This Business Associate Addendum (the “Addendum”) supplements the underlying agreement between My Vet Hub, Inc. (“MVH” or “Business Associate”) and its client (“Client” or “Covered Entity”), including the Terms of Service (collectively, the “Underlying Agreement”). This Addendum is intended to ensure the parties’ compliance with the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, including 45 C.F.R. Part 164 (collectively, the “HIPAA Rules”). The terms of the Underlying Agreement apply to the parties’ performance under this Addendum to the extent they are not inconsistent with the terms of this Addendum.
1. Definitions
1.1 General
Terms used but not otherwise defined in this Addendum shall have the same meanings as those terms are given in the HIPAA Rules.
1.2 42 C.F.R. Part 2 Definitions
To the extent MVH receives, creates, or maintains “Records” as defined in 42 C.F.R. § 2.11, the term “Protected Health Information” (or “PHI”) shall include such records. The terms “Part 2 Program” and “Qualified Service Organization” (or “QSO”) shall have the meanings set forth in 42 C.F.R. § 2.11.
2. Obligations and Activities of MVH
2.1 Restrictions on Use and Disclosure
MVH agrees not to use or disclose Protected Health Information other than as permitted or required by this Addendum, the Underlying Agreement, or as Required By Law.
2.2 Safeguards
MVH agrees to use appropriate safeguards and to comply with Subpart C of 45 C.F.R. Part 164 with respect to Electronic Protected Health Information, in order to prevent use or disclosure of Protected Health Information other than as provided for by this Addendum.
2.3 Reporting of Unauthorized Use, Disclosure, and Security Incidents
MVH agrees to report to Client any use or disclosure of Protected Health Information not provided for by this Addendum of which MVH becomes aware, including breaches of Unsecured Protected Health Information as required by 45 C.F.R. § 164.410. MVH also agrees to report to Client any security incident related to Protected Health Information of which MVH becomes aware, provided that this reporting obligation shall not apply to routine, unsuccessful security incidents — such as port scans or pings — that do not pose a material threat to the Protected Health Information.
2.4 Subcontractors
MVH agrees to ensure that any subcontractor to whom it provides Protected Health Information received from, or created or received by MVH on behalf of, Client agrees to the same restrictions and conditions that apply to MVH under this Addendum, including all restrictions applicable to 42 C.F.R. Part 2 records relating to substance use disorder (“SUD”).
2.5 42 C.F.R. Part 2 – Qualified Service Organization
MVH acknowledges that it is a QSO with respect to any records subject to 42 C.F.R. Part 2. In that capacity, MVH: (a) acknowledges that it is fully bound by the provisions of 42 C.F.R. Part 2; and (b) agrees that it will, if necessary, resist in judicial proceedings any efforts to obtain access to patient-identifying information related to substance use disorder diagnosis, treatment, or referral for treatment, except as permitted by 42 C.F.R. Part 2.
2.6 Access to PHI in Designated Record Sets
MVH agrees to provide access, at the request of Client and during normal business hours, to Protected Health Information in a Designated Record Set to Client or, as directed by Client, to an Individual in order to meet the requirements of 45 C.F.R. § 164.524. Client shall deliver written notice to MVH at least five (5) business days in advance of requesting such access.
2.7 Amendment of PHI
MVH agrees to make any amendments to Protected Health Information in a Designated Record Set that Client directs or agrees to pursuant to 45 C.F.R. § 164.526, at the request of Client or an Individual.
2.8 Accounting of Disclosures
MVH agrees to maintain, and upon request provide to Client, documentation necessary to permit Client to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 C.F.R. § 164.528.
2.9 Availability of Practices and Records to the Secretary
Unless otherwise protected or prohibited from discovery or disclosure by law, MVH agrees to make its internal practices, books, and records relating to the use or disclosure of Protected Health Information received from, or created or received by MVH on behalf of, Client available to the Secretary of Health and Human Services for purposes of determining Client’s compliance with the HIPAA Rules.
2.10 Compliance with Subpart E
To the extent MVH carries out one or more of Client’s obligations under Subpart E of 45 C.F.R. Part 164, MVH agrees to comply with the requirements of Subpart E that apply to Client in the performance of such obligations.
3. Permitted Uses and Disclosures by MVH
3.1 Performance of Services
Except as otherwise limited by this Addendum, MVH may use and disclose Protected Health Information as necessary to perform the services for and on behalf of Client in accordance with the terms of the Underlying Agreement and to otherwise meet its obligations under this Addendum, provided that such uses or disclosures would not violate the HIPAA Privacy Rule if made by Client.
3.2 Management, Administration, and Product Development
Except as otherwise limited by this Addendum, MVH may use Protected Health Information for the proper management and administration of MVH, including for internal analytics and MVH’s own product development, or to carry out the legal responsibilities of MVH. With respect to 42 C.F.R. Part 2 records received pursuant to a patient’s single consent for Treatment, Payment, and Health Care Operations (TPO), MVH may further use or re-disclose such records as permitted by the HIPAA Rules, except for uses in legal proceedings as restricted in Section 3.5 below.
3.3 Use Within AI Systems
Except as otherwise limited by this Addendum, MVH may use PHI within internal and external artificial intelligence systems and models solely to the extent permitted by the HIPAA Rules.
3.4 Data Aggregation and De-Identification
Except as otherwise limited by this Addendum, MVH may use Protected Health Information: (a) to provide Data Aggregation services relating to the health care operations of Client, as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B); and (b) to de-identify such Protected Health Information in accordance with 45 C.F.R. §§ 164.514(a)–(c), and to use such de-identified information for any lawful purpose, including in any AI models or systems MVH develops or utilizes.
3.5 Restrictions on Disclosure of SUD Records
Notwithstanding anything to the contrary in this Addendum, if PHI includes SUD records subject to 42 C.F.R. Part 2, MVH shall not disclose such records for use in any civil, criminal, administrative, or legislative proceeding against a patient unless such disclosure is expressly permitted by a court order issued under 42 C.F.R. Part 2, Subpart E, or by a specific written consent from the patient for such purpose.
3.6 Disclosure for MVH’s Legal Responsibilities
Except as otherwise limited by this Addendum, MVH may disclose Protected Health Information for the proper management and administration of MVH or to carry out the legal responsibilities of MVH, provided that: (a) the disclosure is Required By Law; or (b) MVH obtains reasonable assurances from the recipient that the information will remain confidential and will be used or further disclosed only as Required By Law or for the purpose for which it was disclosed, and that the recipient will notify MVH of any instance of which it becomes aware in which the confidentiality of the information has been breached.
4. Obligations of Client
4.1 Notice of Restrictions
If and to the extent Client has imposed or agreed to any limitation on the use or disclosure of Protected Health Information that is more restrictive than the HIPAA Rules, Client shall notify MVH of any such limitation.
4.2 Notice of Changes to Individual Permissions
Client shall promptly notify MVH of any changes in, or revocation of, an Individual’s permission to use or disclose Protected Health Information, to the extent that such changes may affect MVH’s use or disclosure of Protected Health Information.
4.3 Permissible Requests
Client shall not request MVH to use or disclose Protected Health Information in any manner that would not be permissible under the HIPAA Rules if done by Client, except as otherwise permitted by Section 3 of this Addendum.
4.4 42 C.F.R. Part 2 Records
Client shall notify MVH if any PHI provided to MVH is subject to 42 C.F.R. Part 2. When providing such records, Client shall include the Notice to Accompany Disclosure required by 42 C.F.R. § 2.32 and a copy of the patient’s consent (or a written description of its scope).
5. Term and Termination
5.1 Term
This Addendum shall become effective upon execution of the Underlying Agreement and shall remain in effect until: (a) this Addendum is terminated in accordance with Section 5.2; and (b) all Protected Health Information has been returned to Client or destroyed in accordance with Section 5.3.
5.2 Termination
This Addendum shall terminate upon the earliest of the following:
- termination of the Underlying Agreement;
- thirty (30) days’ prior written notice to the breaching party, if either party materially breaches this Addendum and fails to cure such breach within the thirty (30) day notice period; or
- a determination by MVH that an amendment to the HIPAA Rules, or a restriction agreed to by Client on the use or disclosure of Protected Health Information, would cause MVH to incur unanticipated compliance costs or face adverse regulatory action in continuing to perform under this Addendum.
5.3 Effect of Termination
Upon termination of this Addendum for any reason, MVH shall, with respect to Protected Health Information received from Client or created, maintained, or received by MVH on behalf of Client:
- retain only that Protected Health Information which is necessary for MVH to continue its proper management and administration or to carry out its legal responsibilities;
- return to Client or destroy all remaining Protected Health Information that MVH still maintains in any form; and
- if and to the extent that return or destruction is not practicable, continue to use appropriate safeguards and comply with the applicable HIPAA Rules with respect to any Protected Health Information that MVH retains, and limit further use or disclosure of such information to the purposes that make return or destruction impracticable.
My Vet Hub, Inc. • myvethub.com