Nemira, Inc. Business Associate Agreement
COVER PAGE
USING THIS BAA This BAA has 2 parts: (1) the Key Terms on this Cover Page and (2) the Common Paper BAA Standard Terms Version 1.0 posted at https://commonpaper.com/standards/business-associate-agreement/1.0, which is incorporated by reference. Any modifications to the BAA Standard Terms should be made on the Cover Page. If there is any inconsistency between the parts of the BAA, the Cover Page will control over the BAA Standard Terms. Capitalized words have the meanings or descriptions given in the Cover Page or Standard Terms. A copy of the BAA Standard Terms is attached for convenience only. | |
Key Terms The key legal terms of this BAA are as follows: | |
Agreement | This BAA is incorporated into the Nemira, Inc. Terms of Service posted at https://nemira.app/terms, or any other agreement between Provider and Company for the Services (the "Agreement"). |
|---|---|
Relationship | Provider is a Business Associate. Company is a Covered Entity. |
Breach Notification Period | Without unreasonable delay, and no later than 10 calendar days after discovery of a Breach of Unsecured PHI, with supplemental details as they become available, and no later than 30 calendar days after discovery for any other report required by Section 4.1 |
Designated Record Set | Selected: Provider maintains PHI in a Designated Record Set. |
Limitations | Subcontracting: Selected: Provider will not subcontract unless: Selected: notice has been provided to Company as specified here: Provider lists every Subcontractor that handles PHI, with its BAA status, at https://nemira.app/security, and updates that list, with an option for Company to receive email notice of each update, before a new Subcontractor receives PHI. Offshoring: Selected: Offshoring of PHI and/or Services not permitted unless: PHI is stored and hosted only on servers located in the United States. Provider's personnel may access PHI remotely from outside the United States, but never from a country subject to comprehensive U.S. sanctions or embargoes or from a country of concern named in U.S. Department of Justice rules on access to Americans' bulk sensitive personal data, only through Provider's US-hosted systems, using multi-factor authentication, encrypted connections, and company-managed or company-approved devices with full-disk encryption, without downloading or storing PHI on the device, and with access logged, and only as needed to support and maintain the Services. De-identification: Selected: Provider will not de-identify PHI unless: Selected: it uses a de-identification method that meets HIPAA, solely for the specific purpose of producing aggregate statistics about use of the Services (such as counts of bookings) to operate and improve the Services. Provider will never sell de-identified data or use it to train artificial intelligence models. Aggregation: Selected: Provider will not aggregate PHI unless the result is limited to counts and usage statistics that do not identify any individual or Company, used only to operate and improve the Services. |
BAA Effective Date The date the BAA starts | Selected: The date Company accepts the Agreement electronically, or the date of last signature on this Cover Page, whichever is earlier. |
Changes to BAA Standard Terms | |
Other Changes to BAA Standard Terms Additional modifications or customizations | 1. Electronic acceptance. Company may accept this BAA electronically when it accepts the Agreement. Acceptance must come from a person authorized to bind Company, through a separate checkbox that links to this BAA. Provider will keep a record of each acceptance, including the date, time, accepting user, and BAA version, and will make a copy available in Company's account. A signature on this Cover Page is not required, and Provider will countersign a copy on request. 2. Liability. Claims under this BAA, including under Section 4.3 (Security Incident Reimbursement), are Increased Claims under the Agreement and are subject to the Increased Cap Amount. Nothing in the Agreement limits either party's liability for its own fraud or willful misconduct. 3. Security Incident costs. The costs Provider reimburses under Section 4.3 are limited to reasonable, documented costs of (a) notices to individuals, regulators, and media that the law requires, (b) up to 12 months of credit or identity monitoring where the law requires it or where the Breach exposed financial account or government ID numbers, (c) a call center for affected individuals, and (d) forensic investigation, and do not include Company's lost profits or internal staff time. 4. Patient-facing features. This BAA covers PHI that Provider creates, receives, maintains, or transmits for Company, including PHI patients submit to Company through the Services. Patient login credentials and information a patient gives Provider for Provider's own purposes are governed by Provider's Patient Terms and Privacy Policy. |
Provider and Company have not changed the BAA Standard Terms except for the details on the Cover Page above. By signing or electronically accepting this Cover Page, each party agrees to enter into this BAA as of the BAA Effective Date.
PROVIDER: Nemira, Inc. | COMPANY: The clinic that accepts this BAA in its Nemira account | |
|---|---|---|
Signature | ||
Print Name | ||
Title | ||
Notice Address Use email or postal address | The email address of the clinic's account owner in Nemira | |
Date |
STANDARD TERMS
1. Business Associate Obligations
1.1 Obligations and Restrictions. Provider may not use or disclose PHI other than as described in this BAA, as permitted under the Privacy Rule, or as otherwise required by applicable law.
1.2 Permitted Uses and Disclosures. Except as otherwise permitted or required in this BAA, Provider may only use or disclose PHI as reasonably necessary to provide the Services or as otherwise required by applicable law.
1.3 Privacy and Information Security Program. Provider will maintain a privacy and information security program that takes steps to ensure that employees or agents of Provider comply with this BAA. This includes giving training to Provider’s workforce to ensure compliance with this BAA, implementing policies and practices that meet the current standards for the protection of PHI, and appointing Privacy and Security Officials as required under HIPAA.
1.4 Safeguards. Provider will implement appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of PHI that it receives, creates, maintains, or transmits on behalf of Company. Provider will maintain appropriate technical and organizational safeguards to reduce the risk of misuse or disclosure of PHI except as permitted under this BAA. In addition, Provider will comply with its obligations under the Security Rule.
1.5 Assessments. Provider agrees to conduct regular assessments of its compliance with its obligations under the Privacy Rule and Security Rule. Provider will make available a summary of such assessments to Company upon Company’s reasonable request.
1.6 Mitigation of Risks. Provider agrees to mitigate, to the extent practicable, any harmful effect that is known to Provider of a use or disclosure of PHI by Provider and to promptly communicate to Company any actions taken pursuant to this paragraph.
1.7 Subcontractors. Except as restricted by applicable Limitations, (a) Provider may disclose PHI to a Subcontractor; and (b) may allow the Subcontractor to create, receive, maintain, or transmit PHI on its behalf. However, Provider must first ensure that each Subcontractor executes a binding, written agreement requiring the Subcontractor to protect PHI under terms substantially similar to and no less stringent than this BAA. Provider will not be in compliance with this BAA if Provider knew of a pattern of activity or practice of a Subcontractor that constituted a material breach or violation of the Subcontractor’s obligations under any agreement between Provider and the Subcontractor. Provider will conduct appropriate due diligence on all Subcontractors.
1.8 Books and Records to HHS. Upon request, Provider will make its books, records, and internal policies and procedures relating to the use and disclosure of PHI available to the Secretary of HHS for the purpose of determining Company’s and Provider’s compliance with HIPAA.
1.9 Audit of Books and Records. Upon reasonable request, Provider will make its books, records, and internal policies and procedures relating to its compliance with this BAA available to Company. However, Provider is not required to provide any information or records that interfere with Provider’s confidentiality or proprietary rights or that would otherwise impact Provider’s compliance with its legal obligations.
1.10 Individual Requests. Provider will take reasonable efforts to support Company in completing requests related to individuals’ rights under HIPAA as related to the Services in a timely manner, but in no event will Provider’s response take more than ten business days. Examples of individual rights under HIPAA include the right to access PHI pursuant to 45 CFR §164.524, amend PHI pursuant to 45 CFR §164.526, and receive accounting of disclosures pursuant to 45 CFR §164.528. If relevant to the Services, Provider will maintain an accounting of disclosures it makes on Company’s behalf as required under 45 CFR §164.528(a). Except as directed by Company or required by law, Provider will not respond directly to any individual requests regarding their rights under HIPAA.
1.11 Compliance with Covered Entity’s Obligations. To the extent that Provider carries out Company's obligations under the Privacy Rule, Provider will comply with the requirements of the relevant Privacy Rule regulations that apply to Company in the performance of such obligations.
2. Company Obligations
2.1 Notice of Privacy Practices. Upon request, Company will provide Provider with its current notice of privacy practices adopted as required by the Privacy Rule. Company will notify Provider if any limitations in its notice of privacy practices impact Provider’s use or disclosure of PHI under the BAA.
2.2 Notice of Changes. Company will notify Provider in a timely manner of any changes to how Company uses or discloses PHI to the extent that the changes impact how Provider uses or discloses PHI under the BAA.
2.3 Notice of Restrictions. Company will notify Provider in a timely manner of any restrictions agreed upon with an individual or their legal representative to the extent that the restrictions may impact Provider’s use or disclosure of PHI under the BAA.
2.4 Compliance with Laws. Company will only use and disclose PHI to Provider in accordance with its obligations under HIPAA and with applicable law.
3. Data Rights & Restrictions
3.1 Offshoring PHI. Except as restricted by applicable Limitations, Provider is permitted to use and disclose PHI outside of the United States to provide the Services.
3.2 De-Identification. Except as restricted by applicable Limitations, Provider may de-identify PHI.
3.3 Aggregation. Except as restricted by applicable Limitations, Provider may aggregate PHI for its own purposes.
4. Breach Notification
4.1 Breach Reporting. Provider will report to Company within the Breach Notification Period each use or disclosure of PHI not permitted under this BAA of which Provider becomes aware, including breaches of unsecured PHI as required by §164.410 of HIPAA and any Security Incident involving PHI. In addition, each party will comply with its notification obligations under HIPAA regarding a Security Incident involving PHI.
4.2 Unsuccessful Attempts. Company agrees that this section will be deemed as sufficient notice under Section 4.1 if Provider periodically receives unsuccessful attempts for unauthorized access to, use of, or disclosure of PHI, or for general interference with the general operation of Provider’s products and services.
4.3 Security Incident Reimbursement. Provider will reimburse Company for costs reasonably associated with a Security Incident caused by Provider or one of its Subcontractors.
4.4 Confidentiality. Provider will not disclose information related to a Security Incident except as required by applicable law.
5. Term & Termination
5.1 Term. This BAA will start on the BAA Effective Date and will continue in effect until the later of when all obligations of the parties have been met under this BAA or when the Agreement ends or expires.
5.2 Termination. Either party may terminate this BAA if the other party fails to cure a material breach of the BAA within 30 days after receiving notice of the breach. A material breach of the BAA will be deemed a material breach of the Agreement.
5.3 Effect of Termination.
(a) Upon any expiration or termination of this BAA, or earlier if directed by Company, Provider will either return or destroy, at Company’s discretion and according to Company’s instructions, all PHI maintained in any form by Provider, its agents, or its Subcontractors.
(b) Provider may not retain any copies of PHI unless directed to do so by Company. However, if neither return nor destruction are feasible, Provider may retain PHI as long as Provider continues to comply with all provisions of this BAA for the time it retains PHI and limits the use or disclosure of retained PHI to those purposes that made the return or destruction of PHI infeasible.
6. Definitions
6.1 Defining Variables. Variables have the meanings or descriptions given on the Cover Page. However, if the Cover Page omits or does not define a Variable, the default meaning will be “none” or “not applicable” and the correlating clause, sentence, or section does not apply to the BAA.
6.2 “BAA” means the Cover Page between Provider and Company that incorporates these BAA Standard Terms and any policies and documents referenced in or attached to the Cover Page.
6.3 “BAA Standard Terms” means these Common Paper BAA Standard Terms Version 1.0, which are posted at https://commonpaper.com/standards/business-associate-agreement/1.0.
6.4 “Breach” has the meaning given to it under HIPAA.
6.5 “Business Associate” has the meaning given to it under HIPAA.
6.6 “Covered Entity” has the meaning given to it under HIPAA.
6.7 “Cover Page” means a document that is signed by the parties, identifies Provider and Company, incorporates these BAA Standard Terms, and includes definitions or descriptions for Variables.
6.8 “Designated Record Set” has the meaning given to it under HIPAA.
6.9 "HHS” means the U.S. Department of Health and Human Services.
6.10 “HIPAA” means the Health Insurance Portability and Accountability Act of 1996 and the rules and regulations thereunder, as amended from time to time.
6.11 “Privacy and Security Officials” has the meaning given to it under HIPAA.
6.12 “Privacy Rule” means the federal privacy regulations issued pursuant to HIPAA, codified at 45 CFR Parts 160 and 164 (Subparts A & E).
6.13 “Protected Health Information” or “PHI” has the meaning given to it under HIPAA.
6.14 “Security Incident” has the meaning given to it under HIPAA.
6.15 “Security Rule” means the federal security regulations issued pursuant to HIPAA, codified at 45 CFR Parts 160 and 164 (Subparts A & C).
6.16 “Services” means the products and services provided by Provider under the Agreement.
6.17 “Subcontractor” means a third party to whom Provider provides PHI under this BAA.
6.18 “Variable” means a word or phrase in the BAA Standard Terms that is highlighted and capitalized, such as Limitations.