Business Associate Agreement

This Business Associate Agreement ("HIPAA Addendum") is an addendum to the Terms and Conditions (and is incorporated therein by reference). All terms not defined herein have the meaning ascribed to them in the Terms and Conditions. This HIPAA Addendum defines the rights and responsibilities of Awrel and You with respect to PHI as defined in the Health Insurance Portability and Accountability Act of 1996 and the regulations promulgated thereunder, including the HITECH Act and Omnibus Rule, as each may be amended from time to time (collectively, "HIPAA"). This HIPAA Addendum shall be applicable only in the event and to the extent Awrel meets, with respect to You, the definition of a Business Associate set forth at 45 CFR §160.103, or applicable successor provisions.

1. Defined Terms. For the purposes of this HIPAA Addendum, capitalized terms shall have the following meanings:

"Agreement" shall mean the Terms and Conditions between You and Awrel.

"Business Associate" shall mean Awrel.

"CFR" shall mean the Code of Federal Regulations.

"Individual" shall have the same meaning as the term "individual" in 45 CFR § 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR § 164.502(g).

"Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E.

"Protected Health Information" or “PHI” shall have the same meaning as the term "protected health information" in 45 CFR § 160.103, limited to the information received by Awrel from or on behalf of You.

"Required By Law" shall have the same meaning as the term "required by law" in 45 CFR § 164.103.

"Security Rule” shall mean the Security Standards for the Protection of Electronic Protected Health Information, located at 45 CFR Part 160 and Subparts A and C of Part 164.

"Secretary" shall mean the Secretary of the Department of Health and Human Services or his or her designee.

2. Obligations and Activities of Awrel.

(a) Awrel shall not use or disclose PHI other than as permitted or required by this HIPAA Addendum or as permitted or Required by Law.

(b) Awrel agrees to use appropriate safeguards, including reasonable physical, technical, and administrative safeguards, and comply with relevant provisions of Subpart C of 45 CFR Part 164 with respect to PHI, to prevent use or disclosure of PHI other than as provided for by the Terms and Conditions.

(c) Awrel agrees to mitigate, to the extent reasonably practicable and commercially reasonable, any harmful effect that is known to Awrel of a use or disclosure of PHI by Awrel or its agents or subcontractors in violation of the requirements of this HIPAA Addendum.

(d) Awrel agrees to report to You any use or disclosure of PHI not provided for by the Terms and Conditions or this HIPAA Addendum of which it becomes aware, including breaches of unsecured protected health information as required under 45 CFR 164.410. Awrel agrees to report to you any Security Incident involving Your PHI of which Awrel becomes aware in which there is a successful unauthorized access, use, disclosure, modification or destruction of information or interference with system operations in a manner that risks the confidentiality, integrity, or availability of Your PHI. Notice is hereby deemed provided, and no further notice will be provided, for unsuccessful attempts, including but not limited to pings and other broadcast attacks on a firewall.

(e) Awrel agrees, in accordance with 45 CFR § 164.502(e)(1)(ii), to, as required, ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Awrel agree to substantially similar restrictions and conditions that apply to Awrel under this HIPAA Addendum with respect to such information.

(f) All PHI maintained by Awrel for You will be available to You in a time and manner that reasonably allows You to comply with the requirements under 45 CFR § 164.524. Awrel shall not be obligated to provide any such information directly to any Individual or person other than You.

(g) All PHI maintained by Awrel for You will be available to You in a time and manner that reasonably allows You to comply with the requirements under 45 CFR § 164.526.

(h) Awrel agrees to make internal practices, books, and records available to the Secretary, in a time and manner designated by the Secretary, for purposes of the Secretary determining Your compliance with the Privacy Rule; provided, however, that time incurred by Awrel in complying with any such request that exceeds its normal customer service parameters shall be charged to You at Awrel's then current standard hourly rate for Additional Services.

(i) You acknowledge that Awrel is not required by this HIPAA Addendum to make disclosures of PHI to Individuals or any person other than You, and that Awrel does not, therefore, expect to maintain documentation of such disclosure as described in 45 CFR § 164.528. In the event that Awrel does make such disclosure, it shall document the disclosure as would be required for You to respond to a request by an Individual for an accounting of disclosures in accordance with 45 CFR §164.528, and shall provide such documentation to You promptly on Your request.

(j) To the extent Awrel is to carry out one or more of Your obligation(s) under Subpart E of 45 CFR Part 164, Awrel shall comply with the requirements of Subpart E that apply to You in the performance of such obligation(s).

3. Permitted Uses and Disclosures by Awrel. Except as otherwise limited in this HIPAA Addendum or other portion of the Terms and Conditions, Awrel may use or disclose PHI to perform functions, activities, or services for, or on behalf of, You as specified in the Terms and Conditions, provided that such use or disclosure would not violate the Privacy Rule if done by You.

4. Specific Use and Disclosure Provisions. Except as otherwise limited in this HIPAA Addendum or other portion of the Terms and Conditions, Awrel may:

(a) Use PHI for the proper management and administration of Awrel or to carry out the legal responsibilities of Awrel.

(b) Disclose PHI for the proper management and administration of Awrel, provided that disclosures are Required by Law, or Awrel obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and be used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and the person notifies Awrel of any instances of which it is aware in which the confidentiality of the PHI has been breached.

(c) De-identify any and all PHI provided that the de-identification conforms to the requirements of the Privacy Standards. The Parties acknowledge and agree that de-identified data does not constitute PHI and is not subject to the provisions of this HIPAA Addendum.

(d) Provide Data Aggregation services relating to the health care operations of Covered Entity or as otherwise allowed by law.

(e) Only request, use and disclose the minimum amount of PHI necessary to accomplish the purpose of the request, use or disclosure.

5. Your Obligations. (a) You shall notify Awrel of:

(i) any limitations(s) in Your notice of privacy practices in accordance with 45 CFR § 164.520 to the extent that such changes may affect Awrel's use or disclosure of PHI;

(ii) any changes in, or revocation of, permission by an Individual to use or disclose PHI, to the extent that such changes may affect Awrel's use or disclosure of PHI; and

(iii) any restriction to the use or disclosure of PHI that You have agreed to in accordance with 45 CFR § 164.522, to the extent that such restriction may affect Awrel's use or disclosure of PHI.

(b) You agree that You will not request Awrel to use or disclose PHI in any manner that would not be permissible under the Privacy Rule if done by You.

(c) You agree to comply with those security obligations specified in the Terms and Conditions, and to implement or maintain appropriate safeguards as required for You to comply with the Security and Privacy Rules as applicable to You. You acknowledge and agree that determining what is required for HIPAA compliance rests with You and that the users of any platform supplied under the Terms and Conditions must be appropriately trained on appropriate policies and procedures adequate for Your HIPAA compliance.

6. Term and Termination.

(a) The term of this HIPAA Addendum shall continue for the term of the Terms and Conditions and following termination of the Terms and Conditions until all PHI is destroyed or returned to You or Your designee.

(b) Upon termination of this HIPAA Addendum for any reason, Awrel shall return or destroy all PHI, which remains in Awrel’s possession, in accordance with the terms of the Terms and Conditions. This provision shall apply to PHI that is in the possession of subcontractors or agents of Awrel as well as Awrel itself. Awrel shall retain no copies of the PHI following return or destruction. In the event that Awrel determines that returning or destroying the PHI is infeasible, Awrel shall promptly provide You with notification of the conditions that make return or destruction infeasible. Awrel shall extend the protections of this HIPAA Addendum to such PHI and limit further uses and disclosures of such PHI to those purposes that make the destruction infeasible, for so long as Awrel maintains such PHI. You shall bear the cost of storage of such PHI for as long as storage by Awrel is required. This Section does not require Awrel to segregate any PHI from other information maintained by You on Awrel's (or its subcontractor’s) servers and Awrel may comply with this requirement by returning or destroying all of Your information maintained on Awrel’s (or its subcontractor’s) servers.

7. Miscellaneous.

(a) Amendment. You and Awrel agree to take such action as is reasonably necessary to amend this HIPAA Addendum from time to time as is necessary for You or Awrel to comply with the requirements of HIPAA as they may be amended from time to time; provided, however, that if such an amendment would materially increase the cost of Awrel providing service under the Terms and Conditions, Awrel shall have the option to terminate the Terms and Conditions on thirty (30) days advance notice. You acknowledge that modification of the Business Associate Agreement between Awrel and Hosting Provider may necessitate the amendment of this HIPAA Addendum in order for the Parties to comply with the requirements of HIPAA.

(b) Survival. The respective rights and obligations of the Parties under this HIPAA Addendum shall survive the termination of the Terms and Conditions, as appropriate.

(c) Interpretation. Any ambiguity in this HIPAA Addendum shall be resolved to permit the Parties to comply with HIPAA and the Privacy Rule.

(d) Third Party Beneficiaries. Nothing express or implied in this HIPAA Addendum is intended to confer, nor shall anything herein confer, upon any person other than the Parties and the respective successors and assigns of the Parties, any rights, remedies, obligations, or liabilities whatsoever.

(e) The Hosting Provider. You acknowledges that Your data, including any PHI, may be hosted by the Hosting Provider of Awrel, currently Amazon, and that Awrel has entered into a HIPAA business associate agreement (“Hosting BAA”) with the Hosting Provider.