Business Associate Agreement

Telemed-OS enters into a Business Associate Agreement with every business that uses the platform. It sets out how we protect the patient health information you entrust to us, as required by the Health Insurance Portability and Accountability Act (HIPAA).

This Business Associate Agreement (the "Agreement") is entered into between the business identified in the signature block below ("Customer") and Telemed-OS LLC ("Business Associate"), and is effective on the date Customer accepts it or first uses the Telemed-OS platform, whichever is earlier (the "Effective Date").

Business Associate provides Customer with the Telemed-OS platform, software for physician management, prescription workflow and physician sign-off, pharmacy routing, patient records, intake and messaging, patient portals, and websites and forms that run under Customer's brand (the "Services"), under the platform agreement between the parties (the "Services Agreement"). In providing the Services, Business Associate may create, receive, maintain or transmit protected health information on Customer's behalf. This Agreement applies to the extent Customer is a covered entity, or a business associate of a covered entity, under HIPAA.

1. Definitions

Capitalized terms used but not defined in this Agreement have the meanings given in the HIPAA Rules, including: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information and Use.

• "HIPAA Rules" means the Privacy, Security, Breach Notification and Enforcement Rules at 45 C.F.R. Parts 160 and 164, as amended.
• "PHI" means Protected Health Information that Business Associate creates, receives, maintains or transmits on behalf of Customer, including electronic PHI.

2. Obligations of Business Associate

Business Associate agrees to:

1. Not use or disclose PHI other than as permitted or required by this Agreement or as Required by Law.
2. Use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this Agreement. These safeguards include encryption of PHI at rest and in transit, role-based access controls and audit logging of access to and activity on PHI.
3. Report to Customer any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, including Breaches of Unsecured PHI as required by 45 C.F.R. 164.410, and any Security Incident of which it becomes aware, without unreasonable delay and in no case later than ten (10) business days after discovery. Customer and Business Associate agree that this section serves as notice of the ongoing existence of unsuccessful Security Incidents (such as pings, port scans and blocked log-in attempts) that do not result in unauthorized access to PHI, for which no further notice is required.
4. Ensure, in accordance with 45 C.F.R. 164.502(e)(1)(ii) and 164.308(b)(2), that any Subcontractors that create, receive, maintain or transmit PHI on behalf of Business Associate agree in writing to the same restrictions, conditions and requirements that apply to Business Associate with respect to that PHI.
5. Make PHI in a Designated Record Set available to Customer within fifteen (15) days of a request, as necessary to satisfy Customer's obligations under 45 C.F.R. 164.524, and forward to Customer any such request received directly from an Individual.
6. Make any amendments to PHI in a Designated Record Set as directed or agreed to by Customer under 45 C.F.R. 164.526, or take other measures necessary to satisfy Customer's obligations under that section.
7. Maintain and make available to Customer within fifteen (15) days of a request the information required for Customer to provide an accounting of disclosures under 45 C.F.R. 164.528.
8. To the extent Business Associate carries out any of Customer's obligations under Subpart E of 45 C.F.R. Part 164, comply with the requirements of Subpart E that apply to Customer in performing those obligations.
9. Make its internal practices, books and records relating to PHI available to the Secretary for purposes of determining compliance with the HIPAA Rules.
10. Limit its uses, disclosures and requests of PHI to the Minimum Necessary to accomplish the intended purpose.

3. Permitted uses and disclosures

1. Business Associate may use or disclose PHI as necessary to perform the Services, including routing prescription requests and related information to the physicians Customer designates for review and signature, transmitting signed prescriptions to the pharmacy on file for the Individual, and sending status updates and messages to Individuals and Customer.
2. Business Associate may use or disclose PHI as Required by Law.
3. Business Associate may not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Customer, except for the specific uses and disclosures set out below.
4. Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities.
5. Business Associate may disclose PHI for its proper management and administration or to carry out its legal responsibilities, provided the disclosure is Required by Law, or Business Associate obtains reasonable assurances from the recipient that the PHI will be held confidentially and used or further disclosed only as Required by Law or for the purposes for which it was disclosed, and the recipient notifies Business Associate of any instance of which it is aware in which the confidentiality of the PHI has been breached.
6. Business Associate may provide Data Aggregation services relating to the Health Care Operations of Customer.
7. Business Associate may de-identify PHI in accordance with 45 C.F.R. 164.514(a) through (c). De-identified information is not PHI and is not subject to this Agreement.
8. Business Associate will not sell PHI or use or disclose PHI for marketing purposes, except as permitted by the HIPAA Rules with a valid authorization.

4. Obligations of Customer

1. Customer will notify Business Associate of any limitation in its Notice of Privacy Practices under 45 C.F.R. 164.520, to the extent the limitation may affect Business Associate's use or disclosure of PHI.
2. Customer will notify Business Associate of any changes in, or revocation of, an Individual's permission to use or disclose PHI, to the extent the change may affect Business Associate's use or disclosure of PHI.
3. Customer will notify Business Associate of any restriction on the use or disclosure of PHI that Customer has agreed to or is required to abide by under 45 C.F.R. 164.522, to the extent the restriction may affect Business Associate's use or disclosure of PHI.
4. Customer will obtain any consents or authorizations from Individuals that are required for Business Associate to perform the Services, and will not ask Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 C.F.R. Part 164 if done by Customer.

5. Term and termination

1. Term. This Agreement begins on the Effective Date and continues until the Services Agreement ends or this Agreement is terminated as provided below, whichever is earlier.
2. Termination for cause. If either party determines that the other has materially breached this Agreement, it may give written notice describing the breach. If the breach is not cured within thirty (30) days of notice, the non-breaching party may terminate this Agreement and the affected portions of the Services Agreement.
3. Obligations on termination. On termination, Business Associate will return to Customer or destroy all PHI it still maintains in any form, and retain no copies, except for PHI that Business Associate must retain to meet its legal obligations or for its proper management and administration. Customer may export its records from the platform before termination. If return or destruction is not feasible, Business Associate will extend the protections of this Agreement to the retained PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as it maintains the PHI.
4. Survival. Business Associate's obligations under section 5(c) survive termination of this Agreement.

6. Miscellaneous

1. Regulatory references. A reference in this Agreement to a section of the HIPAA Rules means the section as in effect or as amended.
2. Amendment. The parties agree to take such action as is necessary to amend this Agreement from time to time as needed for compliance with the requirements of the HIPAA Rules and other applicable law.
3. Interpretation. Any ambiguity in this Agreement will be resolved to permit compliance with the HIPAA Rules. If this Agreement conflicts with the Services Agreement on the handling of PHI, this Agreement controls.
4. No third-party beneficiaries. Nothing in this Agreement gives any person other than the parties and their respective successors any rights or remedies.
5. Notices. Notices to Business Associate under this Agreement should be sent to Telemed-OS LLC at [email protected]. Notices to Customer will be sent to the email address on Customer's account.

To request a signature copy of this agreement, contact [email protected].