HIPAA Addendum 

1.1. Catch-all Definition. The following terms used in this HIPAA Addendum shall have the same meaning as those terms in the HIPAA Rules: “breach”, “data aggregation”, “designated record set”, “disclosure”, “health care operations”, “individual”, “minimum necessary”, “notice of privacy practices”, “protected health information”, “required by law”, “secretary”, “security incident”, “subcontractor”, “unsecured protected health information”, and “use”.

1.2. Specific Definitions.

1.2.1. “Business Associate” shall generally have the same meaning as the term “business associate” at 45 CFR 160.103, and in reference to the party to this HIPAA Addendum, shall mean Shulcloud.

1.2.2. “Covered Entity” shall generally have the same meaning as the term “covered entity” at 45 CFR 160.103, and in reference to the party to this HIPAA Addendum, shall mean Customer.

1.2.3. “HIPAA Rules” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.

2.1. Not use or disclose protected health information other than as permitted or required by the Agreement or as required by law;

2.2. Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information, to prevent use or disclosure of protected health information other than as provided for by the Agreement;

2.3. Report to Covered Entity any use or disclosure of protected health information not provided for by the Agreement of which it becomes aware, including breaches of unsecured protected health information as required at 45 CFR 164.410, and any security incident of which it becomes aware. The Covered Entity agrees to notify any affected patient and government agency as required;

2.4. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information;

2.5. Make available protected health information in a designated record set to the Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.524. In the event that the Business Associate receives a request for access directly from the individual rather than the Covered Entity, the Business Associate shall respond to a request for access by forwarding the individual’s request to the Covered Entity to fulfill. The Covered Entity has sole responsibility for handling requests for HIPAA information from individual clients of the Covered Entity;

2.6. Make any amendment(s) to protected health information in a designated record set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526;

2.7. Maintain and make available the information required to provide an accounting of disclosures to the Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.528. The Business Associate shall respond to a request for an accounting of disclosures that the Business Associate receives directly from the individual client of the Covered Entity by forwarding the request to the Covered Entity;

2.8. To the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such obligation(s); and

2.9. Make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

3.1. Business Associate may only use or disclose protected health information as referenced in this HIPAA Addendum as necessary to perform the Services. In addition to other permissible purposes, the Parties should specify whether the Business Associate is authorized to use protected health information to de-identify the information in accordance with 45 CFR 164.514(a)-(c).

3.2. Business Associate may use or disclose protected health information as required by law.

3.3. Business Associate agrees to make uses, disclosures, and requests for protected health information consistent with Covered Entity’s minimum necessary policies and procedures.

3.4. Business Associate may not use or disclose protected health information in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity except for the specific uses and disclosures set forth below.

3.5. Business Associate may use protected health information for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate.

3.6. Business Associate may disclose protected health information for the proper management and administration of Business Associate or to carry out the legal responsibilities of the Business Associate, provided the disclosures are required by law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information shall remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

3.7. Business Associate may provide data aggregation services relating to the health care operations of the Covered Entity.

4.1. Covered Entity shall notify Business Associate of any limitation(s) in the notice of privacy practices of Covered Entity under 45 CFR 164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of protected health information.

4.2. Covered Entity shall notify Business Associate of any changes in, or revocation of, the permission by an individual to use or disclose the individual’s protected health information, to the extent that such changes may affect Business Associate’s use or disclosure of protected health information.

4.3. Covered Entity shall notify Business Associate of any restriction on the use or disclosure of protected health information that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of protected health information.

7.1. Regulatory References. A reference in this HIPAA Addendum to a section in the HIPAA Rules means the section as in effect or as amended.

7.2. Interpretation. Any ambiguity in this HIPAA Addendum shall be interpreted to permit compliance with the HIPAA Rules.

7.3. Limitations of Liability. Each party’s and all of its affiliates’ total liability, taken together in the aggregate, arising out of or related to this HIPAA Addendum, whether in contract, tort, or under any other theory of liability, is subject to the limitations of liability and disclaimers in the Agreement, including any 'Limitations of Liability' section (however described) of the Agreement, and any reference in such section to the liability of a party means the aggregate liability of that party and all of its affiliates under the Agreement and the HIPAA Addendum together.

7.4. Amendment. Business Associate may update this HIPAA Addendum from time to time only to the extent required by law or regulatory guidance, or to make administrative or non-material changes that do not reduce Covered Entity’s rights or protections, increase Covered Entity’s obligations, or limit Business Associate’s obligations under HIPAA Rules. Business Associate shall post any updates to this HIPAA Addendum on its website, and Covered Entity’s continued use of the Services after the effective date of such update shall constitute Covered Entity’s acceptance solely with respect to updates permitted in this Section. Covered Entity’s sole remedy if it does not agree to an update is to discontinue use of the Services and terminate the Agreement, which shall not constitute a breach of the Agreement by Business Associate.