This Business Associate Agreement (the “BAA”) is between Pharmacore Inc., a Delaware corporation (“PHARMACORE”), and the customer identified in the applicable Order (“Customer”). This BAA is incorporated into, and is Exhibit A to, PHARMACORE’s SaaS Subscription Terms and Conditions (together with each Order, the “Agreement”). This BAA is effective as of the earlier of: (i) execution of an Order incorporating this BAA; or (ii) acceptance of this BAA by Customer’s authorized representative in writing or through PHARMACORE’s account-owner enrollment process, and in either case it must be effective before Customer submits any PHI. Any capitalized terms not defined herein will have the definition used in the Agreement. The terms of this BAA will control to the extent inconsistent with the Agreement regarding PHI.
DEFINITIONS. (A) “Business Associate” shall have the meaning set forth at 45 CFR 160.103, and between the parties, refers to PHARMACORE; (B) “Covered Entity” shall have the meaning set forth at 45 CFR 160.103, and between the parties, refers to Customer, except that where Customer is itself a business associate of a covered entity (for example, a consultant pharmacy serving a nursing facility), PHARMACORE is Customer’s Subcontractor, and references in this BAA to Customer’s obligations under the HIPAA Rules (including 45 CFR 164.524, 164.526, and 164.528) refer to the obligations Customer has as that covered entity’s business associate; (C) “HIPAA Rules” means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164, as amended. The following terms shall have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information (or “PHI”), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.
SCOPE. Pursuant to the Agreement, PHARMACORE provides cloud-hosted clinical decision support and workflow software for licensed pharmacists, and related implementation, training, and support services (the “Services”). In its performance of the Services, PHARMACORE may create, receive, maintain, or transmit PHI on behalf of Customer. Notwithstanding anything to the contrary herein or in the Agreement, this BAA shall apply, and PHARMACORE shall have obligations hereunder, solely to the extent PHARMACORE creates, receives, maintains, or transmits PHI in connection with PHARMACORE’s provision of the Services. PHARMACORE is not responsible for a failure to comply with this BAA to the extent caused by Customer’s failure to comply with the Agreement, HIPAA, or this BAA, or by Customer’s configuration or use of the Services. This BAA shall not apply to PHARMACORE’s performance of any other services or processing of any other data on behalf of Customer. Except as expressly stated in the Agreement (including Schedule 2 of the Terms), PHARMACORE does not represent or warrant that PHARMACORE or its other products or services are HIPAA compliant, that it has or will maintain any certifications of any kind, or that Customer will comply with HIPAA merely because Customer uses the Services.
CUSTOMER OBLIGATIONS. Without limiting Section 2, Customer: (A) will comply with the HIPAA Rules; (B) is solely responsible for understanding the scope and characteristics of the Services provided by PHARMACORE, assessing relevant risks to PHI arising from Customer’s use of the Services, and ensuring the appropriate mitigation of such risks, including by configuring and using the Services as necessary to maintain compliance with the HIPAA Rules; (C) shall ensure the proper configuration of its own networks, software, and other systems that are used by or on behalf of Customer to process PHI; (D) shall implement and maintain necessary and appropriate administrative procedures regarding access to PHI, limit such access to only authorized personnel, and terminate access where no longer necessary or appropriate; (E) if Customer is a business associate of a covered entity, shall maintain a business associate agreement with that covered entity that permits Customer to engage PHARMACORE as its Subcontractor on terms consistent with this BAA, and shall confirm this in writing on request; (F) shall not request that PHARMACORE use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Customer; and (G) shall not submit records subject to 42 CFR Part 2 unless the parties have first agreed in writing how those records will be handled. Customer shall not agree to any restriction on the use or disclosure of PHI, or place any limitation in its notice of privacy practices, that would cause PHARMACORE to breach the HIPAA Rules or this BAA or would otherwise affect PHARMACORE’s use or disclosure of PHI under this BAA, without PHARMACORE’s prior written consent.
PHARMACORE OBLIGATIONS. Without limiting Section 2, PHARMACORE will: (A) not use or disclose PHI other than as permitted or required by this BAA or as Required By Law; (B) use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent Use or Disclosure of the PHI other than as provided for by this BAA; (C) in accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractors that create, receive, maintain, or transmit PHI on behalf of PHARMACORE agree in writing to the same restrictions and conditions that apply to PHARMACORE with respect to such information, and keep copies of those agreements on file; (D) within ten (10) business days after Customer’s request, make available PHI in a Designated Record Set to Customer as necessary to satisfy Customer’s obligations under 45 CFR 164.524, in addition to the export features of the Services, which Customer may use during the term, the Transition Period, and (subject to Section 19 of the Terms) any suspension; (E) within ten (10) business days after Customer’s request, make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by Customer pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Customer’s obligations under 45 CFR 164.526; (F) maintain, and within ten (10) business days after Customer’s request make available, the information required to provide an accounting of disclosures to Customer as necessary to satisfy Customer’s obligations under 45 CFR 164.528; (G) to the extent PHARMACORE carries out one or more of Customer’s obligations under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to Customer in the performance of such obligation(s); (H) limit its uses and disclosures of, and requests for, PHI to the Minimum Necessary; and (I) make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.
PERMITTED USES AND DISCLOSURES. PHARMACORE may: (A) use or disclose PHI as necessary to perform the Services, any of PHARMACORE’s obligations under the Agreement, or as otherwise agreed in writing between the parties; (B) use PHI for the proper management and administration of PHARMACORE and to carry out the legal responsibilities of PHARMACORE; (C) disclose PHI for the proper management and administration of PHARMACORE or to carry out its legal responsibilities, provided such disclosures are Required By Law, or PHARMACORE obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as Required By Law or for the purposes for which it was disclosed to the person, and the person notifies PHARMACORE of any instances of which it is aware in which the confidentiality of the information has been breached; (D) use or disclose PHI as Required By Law; and (E) de-identify PHI in accordance with 45 CFR 164.514(a)-(c), to the extent permitted by any business associate agreement under which Customer received the PHI, and use and otherwise process such de-identified information for PHARMACORE’s own internal use, including without limitation for the purpose of product and service improvement and data analysis, and disclose it only as Section 6.3 of the Terms permits. PHARMACORE will not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Customer, except for the uses and disclosures permitted by Sections 5(B) and 5(C). PHARMACORE will not sell PHI, use or disclose PHI for marketing, or use PHI to train, fine-tune, or evaluate artificial intelligence models except as Section 6.2 of the Terms permits.
INDIVIDUAL RIGHTS REQUESTS. Customer shall notify PHARMACORE of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes may affect PHARMACORE’s use or disclosure of PHI. Except for PHARMACORE’s obligations in Section 4, Customer shall have the sole responsibility for providing any response to an Individual’s request for access to PHI or a Designated Record Set, amendments of PHI, or an accounting of disclosures. In the event PHARMACORE receives a request from an Individual, PHARMACORE shall, without unreasonable delay and within five (5) business days, forward such request to Customer so that Customer may fulfill its obligations under the HIPAA Rules. PHARMACORE may charge Customer its reasonable costs, at rates agreed in advance, for assistance under this Section 6 or Section 4(D)-(F) that goes beyond the self-service features of the Services, but will not delay or condition that assistance, or Customer’s access to PHI, on payment.
SECURITY INCIDENTS AND BREACHES. PHARMACORE shall, without unreasonable delay (and within 60 days of discovery), report to Customer any Use or Disclosure of PHI not provided for by this BAA, any confirmed Security Incident, and any confirmed Breach of Unsecured Protected Health Information (as required at 45 CFR 164.410) of which it becomes aware. Each of these is treated as discovered on the first day on which it is known to PHARMACORE or, by exercising reasonable diligence, would have been known to PHARMACORE. If a business associate agreement under which Customer received the PHI requires a shorter reporting period, Customer may notify PHARMACORE in writing, and the parties will agree in good faith on a corresponding period. This Section is notice of the ongoing existence of attempted but unsuccessful Security Incidents (such as pings, port scans, blocked denial-of-service attempts, and unsuccessful log-on attempts) that do not result in unauthorized access, Use, Disclosure, modification, or destruction of PHI or interference with system operations, and no further notice of them is required. PHARMACORE shall provide Customer with the information described in 45 CFR 164.410(c), to the extent available, and any other relevant information reasonably requested to permit Customer to comply with the notification requirements set forth at 45 C.F.R. §164.400 et seq. PHARMACORE shall take corrective action and will use commercially reasonable efforts to mitigate and cure, to the extent reasonably necessary, harmful effects resulting from a Breach that are known to or anticipated by PHARMACORE. Customer shall provide all necessary notifications of the Breach to Individuals and/or other persons or entities, at its cost; where the Breach resulted from PHARMACORE’s breach of this BAA or the Agreement, Customer may recover those costs from PHARMACORE as damages, subject to Section 17 of the Terms.
TERM AND TERMINATION. Unless terminated sooner for cause as set out in this Section 8, the term of this BAA shall begin on its effective date and shall terminate upon the later of (i) the termination of the Agreement, or (ii) when PHARMACORE ceases to have access to or otherwise process any PHI received from, or created, received, maintained or transmitted by or on behalf of, Customer. Customer may terminate this BAA and the affected Services if PHARMACORE violates a material term of this BAA, and such violation is not cured within 30 days from the date Customer provides PHARMACORE written notice of such violation. Upon expiration or termination of the Agreement or this BAA for any reason, PHARMACORE, with respect to PHI received from Customer, or created, maintained, or received by PHARMACORE on behalf of Customer, shall: (A) make the PHI available to Customer for export during the Transition Period described in Section 18 of the Terms; (B) thereafter return to Customer or destroy the PHI that PHARMACORE and its Subcontractors maintain, within the time stated in Section 18 of the Terms, retaining only PHI that is Required By Law to be retained, that is contained in audit logs PHARMACORE retains as HIPAA compliance documentation, or that is otherwise infeasible to return or destroy; (C) continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI to prevent Use or Disclosure of the PHI, other than as provided for in this Section, for as long as PHARMACORE retains the PHI; and (D) not use or disclose the PHI retained by PHARMACORE other than for the purposes for which such PHI was retained and subject to the same conditions set out herein that applied prior to termination, and destroy it when those purposes end.
MISCELLANEOUS. The provisions of this BAA shall prevail over the provisions of any other prior agreement that exists between the parties that may conflict with, or appear inconsistent with, any provision of this BAA or HIPAA, unless otherwise explicitly set forth in such agreement. A reference in this BAA to a section in the HIPAA Rules means the section as in effect or as amended, and any ambiguity in this BAA shall be interpreted to permit compliance with the HIPAA Rules. The parties will amend this BAA as necessary to comply with changes in the HIPAA Rules. The version of this BAA in effect when Customer accepts it governs until the parties agree otherwise in writing or an amendment is required for compliance with the HIPAA Rules. The relationship between PHARMACORE and Customer is an independent contractor relationship. This BAA shall not be construed to create an agency, partnership, employer/employee, master/servant or joint venture relationship between the parties. The invalidity or unenforceability of any particular provision of this BAA shall not affect the other provisions hereof, and this BAA shall be construed in all respects as if such invalid or unenforceable provisions were omitted. Nothing express or implied in this BAA is intended to confer, nor shall anything herein confer, upon any person other than the parties hereto and their respective successors and permitted assigns, any rights, remedies, obligations, or liabilities whatsoever. Except as expressly stated herein, this BAA shall not modify the limitations of liability, indemnification clauses, warranties offered or disclaimed, or other terms and conditions of the Agreement. This BAA is governed by the law that governs the Agreement. The respective rights and obligations of the parties under Section 8(B)-(D) and Section 9 (Miscellaneous) will survive termination of this BAA indefinitely. This BAA may be executed in several counterparts, each of which will be deemed an original but all of which will constitute one and the same agreement. Facsimile signatures and electronic copies of signatures shall have the same force and effect as original signatures.
[End of Document]