Boring Radiology Business Associate Agreement

This Business Associate Agreement (this “Agreement”) is entered into as of the Effective Date described in Section 10.8 (the “Effective Date”) by and between the customer identified in the order form that incorporates this Agreement (“Covered Entity”) and Boring Radiology, Inc., a Delaware corporation with an address at 1207 Delaware Avenue #5445, Wilmington, DE 19806 (“Business Associate”). Covered Entity and Business Associate are each a “Party” and together the “Parties.”

Recitals

A. Business Associate provides software and related services to Covered Entity under one or more order forms, subscription agreements, or other written agreements between the Parties (collectively, the “Underlying Agreement”).

B. In performing the Underlying Agreement, Business Associate creates, receives, maintains, or transmits Protected Health Information on behalf of Covered Entity and is therefore a business associate of Covered Entity under HIPAA.

C. The Parties enter into this Agreement to satisfy the requirements of 45 C.F.R. §§ 164.502(e) and 164.504(e) and to establish their respective obligations with respect to Protected Health Information.

NOW, THEREFORE, the Parties agree as follows:

1. Definitions§

§1.1 HIPAA Terms. Capitalized terms used but not otherwise defined in this Agreement have the meanings given to them in HIPAA. “HIPAA” means the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act, together with their implementing regulations at 45 C.F.R. Parts 160 and 164, in each case as amended from time to time. “Privacy Rule,” “Security Rule,” and “Breach Notification Rule” mean Subparts E, C, and D of 45 C.F.R. Part 164, respectively.

§1.2 PHI. Notwithstanding the definition of Protected Health Information under HIPAA, as used in this Agreement “PHI” means only Protected Health Information that Business Associate creates, receives, maintains, or transmits for or on behalf of Covered Entity under the Underlying Agreement. “Electronic PHI” means PHI that is Electronic Protected Health Information.

§1.3 Covered Entity as Business Associate. If Covered Entity is itself a business associate of another covered entity, then with respect to PHI it receives in that capacity (a) references in this Agreement to “Covered Entity” refer to it in its capacity as a business associate, (b) Business Associate acts as its Subcontractor, and (c) Covered Entity will obtain any authorization from its covered entity that is necessary for Business Associate to perform under this Agreement.

2. Permitted Uses and Disclosures§

§2.1 Performance of Services. Business Associate may use and disclose PHI as necessary to perform the services described in the Underlying Agreement, including developing and maintaining models or model customizations used solely to provide those services to Covered Entity.

§2.2 Management and Administration. Business Associate may use PHI for its own proper management and administration and to carry out its legal responsibilities. Business Associate may disclose PHI for those purposes only if (a) the disclosure is Required by Law, or (b) Business Associate obtains reasonable written assurances from the recipient that the PHI will be held confidentially and used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the recipient will notify Business Associate of any breach of confidentiality.

§2.3 Data Aggregation. Business Associate may use and disclose PHI to provide Data Aggregation services relating to the Health Care Operations of Covered Entity, as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B).

§2.4 Required by Law. Business Associate may use and disclose PHI as Required by Law.

§2.5 De-identification. Business Associate may use PHI to create de-identified information in accordance with 45 C.F.R. § 164.514(a)–(c). Information de-identified in accordance with that section does not constitute PHI and is not subject to this Agreement. Ownership of, and permitted uses of, such de-identified information are governed exclusively by the Underlying Agreement.

§2.6 Limitations. Business Associate will not use or disclose PHI other than as permitted or required by this Agreement or as Required by Law, and will not use or disclose PHI in a manner that would violate the Privacy Rule if done by Covered Entity, except as permitted by Sections 2.2 and 2.3. Business Associate will limit its uses, disclosures, and requests for PHI to the minimum necessary to accomplish the intended purpose, as required by 45 C.F.R. § 164.502(b).

3. Safeguards and Security§

§3.1 Safeguards. Business Associate will use appropriate administrative, physical, and technical safeguards to prevent the use or disclosure of PHI other than as permitted by this Agreement, and will comply with the Security Rule with respect to Electronic PHI.

§3.2 Security Program. Business Associate will maintain a written information security program, including a documented risk analysis and risk management process, that is appropriate to the size and complexity of its operations and to the nature and scope of the PHI it maintains. Business Associate will review and update that program periodically and in response to material changes in its operations or the threat environment.

4. Reporting and Mitigation§

§4.1 Breach of Unsecured PHI. Business Associate will notify Covered Entity of any Breach of Unsecured PHI without unreasonable delay and in no event later than five (5) business days after the Breach is discovered, as determined under 45 C.F.R. § 164.410(a)(2). The notification will include, to the extent then known to Business Associate, the identification of each Individual whose Unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed, together with the other information described in 45 C.F.R. § 164.410(c). Business Associate will supplement that notification with additional information as it becomes available.

§4.2 Impermissible Use or Disclosure. Business Associate will report to Covered Entity any use or disclosure of PHI not permitted by this Agreement of which it becomes aware, without unreasonable delay and in no event later than five (5) business days after becoming aware of it.

§4.3 Security Incidents. Business Associate will report to Covered Entity any Security Incident affecting Electronic PHI of which it becomes aware, on the timetable set out in Section 4.2. The Parties acknowledge that Business Associate’s information systems are routinely subject to unsuccessful attempts at unauthorized access that do not result in unauthorized access to, or use or disclosure of, Electronic PHI — including pings and other broadcast attacks on firewalls, port scans, unsuccessful log-on attempts, denial-of-service attempts that do not materially interrupt system availability, and malware that is blocked or quarantined. This Section constitutes notice to Covered Entity of the ongoing existence and occurrence of such unsuccessful attempts, and no further report of them is required.

§4.4 Mitigation. Business Associate will take reasonable steps to mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure of PHI in violation of this Agreement.

5. Subcontractors§

§5.1 Flow-Down. Business Associate will ensure that each Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to restrictions and conditions with respect to that PHI that are at least as protective as those that apply to Business Associate under this Agreement, as required by 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2). Business Associate remains responsible to Covered Entity for its Subcontractors’ performance.

§5.2 Subcontractor List. Business Associate maintains a current list of Subcontractors that have access to PHI and will make that list available to Covered Entity upon written request.

6. Individual Rights§

§6.1 Access. Within fifteen (15) business days of a written request from Covered Entity, Business Associate will make available to Covered Entity PHI in a Designated Record Set as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. § 164.524.

§6.2 Amendment. Within fifteen (15) business days of a written request from Covered Entity, Business Associate will make PHI in a Designated Record Set available for amendment and will incorporate any amendment directed by Covered Entity, as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. § 164.526.

§6.3 Accounting of Disclosures. Business Associate will document disclosures of PHI and information related to those disclosures as would be required for Covered Entity to respond to a request for an accounting under 45 C.F.R. § 164.528, will retain that documentation for six (6) years, and will make it available to Covered Entity within fifteen (15) business days of a written request.

§6.4 Requests Made Directly to Business Associate. If an Individual makes a request under 45 C.F.R. § 164.524, § 164.526, or § 164.528 directly to Business Associate, Business Associate will forward the request to Covered Entity within five (5) business days and will not respond directly to the Individual except as directed by Covered Entity or as Required by Law.

§6.5 Covered Entity Obligations. To the extent Business Associate is to carry out an obligation of Covered Entity under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to Covered Entity in the performance of that obligation.

7. Availability of Records to HHS§

§7.1 Secretary Access. Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining Covered Entity’s compliance with the Privacy Rule. Business Associate will notify Covered Entity of any such request to the extent permitted by law.

8. Obligations of Covered Entity§

§8.1 Notices to Business Associate. Covered Entity will notify Business Associate of (a) any limitation in Covered Entity’s Notice of Privacy Practices, (b) any change in, or revocation of, an Individual’s permission to use or disclose PHI, and (c) any restriction on the use or disclosure of PHI that Covered Entity has agreed to under 45 C.F.R. § 164.522, in each case to the extent the limitation, change, or restriction affects Business Associate’s permitted uses or disclosures under this Agreement.

§8.2 Permissible Requests. Covered Entity will not request that Business Associate use or disclose PHI in any manner that would not be permissible under the Privacy Rule if done by Covered Entity, except as permitted under Sections 2.2 and 2.3.

§8.3 Authority and Consents. Covered Entity represents that it has the authority to disclose PHI to Business Associate and has obtained any consents, authorizations, or other permissions necessary for Business Associate to receive and process PHI as contemplated by the Underlying Agreement.

9. Term and Termination§

§9.1 Term. This Agreement begins on the Effective Date and continues until the Underlying Agreement terminates or expires and all PHI has been returned or destroyed in accordance with Section 9.3, or until this Agreement is otherwise terminated under Section 9.2.

§9.2 Termination for Cause. If either Party determines that the other Party has violated a material term of this Agreement, the non-breaching Party will give written notice describing the violation, and the breaching Party will have thirty (30) days to cure. If the violation is not cured within that period, or cure is not possible, the non-breaching Party may terminate this Agreement and the Underlying Agreement.

§9.3 Return or Destruction of PHI. Upon termination or expiration of the Underlying Agreement or this Agreement, Business Associate will return to Covered Entity or destroy all PHI that Business Associate maintains in any form, and will require its Subcontractors to do the same. Where return or destruction is not feasible — including PHI contained in archival or disaster-recovery backups that cannot reasonably be isolated — Business Associate will extend the protections of this Agreement to that PHI, limit further uses and disclosures to those purposes that make return or destruction infeasible, and destroy the PHI in the ordinary course when destruction becomes feasible. Business Associate will confirm completion in writing upon Covered Entity’s request.

10. General§

§10.1 Regulatory References. A reference in this Agreement to a section of HIPAA means the section as in effect or as amended.

§10.2 Amendment. The Parties will negotiate in good faith and take such action as is reasonably necessary to amend this Agreement from time to time as is necessary for the Parties to comply with changes in HIPAA.

§10.3 Interpretation. Any ambiguity in this Agreement will be resolved in favor of a meaning that permits the Parties to comply with HIPAA. In the event of a conflict between this Agreement and the Underlying Agreement with respect to the use, disclosure, or safeguarding of PHI, this Agreement controls.

§10.4 Relationship to the Underlying Agreement. Except as expressly set out in this Agreement, this Agreement does not modify the Underlying Agreement. This Agreement does not create, expand, or limit any obligation of either Party with respect to fees, service levels, warranties, limitations of liability, indemnification, insurance, audit, or any other commercial matter, all of which are governed exclusively by the Underlying Agreement.

§10.5 No Third-Party Beneficiaries. Nothing in this Agreement confers any right, remedy, or benefit upon any person other than the Parties.

§10.6 Survival. Sections 1, 6.3, 7, 9.3, and 10 survive termination or expiration of this Agreement, as do the obligations in Sections 2, 3, 4, and 5.1 with respect to any PHI retained under Section 9.3.

§10.7 Governing Law. This Agreement is governed by the laws of the State of Delaware, without regard to its conflict-of-laws principles, except to the extent preempted by federal law.

§10.8 Execution and Acceptance. This Agreement may be executed directly by the Parties, in counterparts and by electronic signature, or accepted by Covered Entity’s execution of an order form or other agreement with Business Associate that incorporates it by reference. If this Agreement is accepted by incorporation, “Covered Entity” means the customer identified in that order form and the Effective Date is the effective date of the first order form that incorporates this Agreement. If the Parties execute this Agreement directly, the executed Agreement controls over any version incorporated by reference.

§10.9 Notices. Notices under this Agreement must be in writing and sent to the addresses in the Underlying Agreement or, for Business Associate, to legal@boringrad.com. Notices under Section 4 may be sent by email to the notices contact identified in the Underlying Agreement and are effective when sent.

§10.10 Versions. If this Agreement is accepted by incorporation, the version that applies is the version identified in the incorporating order form. Later versions apply only as provided in the Underlying Agreement for updates to online terms (Section 2.3 of the Boring Radiology Master Terms), except that changes required by HIPAA are governed by Section 10.2.