Business associate agreement
Version 1.3
BY CHECKING THE BOX OR CLICKING "I AGREE," "ACCEPT," OR A SIMILAR CONTROL PRESENTED WITH THIS AGREEMENT DURING SIGN-UP, UPGRADE, OR USE OF THE SERVICE, THE ORGANIZATION ACCEPTING IT AGREES TO BE LEGALLY BOUND BY THIS BUSINESS ASSOCIATE AGREEMENT.
This Business Associate Agreement (this "Agreement") is between Helix Reserve LLC, an Arizona limited liability company ("Business Associate"), and the organization accepting it ("Covered Entity"). It governs Business Associate's handling of Protected Health Information in connection with the Lumagen service (the "Service"). If you accept this Agreement on behalf of an organization, you represent that you have authority to bind it.
1. Business Associate obligations
1.1 Use and disclosure. Business Associate will not use or disclose PHI other than as permitted by this Agreement, as permitted by the Privacy Rule, or as Required by Law. Except as otherwise permitted in this Agreement, Business Associate uses and discloses PHI only as reasonably necessary to provide the Service.
1.2 Management and administration. Business Associate may use PHI for its proper management and administration and to carry out its legal responsibilities, and may disclose PHI for those purposes if the disclosure is Required by Law or Business Associate obtains reasonable assurances from the recipient that it will keep the PHI confidential, use or disclose it only as Required by Law or for the purpose for which it was disclosed, and notify Business Associate of any breach of its confidentiality.
1.3 Privacy and security program. Business Associate maintains a privacy and information security program designed to ensure that its workforce complies with this Agreement. The program includes workforce training, written policies and procedures that meet the Security Rule, and designated Privacy and Security Officials.
1.4 Safeguards. Business Associate implements appropriate administrative, physical and technical safeguards to protect the confidentiality, integrity and availability of the PHI it creates, receives, maintains or transmits on Covered Entity's behalf, and complies with the Security Rule. These include encryption of PHI in transit and at rest, multi-factor authentication on every account on a paid plan, isolation of each customer's data at the database level, and an audit record of every change of state and every clinical decision in the Service.
1.5 Assessments. Business Associate regularly assesses its compliance with the Privacy Rule and the Security Rule, and makes a summary available to Covered Entity on reasonable request.
1.6 Minimum necessary. Business Associate requests, uses and discloses only the minimum PHI necessary for the purpose.
1.7 No training, no sale. Business Associate does not use PHI to train, fine-tune or improve any machine learning model. Business Associate does not sell PHI and does not use or disclose it for marketing. Nothing in this Section limits Business Associate's rights in De-identified Information under Section 3.2.
1.8 Mitigation. Business Associate mitigates, to the extent practicable, any harmful effect known to it of a use or disclosure of PHI in violation of this Agreement, and tells Covered Entity what it has done.
1.9 Subcontractors. Business Associate may allow a Subcontractor to create, receive, maintain or transmit PHI on its behalf only after the Subcontractor agrees in writing to restrictions and conditions at least as protective as this Agreement. Business Associate performs appropriate due diligence on its Subcontractors, remains responsible for their performance, and keeps a current list of them at lumagen.ai/subprocessors. Business Associate gives Covered Entity thirty (30) days' notice before a new Subcontractor begins processing PHI.
1.10 Books and records. Business Associate makes its internal practices, books and records relating to PHI available to the Secretary of HHS for determining compliance with HIPAA, and, on Covered Entity's reasonable request, makes available the records relating to its compliance with this Agreement, except where doing so would breach a legal obligation or disclose another customer's information or Business Associate's proprietary information.
1.11 Individual rights. Within ten (10) business days of Covered Entity's request, Business Associate makes PHI in a Designated Record Set available for access under 45 CFR 164.524, makes amendments under 45 CFR 164.526, and provides the information needed for an accounting of disclosures under 45 CFR 164.528. Covered Entity may also export its records from the Service at any time. Business Associate forwards to Covered Entity any request it receives directly from an individual and does not respond to it except as Covered Entity directs or as Required by Law.
1.12 Covered Entity's obligations. To the extent Business Associate carries out an obligation of Covered Entity under the Privacy Rule, it complies with the requirements that apply to Covered Entity in performing it.
2. Covered Entity obligations
2.1 Notice of privacy practices. Covered Entity will tell Business Associate of any limitation in its notice of privacy practices that affects Business Associate's use or disclosure of PHI.
2.2 Changes and restrictions. Covered Entity will tell Business Associate in a timely manner of any change in, or revocation of, an individual's permission, and of any restriction Covered Entity has agreed to under 45 CFR 164.522, to the extent it affects Business Associate's use or disclosure of PHI and can be implemented in the Service.
2.3 Compliance. Covered Entity will submit PHI to the Service only in accordance with HIPAA and other applicable law, and will not ask Business Associate to use or disclose PHI in a way that would violate HIPAA if done by Covered Entity.
2.4 Covered Entity's performance. Business Associate is excused from an obligation under this Agreement to the extent its performance depends on Covered Entity performing its own obligations and Covered Entity has not done so.
3. Data rights
3.1 Scope. This Agreement applies to Covered Entity's use of the Service on every plan, including the free plan, from the moment Covered Entity accepts it.
3.2 De-identification. On every plan, Business Associate may de-identify PHI in accordance with 45 CFR 164.514(a) and (b), by expert determination or safe harbor ("De-identified Information"), and may aggregate it with other information. De-identified Information is not PHI. Business Associate may use and disclose it for any lawful purpose, including to operate and improve the Service, for research, publication and benchmarking, and to build datasets and products it may license or otherwise provide to others, including on commercial terms, and this permission survives termination. Business Associate does not attempt to re-identify De-identified Information, requires anyone it provides it to do the same, and does not identify Covered Entity as its source without Covered Entity's written agreement. Any limit on commercial use that Covered Entity has agreed in a master services agreement or order form applies.
3.3 Data aggregation. Business Associate may use PHI to provide data aggregation services relating to Covered Entity's health care operations, as permitted by 45 CFR 164.504(e)(2)(i)(B).
4. Breach notification
4.1 Reporting. Business Associate reports to Covered Entity, without unreasonable delay and in no case later than five (5) business days after discovery, any use or disclosure of PHI not permitted by this Agreement, any Breach of Unsecured PHI as required by 45 CFR 164.410, and any Security Incident that results in unauthorized access to, or use, disclosure, modification or destruction of, PHI. The report includes the information Covered Entity reasonably needs to meet its own notification obligations, supplemented as it becomes available.
4.2 Unsuccessful attempts. This Section is notice of, and no further report is required for, unsuccessful Security Incidents such as pings, port scans, unsuccessful log-in attempts, denial-of-service attempts that do not succeed, and similar events that do not result in unauthorized access to, or use, disclosure, modification or destruction of, PHI.
4.3 Notifying others. Covered Entity is responsible for notifying affected individuals, the Secretary and the media where HIPAA requires it, and Business Associate provides the information Covered Entity reasonably needs to do so. Business Associate does not disclose information about a Security Incident except to Covered Entity or as Required by Law.
5. Term and termination
5.1 Term. This Agreement starts when Covered Entity accepts it and continues until all PHI has been returned or destroyed under Section 5.3.
5.2 Termination. Either party may terminate this Agreement if the other fails to cure a material breach within thirty (30) days after written notice of it. A material breach of this Agreement is a material breach of any services agreement between the parties.
5.3 Return or destruction. On termination, or earlier at Covered Entity's request, Business Associate deletes the PHI it maintains on Covered Entity's behalf, and Covered Entity may export its records before it does. Deletion is available to Covered Entity directly in the Service and takes effect in a single transaction. Business Associate does not promise total destruction: three things remain by design, none of which contains clinical content or identifies a patient: the audit record of what happened and when, a record that Covered Entity's organization existed and was deleted, and the usage records Business Associate's risk-model licences require. PHI may persist in encrypted backups until they expire on their ordinary schedule. Where return or destruction of PHI is infeasible, Business Associate extends this Agreement's protections to it and limits further use and disclosure to the purposes that make return or destruction infeasible.
6. Definitions
Capitalized terms used but not defined in this Agreement, including Breach, Business Associate, Covered Entity, Designated Record Set, Privacy and Security Officials, Protected Health Information or PHI (limited to the information Covered Entity submits to or generates within the Service), Required by Law, Security Incident, Subcontractor and Unsecured PHI, have the meanings given to them under HIPAA. "HIPAA" means the Health Insurance Portability and Accountability Act of 1996 and its regulations at 45 CFR Parts 160 and 164, as amended, including by the HITECH Act. "Privacy Rule" and "Security Rule" mean Subparts A and E, and Subparts A and C, of 45 CFR Parts 160 and 164. "HHS" means the U.S. Department of Health and Human Services.
7. General
7.1 Amendment. Business Associate may update this Agreement to reflect changes in HIPAA or in the Service. Covered Entity is asked to accept each new version, and use of the Service for purposes involving PHI pauses until it does. Business Associate keeps every version Covered Entity has accepted, with the date of acceptance.
7.2 Governing law. This Agreement is governed by the laws of the State of Arizona, without regard to conflict-of-laws principles.
7.3 Interpretation and conflict. Any ambiguity is resolved to permit compliance with HIPAA. Where this Agreement conflicts with any other agreement between the parties, this Agreement controls with respect to PHI.
7.4 Severability. If a provision is held unenforceable, the rest remains in effect.
7.5 Notices. Notices to Business Associate go to legal@helix-reserve.com. Notices to Covered Entity go to the administrative contact on its account. Email notice is effective on transmission.
7.6 No third-party beneficiaries. Nothing in this Agreement confers rights on anyone other than the parties and their permitted successors.
7.7 Survival. Sections 1.10, 1.11, 3.2, 4, 5.3 and 7 survive termination.
7.8 Electronic acceptance. THE PARTIES AGREE THAT THIS AGREEMENT MAY BE ACCEPTED ELECTRONICALLY, INCLUDING BY CHECKBOX OR SIMILAR ONLINE ACCEPTANCE, AND THAT SUCH ACCEPTANCE IS A VALID AND BINDING AGREEMENT ENFORCEABLE TO THE SAME EXTENT AS A HANDWRITTEN SIGNATURE.
Helix Reserve LLC is the contracting entity for the Lumagen service. Questions about this Agreement: legal@helix-reserve.com