provided on or entered into or made available through the Service, including all healthcare related information, whether provided by you or Your Organization, other Healthcare Providers, or other third parties (collectively, “Third-Party Content”) is solely your responsibility. PracticePal will make all reasonable efforts in accordance with applicable laws and agreements to safeguard the integrity and availability of the Content. Further, when using the Service, information may be transmitted over a medium that may be beyond the control and jurisdiction of PracticePal and its suppliers. Accordingly, PracticePal assumes no liability for or relating to the delay, failure, interruption, or corruption of any data or other information transmitted in connection with use of the Service that is reasonably determined to be beyond PracticePal’s control. Accordingly, you acknowledge and agree that you are solely responsible for all medical services, advice, instructions, diagnoses, treatments, procedures, and other services you provide in connection with using the Service or otherwise.
8. MEDICAL DATA AND PERSONAL HEALTH INFORMATION
In addition to Section 20, and pursuant to the Business Associate Agreement, which is incorporated herein:
You acknowledge and agree that the Service may be used to transmit, collect, access, manage, and display Protected Health Information (“PHI”) by and among you and other authorized Healthcare Providers, and their employees and contractors. You acknowledge and agree that the PHI related to your treatment of patients may be transmitted and stored by PracticePal and/or its licensees and service providers in connection with providing the Service and its related services, as well as shared among other users of the Service and its related services. You acknowledge and agree that the PHI stored by PracticePal shall not serve as the system of record for any patient, personal representative of a patient, health care provider, any business associate of a health care provider, or any affiliates of the foregoing.
“Protected Health Information” or “PHI” means, collectively, information and data related to the provision of health care to patients, their health status, medical records, and related information and documents, including consent to treatment forms, authorization to disclose medical information forms, Medicare forms, Medicaid forms, living wills, Directives to Physicians and Family or Surrogates, Medical Powers of Attorney, Out-of-Hospital Do-Not-Resuscitate Orders, Declarations of Mental Health Treatment, images, reports, and lab and test results, medical treatments performed by you and/or other Healthcare Providers, and other “protected health information,” as defined under HIPAA and similar terms as defined by state, national, or international Law. You agree that your provision and use of all Protected Health Information will be in compliance with HIPAA and all other applicable Laws.
To the extent this Section conflicts with the BAA incorporated herein, the BAA shall control.
9. REPRESENTATIONS & WARRANTIES
In addition to the other representations and warranties contained in this Agreement, you further represent, warrant, and covenant to PracticePal the following:
All information you provide to PracticePal, including but not limited to any Protected Health Information, as part of the registration process or otherwise will be truthful, accurate and complete, irrespective of any independent verification or other determination made by PracticePal;
You, your practice, and all goods and services provided in connection with your use of the Service will comply with all applicable international, national, federal, state, and local laws, regulations, ordinances, and judicial decisions in courts and tribunals of competent jurisdiction within the United States as applicable (collectively, “Law”);
You are legally authorized in accordance with applicable Law to provide any and all Protected Health Information that you provide to the Service for all uses contemplated under this Agreement;
This Agreement has been duly and validly authorized, accepted, agreed to, and delivered by you (or your authorized representative) and constitutes your legal, valid, and binding obligation, enforceable against you in accordance with this Agreement. You represent that you have full power, capacity and authority to enter into this Agreement. If you are accepting on behalf of your employer or an entity, you represent that you have full legal authority to bind your employer or such entity to this Agreement; and
The performance by you of this Agreement and your use of the Service does not and will not conflict with or violate (1) any law, rule, regulation, order, judgment, decree, agreement, instrument, or obligation applicable to you, or (2) if you are an entity, any provision of your organizational or governing documents.
10. DISCLAIMER OF WARRANTIES
THE SERVICE, AND ANY THIRD PARTY TECHNOLOGY ARE PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF TITLE, NON-INFRINGEMENT, AND IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, PRACTICEPAL, ITS LICENSORS, AND SUPPLIERS MAKE NO WARRANTY, REPRESENTATION, OR GUARANTY:
AS TO THE SEQUENCE, ACCURACY, TIMELINESS, RELEVANCE, OR COMPLETENESS OF THE SERVICE;
AS TO ANY INFORMATION OFFERED OR PROVIDED WITHIN OR THROUGH THE SERVICE REGARDING TREATMENT OF MEDICAL CONDITIONS, ACTIONS, DIAGNOSES, PROCEDURES, APPLICATION OF MEDICATION, OR OTHER PROVISION OF HEALTHCARE SERVICES;
THAT THE SERVICE MAY BE RELIED UPON FOR ANY REASON, THAT THE USE OF THE SERVICE WILL BE UNINTERRUPTED OR ERROR FREE. FURTHER, YOUR USE OF THE SERVICE, AND ANY THIRD PARTY TECHNOLOGY IS AT YOUR OWN RISK. PRACTICEPAL DOES NOT WARRANT THAT THE SERVICE OR THIRD PARTY TECHNOLOGY WILL MEET YOUR SPECIFIC REQUIREMENTS. TO THE EXTENT THAT PRACTICEPAL MAY NOT DISCLAIM ANY WARRANTY AS A MATTER OF APPLICABLE LAW, THE SCOPE AND DURATION OF SUCH WARRANTY WILL BE THE MINIMUM PERMITTED UNDER SUCH LAW.
11. LIMITATION OF LIABILITY
EXCEPT WHERE PROHIBITED BY LAW, UNDER NO CIRCUMSTANCES WILL PRACTICEPAL BE LIABLE TO YOU OR ANY OTHER PERSON FOR DIRECT, CONSEQUENTIAL, SPECIAL, INDIRECT, INCIDENTAL, PUNITIVE, OR EXEMPLARY DAMAGES, COSTS, EXPENSES OR LOSSES OR LOST PROFITS IN CONNECTION WITH THE SERVICE OR OTHERWISE RELATED TO THIS AGREEMENT. THE PROVISIONS OF THIS SECTION WILL APPLY REGARDLESS OF THE FORM OF ACTION, DAMAGE, CLAIM, LIABILITY, COST, EXPENSE, OR LOSS, WHETHER IN CONTRACT, STATUTE, TORT (INCLUDING NEGLIGENCE), FAILURE OF ESSENTIAL PURPOSE OR OTHERWISE, AND EVEN IF ADVISED OF THE LIKELIHOOD OF SUCH DAMAGES. PRACTICEPAL WILL NOT BE LIABLE FOR ANY FAILURE TO PERFORM ITS OBLIGATIONS UNDER THIS AGREEMENT BECAUSE OF CIRCUMSTANCES BEYOND ITS CONTROL, WHICH CIRCUMSTANCES INCLUDE NATURAL DISASTER, TERRORISM, THIRD PARTY LABOR DISPUTES, WAR, DECLARATIONS OF GOVERNMENTS, TRANSPORTATION DELAYS, FAILURE OF HARDWARE, EQUIPMENT, OR TELECOMMUNICATIONS FAILURE. PRACTICEPAL WILL NOT BE LIABLE FOR ANY FAILURE TO PERFORM ITS OBLIGATIONS UNDER THIS AGREEMENT BECAUSE OF YOUR MISUSE OF THE SERVICE BY YOU OR ANY OTHER PERSON. THIS SECTION WILL BE GIVEN FULL EFFECT EVEN IN THE EVENT THAT ANY EXCLUSIVE REMEDY PROVIDED HAS FAILED OF ITS ESSENTIAL PURPOSE. FURTHER, IN NO EVENT WILL PRACTICEPAL BE LIABLE TO YOU OR ANYONE ELSE FOR ANY CLAIMS, LOSSES, OR DAMAGES ARISING OUT OF ANY USE OR MISUSE OF ANY THIRD PARTY TECHNOLOGY. THE PARTIES ACKNOWLEDGE THAT THE TERMS OF THIS SECTION REFLECT THE ALLOCATION OF RISK SET FORTH IN THIS AGREEMENT AND THAT THE PARTIES WOULD NOT ENTER INTO THIS AGREEMENT WITHOUT THESE LIMITATIONS OF LIABILITY. IN NO EVENT SHALL THE LIABILITY OF PRACTICEPAL FOR ANY LOSS RELATED TO USE OR INABILITY TO USE THE SERVICE EXCEED $100.00.
YOU WILL INDEMNIFY, DEFEND, AND HOLD INDEMNITEES (AS DEFINED BELOW) HARMLESS FROM AND AGAINST ANY AND ALL CLAIMS AND LOSSES ARISING FROM OR ATTRIBUTABLE TO (1) YOUR PROVISION OF MEDICAL SERVICES AND TREATMENT OF PATIENTS IN CONNECTION WITH YOUR USE OF THE SERVICE OR OTHERWISE; (2) YOUR BREACH OF ANY OF YOUR REPRESENTATIONS, WARRANTIES, COVENANTS, OR OTHER AGREEMENTS MADE UNDER THIS AGREEMENT; (3) ANY CLAIMS BY OR DISPUTES RELATED TO YOUR USE OF THE SERVICE ; (4) ANY CONTENT YOU PROVIDE TO THE SERVICE OR OTHERWISE TRANSMIT USING THE SERVICE; AND (5) BREACH OF CONFIDENTIALITY RELATED TO YOUR USE OF THE SERVICE.
Procedures. The Indemnitee will give you written notice of any Claim for which indemnification is sought. However, failure to provide such notice will not relieve you from your liability or obligations under this Agreement, except to the extent you are materially prejudiced as a direct result of such failure. The Indemnitee will cooperate with you at your expense in connection with the defense and settlement of the Claim. You may not settle any indemnified Claim in a manner that adversely affects the Indemnitee without its prior written consent. Further, the Indemnitee may participate in the defense of the Claim through counsel of its own choosing at its own cost and expense. If you fail to promptly assume the defense and employ counsel reasonably satisfactory to Indemnitee, or the Indemnitee has been advised by counsel that there exist actual or potential conflicting interests between you or your counsel and such Indemnitee, the Indemnitee may employ separate counsel, in addition to local counsel, to represent or defend such Indemnitee in such action or proceeding, and you agree to pay the fees and disbursements of such separate counsel as incurred. To the extent indemnification requires the payment of monies owed, such indemnification will occur as soon as reasonably possible after the determination of monies owed, and payment to the Indemnitee will be made within 30 days of a final determination of monies owed. Your obligations under this Section are in addition to any rights that any Indemnitee may have at common law or otherwise.
Defined Terms. “Claim” means each and every claim, request, accusation, allegation, assertion, complaint, petition, demand, suit, action, proceeding, and cause of action of every kind and description. “Indemnitee” means PracticePal, its affiliates, and its and their respective officers, directors, shareholders, managers, members, agents, employees, representatives, successors, and assigns. “Loss” means each and every liability, loss, damage, and injury (including injury or damage to any property right, and injury, damage, or death to any Person), wound, wrong, hurt, harm, expense, deficiency, diminution in value, obligation, expenditure and disbursement of any kind or nature (including all fees, costs, and expenses of investigation, travel expenses, and value of time expended by personnel), settlement, fine, fee, cost, cost of court, and all expenses of litigation (including reasonable attorneys’ fees) incident to any of the foregoing.
IN THE EVENT THAT YOU HAVE A DISPUTE WITH ONE OR MORE USERS OF THE SERVICE FOR ANY REASON, YOU RELEASE PRACTICEPAL (AND ITS OFFICERS, DIRECTORS, MANAGERS, MEMBERS, AGENTS, SUBSIDIARIES, REPRESENTATIVES, EMPLOYEES, VENDORS, DEVELOPERS OR CONTRACTORS) FROM ALL CLAIMS, DEMANDS AND DAMAGES (ACTUAL AND CONSEQUENTIAL) OF EVERY KIND AND NATURE, KNOWN AND UNKNOWN, SUSPECTED AND UNSUSPECTED, DISCLOSED AND UNDISCLOSED, ARISING OUT OF OR IN ANY WAY CONNECTED WITH SUCH DISPUTES. IF YOU ARE A CALIFORNIA RESIDENT, YOU WAIVE CALIFORNIA CIVIL CODE §1542, WHICH PROVIDES: “A GENERAL RELEASE DOES NOT EXTEND TO CLAIMS WHICH THE CREDITOR DOES NOT KNOW OR SUSPECT TO EXIST IN HIS FAVOR AT THE TIME OF EXECUTING THE RELEASE, WHICH IF KNOWN BY HIM MUST HAVE MATERIALLY AFFECTED HIS SETTLEMENT WITH THE DEBTOR.”
Unless otherwise terminated by PracticePal as provided for in this Agreement, this Agreement will remain in effect for so long as PracticePal licenses the use of the Service to you.
PracticePal may, in its sole discretion and without prior notice, terminate your access to the Service for violations of this Agreement or other agreements or guidelines, which may be associated with your use of the Service, or if PracticePal deems it necessary in its sole discretion. Further, Your Organization may terminate, or request that PracticePal terminate your access to the Service. In any such event, you must destroy all copies of the Service and all of its component parts. Failure to abide by this Agreement is a material breach of this Agreement for which PracticePal may pursue all rights and remedies it has pursuant to this Agreement, and any other rights and remedies it may have at law or in equity. You also agree that any violation by you of this Agreement will constitute an unlawful and unfair business practice and will cause irreparable harm to PracticePal, for which monetary damages would be inadequate, and you consent to PracticePal obtaining any injunctive or equitable relief that PracticePal deems necessary or appropriate in such circumstances without the need to post a bond or satisfy any similar requirements. These remedies are in addition to any other remedies PracticePal may have at law or in equity.
16. EXCLUSIONS NOT APPLICABLE
Certain states and/or jurisdictions do not allow the exclusion of implied warranties or limitation of liability for incidental or consequential damages, so the exclusions set forth in this Agreement may not apply to you. In such event, Demandforce’s liability under this Agreement will be limited to the greatest extent permitted by applicable law in such jurisdiction.
17. MESSAGING COMPLIANCE
Email compliance. You agree to comply with all elements of CAN-SPAM and safe sender email practices. This includes but is not limited to including unsubscribe links, your full contact information in all correspondence, and not releasing private and/or confidential information. You may only use email services for those customers with whom you have an existing business relationship and which have indicated that they accept correspondence from you. You may not attempt to spoof sender domains, send spam or other offending email practices including those covered in the Section titled “ Customer responsibility and passwords; third-party software” of this Agreement. Because of carrier technologies, Demandforce makes no expressed or implied warranty of individual message receipt. Demandforce is not liable for any issues that arise associated with the content that you provide or unforeseen liabilities of it being delivered.
Text message compliance. The Telephone Consumer Protection Act (TCPA) is a federal law regulating the way consumers are contacted by telephone, fax, and text message. The TCPA regulations apply to the text and automated landline messages you are able to send through the Demandforce Service to communicate with your customers and patients.
18. U.S. GOVERNMENT END USERS
The App is a “commercial item” as that term is defined at FAR 2.101, consisting of “commercial computer software” and “commercial computer software documentation” as such terms are used in 48 C.F.R. 12.212 and is provided to the U.S. Government only as a commercial end item. Consistent with FAR 12.212 and DFARS 227.7202, all U.S. Government End Users use the Service with only those rights expressly set forth in this Agreement.
19. BILLING & PRICING
Credit card authorization. By submitting your credit/debit card (“Bank Card”) data to PracticePal, you authorize PracticePal in its complete discretion to submit a financial transaction(s) to your issuing bank for settlement. You agree that once PracticePal has approved or declined your transaction, PracticePal has fully performed under the terms of this Agreement. You agree to contact PracticePal in the event that you desire to cancel any recurring charge, prior to the next billing cycle. Should you fail to contact PracticePal, you agree to indemnify and hold PracticePal harmless from any losses or damages that you suffer as a result of a recurring charge. PracticePal may be contacted at HELP@PracticePal.io. If you think that there is an error on your account, including an incorrect amount or unauthorized transaction, you agree to contact PracticePal prior to the next billing cycle. Upon proper notification, PracticePal, in its sole discretion may issue a credit to your Bank Card.
Billing. PracticePal charges and collects in advance for use of the Service. No refunds will be available for fees you have paid. PracticePal will automatically renew and bill your credit card or issue an invoice to you every month for monthly licenses and fees, or in an otherwise mutually agreed upon manner. You expressly agree that PracticePal is authorized to charge you (i) a recurring monthly fee for any applicable Service billed on a monthly basis automatically, (ii) any other fees for the Service you may purchase, and (iii) any applicable taxes in connection with your use of the Service to the payment card you provide and to reimburse us for all collection costs and interest for any overdue amounts. If the payment card you provide expires and you do not provide new payment card information or cancel your account, you authorize us to continue billing you for all fees associated with the remaining duration of your service agreement and you agree to remain responsible for any uncollected fees. If your card expires or we cannot collect the fees for any reason, you have 30 days to provide a new valid credit or debit card for us to charge. If you do not provide new card information within 30 days, PracticePal will suspend the Service and will only reinstate them once you pay us what you owe plus interest which will accrue at a rate of 1.5% per month.
Renewal. The renewal charge will be equal to the then-current license fee in effect at the time of renewal. The pricing during any automatic Renewal Term will renew at the then current rate and PracticePal will give you notice of a pricing increase at least thirty (30) days before the end of that prior Term, in which case the pricing increase will be effective upon Renewal and thereafter in the new Term. You may be allowed space and a monthly bandwidth allowance. This allowance varies depending on the hosting package you purchase. Should your account pass the allocated amount, PracticePal reserves the right to suspend the account until the start of the next allocation, suspend the account until more bandwidth is purchased at an additional fee, suspend the amount until you upgrade to a higher level package, terminate the account or charge you an additional fee for the overages. Unused bandwidth in one month cannot be carried over the next month.
Fees for other services will be charged on an as-quoted basis, including but not limited to:
Email Finder product: PracticePal works with a third-party provider to gather email addresses for individuals in your customer database for which you do not currently have email addresses on file. By opting in to use PracticePal’s email finder product you will be subject to the monthly service fee once email finder begins for that calendar month; email finder begins once PracticePal has passed your data to the PracticePal third-party provider. The fees are based on per-valid email returned each month from the provider.
Postcard product: By opting in to use PracticePal’s postcard product, you will be subject to the service fees charged per printed postcard. You assume full responsibility that any custom content you submit is correct, and in the event that you submit incorrect information, misspellings, grammatical errors, etc., you agree to pay any and all associated correction fees
Listing service: The Listing Service (defined below) is provided free of charge. PracticePal reserves the right to terminate the Listing Service as to you or any other customer at any time for any reason or no reason.
Taxes: Unless otherwise stated, the PracticePal fees do not include any taxes, levies, duties or similar governmental assessments of any nature, including but not limited to value-added, sales, use or withholding taxes, assessable by any local, state, provincial, federal or foreign jurisdiction, plus interest, penalty and additions thereon (collectively, “Taxes”). You are responsible for paying all Taxes applicable to your purchase or use of PracticePal products or services. If PracticePal has the legal obligation to pay or collect Taxes (or an amount in respect of Taxes) for which you are responsible under this paragraph, the appropriate amount shall be invoiced to and paid by you, unless you provide PracticePal with a valid tax exemption certificate authorized by the appropriate taxing authority. PracticePal is responsible solely for taxes based on its income.
20. HIPAA AND LAWS
In accordance with the provisions of the Health Insurance Portability and Accountability Act of 1996, and the regulations promulgated thereunder, including the Privacy Rule and Security, as amended (“HIPAA”), you agree to follow and abide to the following (all undefined terms in Sections 20 and 21 have their meaning defined by the HIPAA regulations):
Ensuring that your use of the Services complies with applicable law, including but not limited to laws relating to maintenance of privacy, security, and confidentiality of patient and other health information.
- Implement and maintain appropriate administrative, physical and technical safeguards to protect information within the Service.
- Such safeguards must comply with federal, state, and local requirements, including the Privacy Rule and the Security Rule.
- Maintain appropriate security with regard to all personnel, systems, and administrative processes used by you or members of your workforce to transmit, store and process electronic health information through the use of the Service.
- By using the Service, you consent to the terms of the Business Associate Agreement set forth below and you agree to protect any information received through such communication services in accordance with the terms of such business associate agreement.
Specially Protected Information:
- PracticePal applies the standards of the Privacy Rule in permitting access to the Service.
- You acknowledge that other federal and state laws impose additional restrictions on the use and disclosure of certain types of health information, or health information pertaining to certain classes of individuals.
- You agree that you are solely responsible for ensuring that personal health information is subject to the restrictions of the Privacy Rule and applicable law. In particular, you will:
not make available to other users through the Service any information in violation of any restriction on use or disclosure (whether arising from your agreement with such users or under law);
obtain all necessary consents, authorizations or releases from individuals required for making their personal health information available to PracticePal; and
include such statements (if any) in your notice of privacy practices as may be required.
PracticePal is committed to maintaining the confidentiality of information entrusted to us, especially individually identifiable personal and health information. PracticePal follows its HIPAA policies and procedures. Some acquired companies, including their products and services may operate under their own privacy policies until PracticePal integrates their privacy practices with ours. You are responsible for determining if the Service meets your compliance standards.
21. PRACTICEPAL’S USE OF PROTECTED HEALTH INFORMATION (PHI)
The Service may include use of your patients’ Protected Health Information (“PHI”) that you or your personnel input or upload onto the Service or that PracticePal (as a Business Associate) receives on your or Your Organization’s behalf (as Covered Entity) pursuant to the BAA incorporated by reference herein, or from your authorized service providers or our third party partners (“Your Health Information”). You (or your patients with respect to their PHI) retain all rights with regard to Your Health Information, and PracticePal will only use such information as expressly permitted in this Agreement and our Business Associate Agreement. You authorize PracticePal, as your business associate, to use and disclose Your Health Information as follows:
PracticePal will permit access to Your Health Information by business associates to whom you have consented to provide access to the Service and who have otherwise agreed to integrate with our systems pursuant to appropriate assurances (i.e. practice management integration vendor). You acknowledge that once PracticePal has granted access rights to another provider or covered entity (or their respective business associates), PracticePal has no control over the uses and disclosures that the business associate makes of Your Health Information, and the recipient may be subject to its own legal or regulatory obligations (including HIPAA) to retain such information and make such information available to patients, governmental authorities and others as required by applicable law or regulation.
PracticePal may “De-Identify” (means health information that has been de-identified in accordance with the provisions of the Privacy Rule) Your Health Information and use and disclose de-identified information as provided by Section 22.
PracticePal may create limited data sets from Your Health Information, and disclose them for any purpose for which you may disclose a limited data set; and you hereby authorize PracticePal to enter into data use agreements on your behalf for the use of limited data sets, in accordance with applicable law and regulation.
PracticePal may use Your Health Information in order to prepare analyses and reports, such as activity or quality-metrics reports, or any other reports the Service makes available, in order to render these reports to you. Preparation of such analyses and reports may include the use of data aggregation services relating to your treatment and health care operations, which PracticePal may perform using Your Health Information. Such reporting will be done in a manner that does not make any disclosure of Your Health Information that you would not be permitted to make.
PracticePal may use Your Health Information for the proper management and administration of the Service and our business, and to carry out its legal responsibilities. PracticePal may also disclose Your Health Information for such purposes if the disclosure is required by law, or PracticePal obtains reasonable assurances from the recipient that it will be held confidentially and used or further disclosed only (a) as required by law (as such term is defined in 45 CFR §164.103), or (b) for the purpose for which it was disclosed to the recipient, and the recipient notifies PracticePal of any instances of which it is aware in which the confidentiality of the information has been breached. Without limiting the foregoing, PracticePal may permit access to the system by our contracted system developers under appropriate confidentiality agreements.
PracticePal may use Your Health Information and Directory Information (defined below) to contact your patients on your behalf for certain Service, including (a) for treatment and health care operations messages, including sending appointment requests and reminders or post-visit treatment satisfaction surveys; (b) to request authorization on your behalf from your patients to use or disclose their health information for any purpose for which use or disclosure may be made with an appropriate authorization, including marketing purposes; and (c) to provide information about health-related products or services that you provide, or that PracticePal provides on your behalf as your business associate.
From time to time PracticePal may incorporate information it receives from your authorized service providers; (including any third-party product or services) or our third party partners into the Service provided to you. Such information may include, without limitation, clinical information such as lab results, imaging results, eligibility information, and prescription history; and shall, upon incorporation into the Service, be treated as “Your Health Information” for all purposes hereunder. You hereby authorize PracticePal to request and receive such information on your behalf from such authorized service providers or PracticePal’s third party partners.
Trouble Shooting and Maintenance Services:
From time to time, PracticePal, or its duly licensed designee or representative, will perform troubleshooting and maintenance services on the Service and App, including but not limited to (a) bug fixes and code corrections to correct App malfunctions in order to bring the software into substantial conformity with the operating specifications; (b) all extensions, enhancements and other changes that PracticePal, at its sole discretion, makes or adds to the App or Services and which PracticePal furnishes, without charge, to all Users of the App or Service.
You understand and agree that, for troubleshooting and maintenance purposes, if and when You experience an issue with an Eligibility & Benefits Engine search or Optical Sales Tool order within PracticePal App or Service, PracticePal and its customer support team are authorized to access various third-party providers (i.e. insurance portals) in order to troubleshoot, fix or maintain the App or Service, by leveraging an internal Portal-Troubleshooting tool that gives access to the portal while keeping the portal credentials hidden from the customer support team, subject to the conditions and limitations provided herein and the BAA.
22. DE-IDENTIFIED INFORMATION
In consideration of PracticePal’s provision of the Service, you hereby transfer and assign to PracticePal all right, title and interest in and to all De-Identified Information that PracticePal makes from Your Health Information pursuant to Section 21. You agree that PracticePal may use, disclose, market, license and sell such De-Identified Information for any purpose without restriction, and that you have no interest in such information, or in the proceeds of any sale, license, or other commercialization thereof. You acknowledge that the rights conferred by this Section are the principal consideration for the provision of the Service, without which PracticePal would not enter into this Agreement.
23. INDIVIDUALS’ RIGHTS
You are solely responsible for affording individuals their rights with respect to relevant portions of Your Health Information, such as the rights of access and amendment. You will not undertake to afford an individual any rights with respect to any information in the Service other than Your Health Information.
24. GOVERNING LAW; DISPUTE RESOLUTION
Arbitration. We believe we will be able to resolve most disputes or issues you may have using our Service. In the unlikely event we are not able to resolve a dispute or issue, we prefer to specify now what each of us should expect in order to avoid any confusion later. Accordingly, you agree to the following resolution process:
Since we always prefer to find ways to satisfy you as quickly and efficiently as possible, before initiating any arbitration proceeding, you agree to first discuss the matter informally with us for at least 30 days. To do that, please send your full name and contact information, your concern and your proposed solution at HELP@PracticePal.io.
If we are unable to mutually agree upon a resolution after the 30-day period, you agree that any claim you may have against us regarding this Agreement and our Service will be resolved through binding arbitration administered by the American Arbitration Association (“AAA”), governed by the then current Commercial Arbitration Rules and Expedited Procedures, before a single arbitrator. It is important to us that we address any issues you might have promptly. To help us do that, you agree to begin any arbitration within one year after your claim arose; otherwise, your claim is waived. As an exception to this arbitration agreement, we are happy to give you the right to pursue in small claims court any claim that is within that court’s jurisdiction as long as you proceed only on an individual basis.
We prefer to resolve our issues with you directly and, accordingly, you agree to arbitrate with us only in your individual capacity, not as a representative or member of a class. As such, your claims may not be joined with any other claims and there will be no authority for any dispute to be arbitrated on a class-action basis or brought by a purported class representative. You agree that arbitration will be exclusively held in Boise, Idaho, Ada County, or Phoenix, Arizona at PracticePal’s election and that each party will be responsible for its own costs, including paying any AAA filing, administrative and arbitrator fees in accordance with AAA rules. In order to select an arbitrator, each party agrees to provide a list of two available arbitrators that have experience with the subject matter. Each party may strike one of the names on the other party’s list. The parties will select an arbitrator out of the remaining two arbitrator names. If the parties cannot mutually agree on one arbitrator, AAA will choose the arbitrator randomly from the two remaining arbitrators. It is important that you understand that the arbitrator’s decision will be binding and may be entered as a judgment in any court of competent jurisdiction. If you’re not sure what all of this means, of course please feel free to ask an attorney.
Governing Law; Venue.
Any and all claims, causes of action or disputes (regardless of theory) between you and us arising out of or related to these Terms & Conditions, our sites and services or content accessed through our sites and services will be governed by the laws of the State of California, without regard to conflict or choice of law principles.
All claims that you bring against us must be resolved in accordance with this Section 24. All claims filed or brought contrary to this section will be considered improperly filed. Should you file a claim contrary to this section, we may recover attorneys. fees and costs, provided that we have notified you in writing of the improperly filed claim and you have failed to properly withdraw the claim.
In the event You agree that any claims, causes of action or disputes not subject to this Section 24 (Dispute Resolution; Arbitration) will be brought exclusively in courts located within the county of Maricopa, city of Phoenix, Arizona, and you agree to submit to the personal and exclusive jurisdiction of such courts, for any actions. You further agree that, regardless of any statute or law to the contrary, you must file any such claim or cause of action within one (1) year after such claim or cause of action arose or be forever barred.
25. GENERAL PROVISIONS
Assignment. This Agreement, and any rights or obligations in this Agreement will not be assigned by you without the prior written consent of PracticePal. Any attempt to assign or transfer this Agreement other than in accordance with this provision will be null and void. Subject to the forgoing, this Agreement and its terms and provisions inure to the benefit of and are binding upon the parties and their respective successors, heirs, personal representatives, and assigns.
Notices. All notices, requests, or consents sent to PracticePal that are required or permitted under this Agreement must be in writing (including electronic form) and must be delivered to the address designated below in a notice served in the manner provided for below. Each notice, request, consent, or other communication will be given and will be effective: (1) if delivered by hand, when so delivered; (2) if delivered by nationally recognized overnight courier service or sent by United States Express Mail, upon confirmation of delivery; (3) if delivered by certified or registered mail, on the third following day after deposit with the United States Postal Service; or (4) if delivered by facsimile, upon confirmation of successful transmission, and if delivered by email, upon confirmation of receipt by the other party in writing by return email.
Severability. The provisions of this Agreement are severable. The invalidity, in whole or in part, of any provision of this Agreement will not affect the validity or enforceability of any other of its provisions. If one or more provisions of this Agreement are declared invalid or unenforceable, the remaining provisions will remain in full force and effect and will be construed in the broadest possible manner to effectuate the purposes of this Agreement. The parties further agree to replace such void or unenforceable provisions of this Agreement with valid and enforceable provisions that will achieve, to the extent possible, the economic, business, and other purposes of the void or unenforceable provisions.
Captions. The headings and captions of this Agreement are inserted for reference convenience and do not define, limit, or describe the scope or intent of this Agreement or any particular section, paragraph, or provision of this Agreement. Unless otherwise expressly provided, the words “include(s),” “included,” or “including” do not limit the preceding words or terms. Pronouns will refer to the masculine, feminine, neuter, singular, or plural as the context will require.
Waiver. The failure or delay of PracticePal to exercise or enforce any rights or provision of this Agreement does not constitute a waiver of such right or provision.
Survival. All provisions which must survive in order to give effect to their meaning will survive any expiration or termination of this Agreement, and all of your representations, warranties and indemnification obligations, which will survive any expiration or termination of this Agreement indefinitely.
This Business Associate Agreement (“BAA”) is entered between you and/or “Your Organization” (as defined in the PracticePal Term & Conditions and herein) on the one hand, and McClain Investments, LLC dba PracticePal on behalf of itself and its affiliates or representatives (hereinafter collectively (“Business Associate”), on the other hand, each of which is a “Party” and collectively, the “Parties”. The Parties hereto have executed this BAA as of the Effective Date, i.e., the date that Your Organization accepts the Terms & Conditions as provided therein.
- Your Organization is a “Covered Entity,” and PracticePal is a “Business Associate,” as those terms are defined under the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-91), as amended, (“HIPAA”), and the regulations promulgated thereunder by the Secretary of the U.S. Department of Health and Human Services (“Secretary”), including, without limitation, the regulations codified at 45 C.F.R. Parts 160 and 164 (“HIPAA Regulations”);
- As a Covered Entity, Your Organization creates, receives, maintains, transmits, and/or otherwise has access to Protected Health Information (“PHI”), including via your or Your Organization’s accounts with one or more Vision Care Plan or other third party that provide access to PHI (hereinafter a “VCP”);
- As a Business Associate, PracticePal is an entity that performs certain functions or activities that involve the use or disclosure of PHI on behalf of, or provides services to, a Covered Entity. PracticePal also receives PHI and performs Services as a Subcontractor of other Business Associate(s). Such “Subcontractors” are defined as “Business Associates” of PracticePal pursuant to the HIPAA Regulations;
- In the performance of Business Associate functions or services on behalf of Covered Entities or other Business Associate(s), PracticePal also subcontracts with certain other entities that perform Services for or on behalf of PracticePal, and in performing said Services, create, receive, maintain, or transmit PHI;
- The Parties intend to protect the privacy and provide for the security of PHI Disclosed by Your Organization to Business Associate, or received or created by Business Associate, when providing Services in compliance with HIPAA, the Health Information Technology for Economic and Clinical Health Act (Public Law 111-005) (“the HITECH Act”) and its implementing regulations and guidance issued by the Secretary, and other applicable state and federal laws, all as amended from time to time; and
- Your Organization is required under HIPAA to enter into a BAA with each Business Associate that meets certain requirements with respect to the Use and Disclosure of PHI, which are met by this BAA.
In consideration of the Recitals and for other good and valuable consideration, the receipt and adequacy of which is hereby acknowledged, the Parties agree as follows:
The following terms shall have the meaning set forth below. Capitalized terms used in this BAA and not otherwise defined shall have the meanings ascribed to them in the HIPAA Regulations.
- 1.1.“Breach” shall have the meaning given under and 45 C.F.R. § 164.402.
- 1.2.“Designated Record Set” shall have the meaning given such term under 45 C.F.R. § 164.501.
- 1.3.“Disclose” and “Disclosure” mean, with respect to PHI, the release, transfer, provision of access to, or divulging in any other manner of PHI outside of Business Associate or to other than member of its Workforce, as set forth in 45 C.F.R. § 160.103.
- 1.4.“Electronic PHI” or “e-PHI” means PHI that is transmitted or maintained in electronic media, as set forth in 45 C.F.R. § 160.103.
- 1.5.“Protected Health Information” and “PHI” mean any information, whether oral or recorded in any form or medium, that: (a) relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual, or the past, present or future payment for the provision of health care to an individual; (b) identifies the individual (or for which there is a reasonable basis for believing that the information can be used to identify the individual); and (c) shall have the meaning given to such term under 45 C.F.R. § 160.103. Protected Health Information includes e-PHI.
- 1.6.“Required by Law” shall have the meaning given to such term under 45 C.F.R. § 160.103.
- 1.7.“Security Incident” shall have the meaning given to such term under 45 C.F.R. § 164.304.
- 1.8.“Services” shall mean the services for or functions on behalf of Your Organization performed by Business Associate pursuant to any service agreement(s) between Your Organization and Business Associate which may be in effect now or from time to time (“Underlying Agreement”), or, if no such agreement is in effect, the services or functions performed by Business Associate that constitute a Business Associate relationship between Your Organization and Business Associate, as set forth in 45 C.F.R. § 160.103.
- 1.9.“Unsecured PHI” shall have the meaning given to such term under 42 U.S.C. § 17932(h), 45 C.F.R. § 164.402, and guidance issued pursuant to the HITECH Act including, but not limited to the guidance issued on April 17, 2009 and published in 74 Federal Register 19006 (April 27, 2009) by the Secretary.
- 1.10.“Use” or “Uses” mean, with respect to PHI, the sharing, employment, application, utilization, examination or analysis of such PHI within Business Associate’s internal operations, as set forth in 45 C.F.R. § 160.103.
- 1.11.“Workforce” shall have the meaning given to such term under 45 C.F.R. § 160.103.
- 2.1.Permitted Uses and Disclosures of Protected Health Information. Business Associate shall not Use or Disclose PHI received, accessed, or created for or on behalf of Your Organization except to perform the Services required by any Underlying Agreement, or as permitted by this BAA or Required by Law. Business Associate shall not Use or Disclose PHI in any manner that would constitute a violation of the HIPAA Regulations if so Used or Disclosed by Your Organization or a Covered Entity. Creation, Use, or Disclosure of de-identified PHI is not permitted by this BAA without the prior written consent of Your Organization.
- 2.2.Compliance with Privacy Provisions. Business Associate shall only Use and Disclose PHI in compliance with each applicable requirement of 45 C.F.R. § 164.504(e).
- 2.3.Adequate Safeguards of PHI. Business Associate shall comply with Subpart C of 45 C.F.R. Part 164 with respect to PHI, to reasonably and appropriately protect the confidentially, integrity, and availability of e-PHI that it creates, receives, maintains or transmits on behalf of Your Organization.
- 2.4.Mitigation. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in violation of the requirements of this BAA.
- 2.5.Reporting Non-Permitted Use or Disclosure.
- 2.5.1.Reporting Security Incidents and Non-Permitted Uses or Disclosures. Business Associate shall report to Your Organization in writing each Security Incident or Use or Disclosure that is made by Business Associate, members of its Workforce, or Subcontractors that is not specifically permitted by this BAA no later than three (3) calendar days after becoming aware of such Security Incident or non-permitted Use or Disclosure, in accordance with the notice provisions set forth herein. Notwithstanding the foregoing, Business Associate and Your Organization acknowledge the ongoing existence and occurrence of attempted but ineffective Security Incidents that are trivial in nature, such as pings and other broadcast service attacks, and Your Organization acknowledges and agrees that no additional notification to Covered Entity of such ineffective Security Incidents is required, as long as no such incident results in unauthorized access, Use or Disclosure of PHI. Business Associate shall investigate each unauthorized access, acquisition, Use, or Disclosure of PHI that it creates, receives, maintains, or transmits for or on behalf of Your Organization. If such Security Incident or non-permitted Use or Disclosure constitutes a reportable Breach of Unsecured PHI, then Your Organization shall comply with the requirements of Section 2.5.2 below.
- 2.5.2.Breach of Unsecured PHI. Business Associate shall notify Your Organization of such Breach in writing without unreasonable delay but no later than three (3) calendar days after Discovery of the Breach. Business Associate shall be deemed to have Discovered a Breach as of the first day that the Breach is either known to Business Associate or any of its employees, officers or agents, other than the person who committed the Breach, or by exercising reasonable diligence should have been known to Business Associate or any of its employees, officers or agents, other than the person who committed the Breach. To the extent the information is available to Business Associate, Business Associate’s written notice shall include the information required by 45 C.F.R. §164.410. Business Associate shall promptly supplement the written report with additional information regarding the Breach as it obtains such information. Business Associate shall cooperate with Your Organization in meeting Your Organization’s obligations with respect to such Breach. Your Organization shall have sole control over the timing and method of providing notification of such Breach to the affected individual(s), the Secretary and, if applicable, the media. Business Associate shall reimburse Your Organization for its reasonable costs and expenses in providing the notification, including, but not limited to, any administrative costs associated with providing notice, printing and mailing costs, and costs of mitigating the harm (which may include the costs of obtaining credit monitoring services and identity theft insurance) for affected individuals whose PHI has or may have been compromised as a result of the Breach.
- 2.5.3.Security Breaches. Business Associate agrees that in the event that PHI constituting “personal information” to which Business Associate has access is acquired by any unauthorized person, Business Associate shall notify Your Organization of the breach of security within three (3) calendar days, and comply with all legal requirements with respect thereto.
- 2.6.Delegated Responsibilities. To the extent that Business Associate carries out one or more of Your Organization’s obligations under Subpart E of 45 C.F.R. Part 164, Business Associate must comply with the requirements of Subpart E that apply to Covered Entities in the performance of such obligations.
- 2.7.Availability of Internal Practices, Books, and Records to Government. Business Associate agrees to make its internal practices, books and records relating to the Use and Disclosure of PHI received from, or created or received by the Business Associate on behalf of Your Organization available to the Secretary for purposes of determining Your Organization’s compliance with HIPAA, the HIPAA Regulations, and the HITECH Act.
- 2.8.Access to and Amendment of Protected Health Information. To the extent that Business Associate maintains a Designated Record Set on behalf of Your Organization and within ten (10) calendar days of such request by Your Organization, Business Associate shall (a) make the PHI it maintains (or which is maintained by its Subcontractors) in Designated Record Sets available to Your Organization for inspection and copying or, if requested by Your Organization, to an individual, to enable Your Organization to fulfill its obligations under 45 C.F.R. § 164.524, or (b) amend the PHI it maintains (or which is maintained by its Subcontractors) in Designated Record Sets to enable Your Organization to fulfill its obligations under 45 C.F.R. § 164.526. If Business Associate maintains PHI in a Designated Record Set electronically, Business Associate shall provide such information in the electronic form and format requested by Your Organization if it is readily reproducible in such form and format, and, if not, in such other form and format agreed to by Your Organization to enable Your Organization to fulfill its obligations under 45 C.F.R. § 164.524(c)(2).
- 2.9.Accounting. To the extent that Business Associate maintains a Designated Record Set on behalf of Your Organization, within twenty (20) calendar days of receipt of a request from Your Organization or an individual for an accounting of disclosures of PHI, Business Associate and its Subcontractors shall make available to Your Organization the information required to provide an accounting of disclosures to enable Your Organization to fulfill its obligations under 45 C.F.R. § 164.528.
- 2.10.Use of Subcontractors. Business Associate shall require each of its Subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate, to execute a written agreement that includes substantially the same restrictions and conditions that apply to Business Associate under this BAA with respect to PHI.
- 2.11.Audit. Your Organization shall have the right to audit and monitor all applicable activities and records of Business Associate to determine Business Associate's compliance with the requirements relating to the creation or Use and Disclosure of PHI as it relates to the privacy and security sections of this BAA.
- 2.12.Minimum Necessary. Business Associate (and its Business Associates) shall, to the extent practicable, limit its request, Use, or Disclosure of PHI to the minimum amount of PHI necessary to accomplish the purpose of the request, Use or Disclosure, in accordance with 42 U.S.C. § 17935(b) and 45 C.F.R. § 164.502(b)(1) or any other guidance issued thereunder.
TERM AND TERMINATION
- 3.1.Term. Subject to the provisions of Section 3.2, the term of this BAA shall be the term of any Underlying Agreement.
- 3.2.Termination for Cause. In addition to and notwithstanding the termination provisions set forth in any Underlying Agreement, upon Your Organization’s knowledge of a material breach or violation of this BAA by Business Associate, Your Organization shall either:
- 3.2.1.Notify Business Associate of the breach in writing, and provide an opportunity for Business Associate to cure the breach or end the violation within ten (10) business days of such notification; provided that if Business Associate fails to cure the breach or end the violation within such time period to the satisfaction of Your Organization, Your Organization may immediately terminate this BAA and any Underlying Agreement upon written notice to Business Associate; or
- 3.2.2.Upon written notice to Business Associate, immediately terminate this BAA and any
Underlying Agreement if Your Organization determines that such breach cannot be cured.
- 3.3.Disposition of Protected Health Information Upon Termination.
- 3.3.1.Upon termination or expiration of this BAA, Business Associate shall either return or destroy all PHI received from, or created or received by Business Associate on behalf of Your Organization, that Business Associate still maintains in any form and retain no copies of such PHI. If Your Organization requests that Business Associate return PHI, PHI shall be returned in a mutually agreed upon format and timeframe, at no additional charge to Your Organization.
- 3.3.2.If return or destruction is not feasible, Business Associate shall (a) retain only that PHI which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities; (b) return to Your Organization the remaining PHI that the Business Associate still maintains in any form; (c) continue to extend the protections of this BAA to the PHI for as long as Business Associate retains the PHI; (d) limit further Uses and Disclosures of such PHI to those purposes that make the return or destruction of the PHI not feasible and subject to the same conditions set out in Section 2.1 – 2.3 above, which applied prior to termination; and (e) return to Your Organization the PHI retained by Business Associate when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities.
- 4.1.Amendment to Comply with Law. This BAA shall be deemed amended to incorporate any mandatory obligations of Your Organization or Business Associate under the HITECH Act and its implementing HIPAA Regulations. Additionally, the Parties agree to take such action as is necessary to amend this BAA from time to time as necessary for Your Organization to implement its obligations pursuant to HIPAA, the HIPAA Regulations, or the HITECH Act.
- 4.2.Relationship to Underlying Agreement Provisions. In the event that a provision of this BAA is contrary to a provision of an Underlying Agreement, the provision of this BAA shall control. Otherwise, this BAA shall be construed under, and in accordance with, the terms of such Underlying Agreement, and shall be considered an amendment of and supplement to such Underlying Agreement, subject to Section 4.3 below.
- 4.3.Indemnification. Notwithstanding anything to the contrary which may be contained in any Underlying Agreement, including but not limited to any limitations on liability contained therein, Business Associate hereby agrees to indemnify and hold harmless Your Organization, its affiliates, and their respective officers, directors, managers, members, shareholders, employees and agents from and against any and all fines, penalties, damages, claims or causes of action and expenses (including, without limitation, court costs and attorney’s fees) arising from any violation of HIPAA, the HIPAA Regulations, or the HITECH Act or from any negligence or wrongful acts or omissions (including but not limited to failure to perform its obligations) that results in a violation of HIPAA, the HIPAA Regulations, or the HITECH Act, by Business Associate or its employees, directors, officers, Business Associates, or other members of Business Associate’s Workforce. In the event of a Breach, Your Organization shall be entitled to enjoin and restrain Business Associate from any continued violation of this BAA.
- 4.4.Choice of Law; Arbitration. This Agreement and the rights of the Parties hereunder shall be governed by and construed in accordance with the laws of the State of California including all matters of construction, validity, performance, and enforcement and without giving effect to the principles of conflict of laws. Either Covered Entity or Business Associate may, without the other’s consent, elect mandatory, binding arbitration of any claim, dispute, or controversy raised by either Covered Entity or Business Associate against the other arising under this Business Associate Agreement (each a “Claim”). All Claims, including those for injunctive relief, are subject to arbitration, no matter what theory they are based on or what remedy they seek. If Covered Entity or Business Associate elects arbitration, the arbitration will be conducted as an individual arbitration. Neither Covered Entity nor Business Associate consents or agrees to any arbitration on a class or representative basis, and the arbitrator shall have no authority to proceed with an arbitration on a class or representative basis. No arbitration will be consolidated with any other arbitration proceeding without the consent of all parties. This arbitration provision applies to and includes any Claims made and remedies sought as part of any class action, private attorney general action, or other representative action. The arbitration shall be administered by the American Arbitration Association (“AAA”) the arbitration in the city of Boise, Idaho or Phoenix, Arizona at the election of Business Associate. The AAA will apply its rules, codes, or procedures in effect at the time the arbitration is filed. The arbitration shall be before a single arbitrator. The prevailing party in the arbitration of any Claim shall be awarded the fees it paid to the arbitration organization in connection with the arbitration and reasonable attorneys’ fees and other costs in accordance with the AAA rules.
- 4.5.Notices. Any notices required or permitted to be given hereunder by either Party to the other shall be given in writing: (1) by personal delivery; (2) by electronic mail or facsimile with confirmation sent by United States first class registered or certified mail, postage prepaid, return receipt requested; (3) by bonded courier or by a nationally recognized overnight delivery service; or (4) by United States first class registered or certified mail, postage prepaid, return receipt, in each case, addressed to a Party on the signature page(s) to this BAA, or to such other addresses as the Parties may request in writing by notice given pursuant to this Section 4.4. Notices shall be deemed received on the earliest of personal delivery; upon delivery by electronic facsimile with confirmation from the transmitting machine that the transmission was completed; twenty-four (24) hours following deposit with a bonded courier or overnight delivery service; or seventy-two (72) hours following deposit in the U.S. mail as required herein.
Notice Address: As provided by You.
- 4.6.Relationship of Parties. Notwithstanding anything to the contrary in any Underlying Agreement, Business Associate is an independent contractor and not an agent of Your Organization under this BAA. Business Associate has the sole right and obligation to supervise, manage, contract, direct, procure, perform or cause to be performed all Business Associate obligations under this BAA.
- 4.7.Interpretation. This BAA shall be interpreted as broadly as necessary to implement and comply with HIPAA, the HIPAA Regulations and the HITECH Act. The parties agree that any ambiguity in this BAA shall be resolved in favor of a meaning that complies and is consistent with such laws.
- 4.8.State Privacy Laws. Business Associate shall comply with state laws to extent that such state privacy laws are not preempted by HIPAA or the HITECH Act.
- 4.9.Survival. The respective rights and obligations of the Parties under Sections 2.4, 3.3, and 4.3 of this BAA shall survive the termination of this BAA.
- 4.10.Execution; Counterparts. By acceptance of the Term & Conditions as provided therein, this Business Associate Agreement has been executed electronically by you or a duly authorized representative of Your Organization or Covered Entity.