Personal Health Information Data Processing Addendum

Terms defined in the Agreement or in the applicable PHI Laws have the same meaning when used in this DPA unless the context otherwise requires. The following terms have the meanings set out below:

1.1 “Agreement”

means the Services Agreement and/or the Terms of Service between you and MVH for the provision of services by MVH to you, which incorporates this DPA by reference or to which this DPA is attached.

1.2 “Canadian PHI Laws”

means each of the following statutes, as amended from time to time:

• the Health Information Act (Alberta);
• the Personal Health Information Act (Manitoba);
• the Personal Health Information Privacy and Access Act (New Brunswick);
• the Personal Health Information Act (Newfoundland and Labrador);
• the Health Information Act (Northwest Territories);
• the Personal Health Information Act (Nova Scotia);
• the Personal Health Information Protection Act (Ontario);
• the Health Information Act (Prince Edward Island);
• the Health Information Protection Act (Saskatchewan); and
• the Health Information Privacy and Management Act (Yukon).

1.3 “Data Subject”

means the individual identified in or identifiable from Personal Health Information.

1.4 “Personal Health Information” or “PHI”

means: (a) for Subscribers subject to Canadian PHI Laws, “Personal Health Information” as defined in the applicable Canadian PHI Law; and (b) for Subscribers subject to US PHI Laws, “Protected Health Information” as defined in 45 C.F.R. § 160.103, including Electronic Protected Health Information (“ePHI”) as defined therein.

1.5 “PHI Laws”

means, collectively, the Canadian PHI Laws and the US PHI Laws, as applicable to the Subscriber.

1.6 “Services”

means the services provided by MVH to Subscriber, as described in the Agreement.

1.7 “US PHI Laws”

means the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and their implementing regulations, including 45 C.F.R. Parts 160 and 164 (the “HIPAA Rules”), as amended from time to time.

2.1 Roles of the Parties – Canada

For the purposes of the Canadian PHI Laws, Subscriber is a “custodian”, “health information custodian”, or “trustee” as defined in the applicable Canadian PHI Law, and MVH is an “information manager”, “information management service provider”, and/or “agent” as defined in the applicable Canadian PHI Law.

2.2 Roles of the Parties – United States

For the purposes of the US PHI Laws, Subscriber is a “Covered Entity” and MVH is a “Business Associate” as those terms are defined in 45 C.F.R. § 160.103. This DPA constitutes a Business Associate Agreement for the purposes of the HIPAA Rules.

2.3 Objectives

The objectives of this DPA are to ensure that Subscriber and MVH comply with their obligations under the applicable PHI Laws with respect to MVH’s provision of the Services to Subscriber under the Agreement. The parties will be guided by the underlying principles of the applicable PHI Laws, which may be used as a guide to the interpretation of this DPA.

2.4 Mutual Compliance

Each of MVH and Subscriber will at all times comply with the applicable PHI Laws, including with respect to the processing, storage, retrieval, and disposal of Personal Health Information, the de-identification or transformation of individually identifying health information, and the provision of information management or information technology services.

2.5 Collection on Subscriber’s Behalf

MVH is permitted to collect Personal Health Information from your patients and customers during the provision of the Services, to the extent necessary for the provision of Services to you. Any such collection of Personal Health Information by MVH is made solely for and on your behalf, and you are the controller (or Covered Entity, as applicable) of the Personal Health Information.

3.1 Restrictions on Use and Disclosure

MVH will only use Personal Health Information to provide the Services to Subscriber, except with the prior written consent of Subscriber or as otherwise expressly permitted under the Agreement or this DPA. MVH will not disclose Personal Health Information outside of MVH or its affiliates except:

• as Subscriber directs, or as required to provide the Services;
• to Subscriber’s third-party service providers as directed by Subscriber;
• to sub-processors as described in Section 5 (Sub-Processors);
• as otherwise described in the Agreement or this DPA; or
• as required by applicable laws to which MVH is subject.

3.2 Safeguards

MVH will implement and maintain appropriate technical and organizational measures designed to protect the security of Personal Health Information against unauthorized access, use, modification, deletion, loss, or disclosure. With respect to US Subscribers, MVH will comply with Subpart C of 45 C.F.R. Part 164 with respect to Electronic Protected Health Information. MVH will limit access to Personal Health Information to only those subcontractors and personnel who have a need to know, and will ensure that such persons are bound by appropriate obligations of confidentiality.

3.3 Data Subject Requests

MVH will, unless prohibited by law, promptly notify Subscriber if MVH receives any request, query, or exercise of rights from a Data Subject relating to their Personal Health Information, including requests for access, rectification, or erasure. MVH will assist Subscriber, by appropriate technical and organizational measures and insofar as reasonably possible, to fulfil Subscriber’s obligations to respond to such requests. Any assistance performed by MVH in connection with Data Subject requests will be charged at MVH’s then-current fees for such services. If a Data Subject expresses a wish relating to the disclosure of their Personal Health Information, MVH will refer that request to Subscriber in accordance with this Section 3.3.

3.4 Access to PHI and Amendment

Upon written request from Subscriber with at least five (5) business days’ notice, MVH will provide access to Personal Health Information maintained in a Designated Record Set to Subscriber or, as directed by Subscriber, to an Individual, in order to meet the requirements of 45 C.F.R. § 164.524 (for US Subscribers) or the equivalent provision of the applicable Canadian PHI Law. MVH will also make any amendments to Personal Health Information in a Designated Record Set as directed by Subscriber pursuant to 45 C.F.R. § 164.526 or the equivalent provision of the applicable Canadian PHI Law.

3.5 Accounting of Disclosures

MVH will maintain, and upon request provide to Subscriber, documentation necessary to permit Subscriber to respond to a request by an Individual for an accounting of disclosures of Personal Health Information, in accordance with 45 C.F.R. § 164.528 (for US Subscribers) or the equivalent provision of the applicable Canadian PHI Law.

3.6 Breach Notification

MVH will notify Subscriber of any loss of individually identifying Personal Health Information, or any unauthorized access to or disclosure of individually identifying Personal Health Information in the custody or control of MVH, without undue delay after MVH discovers the incident. For US Subscribers, such notice will be provided in accordance with 45 C.F.R. § 164.410 and in any event no later than sixty (60) calendar days after MVH discovers the breach. For Canadian Subscribers, notice will be provided within any notice period imposed by the applicable Canadian PHI Law. All notices will comply with the content requirements of the applicable PHI Laws.

3.7 Availability of Records to Regulatory Authorities

Unless otherwise protected or prohibited from discovery or disclosure by law, MVH agrees to make its internal practices, books, and records relating to the use or disclosure of Personal Health Information available to the relevant regulatory authority — including the Secretary of Health and Human Services for US Subscribers — for purposes of determining Subscriber’s compliance with the applicable PHI Laws.

3.8 Compliance with Subscriber’s PHI Obligations

To the extent MVH carries out one or more of Subscriber’s obligations under the applicable PHI Laws (including Subpart E of 45 C.F.R. Part 164 for US Subscribers), MVH agrees to comply with the requirements of those provisions that apply to Subscriber in the performance of such obligations.

3.9 De-Identification

MVH is authorized to create non-identifying health information from Personal Health Information. For US Subscribers, de-identification will be performed in accordance with 45 C.F.R. §§ 164.514(a)–(c). For Canadian Subscribers, de-identification will be performed in accordance with the applicable Canadian PHI Law. MVH may use and disclose de-identified or non-identifying information for any purpose, including for internal analytics, product development, and the development or improvement of artificial intelligence systems and models.

3.10 Return or Deletion of Personal Health Information

Personal Health Information provided to MVH will be returned or destroyed in accordance with Section 6.3 (Return or Deletion of Personal Health Information) and in compliance with the applicable PHI Laws.

4.1 Monitoring and Verification

You are entitled to monitor and verify MVH’s compliance with the terms of this DPA and the Agreement.

4.2 Permissible Requests

You shall not request MVH to use or disclose Personal Health Information in any manner that would not be permissible under the applicable PHI Laws if done by you, except as otherwise permitted by Section 3 of this DPA.

4.3 Notice of Restrictions and Changes

You shall promptly notify MVH of: (a) any limitation on the use or disclosure of Personal Health Information that is more restrictive than the applicable PHI Laws and that may affect MVH’s use or disclosure of Personal Health Information; and (b) any changes in, or revocation of, an Individual’s permission to use or disclose Personal Health Information, to the extent that such changes may affect MVH’s use or disclosure.

4.4 Subscriber Safeguards and Policies

You may provide MVH with your administrative, technical, and physical safeguards, and any policies or procedures, relating to Personal Health Information that are relevant to MVH’s provision of the Services. MVH will comply with such safeguards, policies, and procedures to the extent they are reasonable and relevant to the provision of the Services. If MVH is of the opinion that any such safeguards, policies, or procedures:

• cannot reasonably be complied with by MVH;
• may cause MVH to incur unanticipated costs; or
• may cause MVH to face adverse regulatory action,

then MVH may, in its discretion, elect to: (a) increase the fees under the Agreement by an amount sufficient to recover those costs; or (b) terminate the Agreement and this DPA by notice in writing to you.

4.5 Consent to Sub-Processors

You consent to MVH’s use of sub-processors as described in Section 5 (Sub-Processors). MVH will not otherwise subcontract the provision of Services involving Personal Health Information without your prior consent.

Subscriber agrees that MVH may use sub-processors to provide the Services, to fulfil its contractual obligations under this DPA and the Agreement, or to provide certain services on its behalf. MVH will enter into a written agreement with each sub-processor to which Personal Health Information is provided, permitting the sub-processor to access and use Personal Health Information only for the purpose of delivering the services MVH has retained the sub-processor to provide, and for no other purpose. MVH will be liable for the acts and omissions of its sub-processors to the same extent as if the acts or omissions were performed by MVH directly.

6.1 Term

This DPA will continue in force until the later of: (a) the expiry or termination of the Agreement; and (b) the return or destruction of all Personal Health Information in accordance with Section 6.3.

6.2 Material Breach

A material breach of this DPA by either party shall be deemed to be a material breach of the Agreement, and shall entitle the other party to exercise the rights of termination for material breach provided in the Agreement.

6.3 Return or Deletion of Personal Health Information

On the expiry or termination of this DPA for any reason, MVH will:

• retain only the Personal Health Information that is necessary for MVH to continue its proper management and administration or to carry out its legal responsibilities;
• return to Subscriber or destroy all remaining Personal Health Information in MVH’s custody or control; and
• with respect to any Personal Health Information that MVH retains beyond termination, continue to comply with the terms of this DPA for so long as such information is retained, and return or destroy it when it is no longer needed for MVH’s proper management, administration, or legal responsibilities.

Where destruction of Personal Health Information is not feasible, MVH will extend the protections of this DPA to the retained information and limit further uses and disclosures to those purposes that make return or destruction infeasible, in accordance with 45 C.F.R. § 164.504(e)(2)(ii)(J) (for US Subscribers) or the equivalent provision of the applicable Canadian PHI Law.

7.1 Relationship to Agreement

This DPA is incorporated into, and is subject to the terms and conditions of, the Agreement. Except as amended by this DPA, the Agreement will remain in full force and effect.

7.2 Order of Precedence

In the event of any inconsistency between a term of this DPA and a term of the Agreement, the term of this DPA will take precedence. In the event of any inconsistency between a term of the applicable PHI Laws and a term of this DPA, the term of the PHI Laws shall prevail.

7.3 Jurisdiction-Specific Application

Where a provision of this DPA is expressed to apply to US Subscribers or Canadian Subscribers specifically, that provision applies only to Subscribers subject to the relevant PHI Laws. Where a provision applies to both, it applies to all Subscribers covered by this DPA. In no case will a US-specific provision impose obligations on a Canadian Subscriber, or vice versa, unless the Subscriber is subject to both US PHI Laws and Canadian PHI Laws.

7.4 Severability

If any provision of this DPA is held to be invalid or unenforceable under applicable law, the remaining provisions will continue in full force and effect.

My Vet Hub, Inc. • myvethub.com