Onye Inc. Business Associate Agreement

This Business Associate Agreement ("Agreement") is entered into between Onye Inc. ("Business Associate" or "Onye") and the healthcare organization that accepts this Agreement during account creation on OnyeSync ("Customer"). Customer is referred to in this Agreement as "Covered Entity," except as provided in Section 8.9. This Agreement is effective on the date of that acceptance (the "Effective Date").

RECITALS

WHEREAS, Covered Entity and Business Associate have entered into the Terms of Use and any applicable Service Order (together, the "Services Agreement");

WHEREAS, in connection with the Services Agreement, Business Associate may create, receive, maintain, or transmit Protected Health Information ("PHI") on behalf of Covered Entity;

WHEREAS, the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), and implementing regulations (collectively, "HIPAA Rules") require Covered Entity to enter into a written agreement with Business Associate containing specific terms regarding the use and disclosure of PHI;

NOW THEREFORE, in consideration of the mutual promises and covenants contained herein, the parties agree as follows:

1. DEFINITIONS

Terms used but not otherwise defined in this Agreement shall have the meanings set forth in the HIPAA Rules, including:

1.1 Breach: Breach has the meaning given in 45 CFR § 164.402.

1.2 Covered Entity: An entity covered under HIPAA, including healthcare providers, health plans, and healthcare clearinghouses.

1.3 Designated Record Set: A group of records maintained by or for a Covered Entity that is used to make decisions about individuals and includes medical records, billing records, enrollment records, and claims records.

1.4 Individual: The person who is the subject of PHI.

1.5 Protected Health Information (PHI): Information that relates to the past, present, or future physical or mental health or condition of an individual; the provision of healthcare to an individual; or the past, present, or future payment for healthcare provided to an individual, and that identifies the individual or could be used to identify the individual.

1.6 Required by Law: A mandate contained in law that compels an entity to make a use or disclosure of PHI.

1.7 Secretary: The Secretary of the U.S. Department of Health and Human Services.

1.8 Other Terms: Terms of Use, Service Order, Authorized Users, and De-Identified Data have the meanings given in the Terms of Use.

2. PERMITTED USES AND DISCLOSURES OF PHI

2.1 General Use and Disclosure Provisions

Business Associate may use and disclose PHI only to the extent necessary to perform the services specified in the Services Agreement, and as permitted or required by this Agreement, the Services Agreement, or as Required by Law.

2.2 Specific Permitted Uses and Disclosures

Business Associate may use or disclose PHI:

A. To Perform Services

• To provide Patient Access API services as specified in the Services Agreement
• To retrieve patient health information from healthcare providers via TEFCA Individual Access Services
• To normalize and standardize data into FHIR R4 format
• To match patient identities across multiple healthcare providers
• To retrieve medical imaging and radiology reports from Covered Entity's connected PACS and other source systems
• To store and display imaging and reports to Authorized Users for treatment and clinical decision-making
• To share imaging and reports with referral providers designated by Covered Entity, as permitted by HIPAA
• To transmit PHI to Covered Entity via secure API
• To generate reports, maintain audit trails, and provide technical support and maintenance for the Service

B. For Business Associate's Proper Management and Administration

• As necessary for Business Associate's proper management and administration
• To carry out Business Associate's legal responsibilities
• Provided that:
  • Such disclosures are Required by Law, OR
  • Business Associate obtains reasonable assurances from the recipient that the PHI will be held confidentially and used or further disclosed only as Required by Law or for the purposes for which it was disclosed, and the recipient will notify Business Associate of any instances of which it becomes aware that the confidentiality of the PHI has been breached

C. Data Aggregation Services

Business Associate may use PHI to provide Data Aggregation services to Covered Entity as permitted by 45 CFR § 164.504(e)(2)(i)(B).

D. De-identification

Business Associate may de-identify PHI in accordance with 45 CFR § 164.514(b), provided that de-identified information is not re-identified and is used in compliance with applicable law. Covered Entity acknowledges that De-Identified Data is not PHI and, as provided in the Terms of Use, is owned by Business Associate and may be used by Business Associate for analytics, research, benchmarking, and other lawful purposes, provided it is not re-identified.

2.3 Prohibited Uses and Disclosures

Business Associate shall NOT:

• Use or disclose PHI for fundraising or marketing purposes, except as permitted by HIPAA
• Sell PHI, except as permitted by 45 CFR § 164.502(a)(5)(ii)
• Use or disclose PHI in a manner that would violate the HIPAA Privacy Rule if done by Covered Entity
• Disclose PHI to a third party without authorization unless required for services or Required by Law

3. OBLIGATIONS OF BUSINESS ASSOCIATE

3.1 Safeguards

Business Associate shall implement and maintain appropriate administrative, physical, and technical safeguards to prevent use or disclosure of PHI other than as provided by this Agreement. Such safeguards shall comply with the HIPAA Security Rule (45 CFR Part 164, Subpart C).

Minimum Required Safeguards:

• Administrative: Security management process, workforce training, access management, security awareness training, incident response procedures
• Physical: Facility access controls, workstation security, device and media controls
• Technical: Access controls, encryption (TLS 1.2 or higher for transmission, AES-256 for storage), audit controls, integrity controls, authentication

3.2 Reporting

Business Associate shall report to Covered Entity:

A. Breaches

Any Breach of Unsecured PHI without unreasonable delay and in no case later than 24 hours after discovery of the Breach. The report shall include:

• Description of what occurred
• Date of the Breach and date of discovery
• Types of PHI involved
• Number of Individuals affected
• Steps taken to mitigate harm
• Contact information for further inquiries

B. Security Incidents

Any successful Security Incident (as defined in 45 CFR § 164.304) that affects PHI within 48 hours of discovery.

C. Unauthorized Uses or Disclosures

Any use or disclosure of PHI not permitted by this Agreement within 24 hours of becoming aware.

3.3 Mitigation

Business Associate shall mitigate, to the extent practicable, any harmful effect of a use or disclosure of PHI in violation of this Agreement that is known to Business Associate.

3.4 Subcontractors

Business Associate shall ensure that any subcontractors or agents that create, receive, maintain, or transmit PHI on behalf of Business Associate agree in writing to the same restrictions and conditions that apply to Business Associate under this Agreement, including compliance with the HIPAA Rules.

Subcontractor Information: Business Associate shall provide Covered Entity with a list of subcontractors upon request and notify Covered Entity of any changes within 30 days.

3.5 Access to PHI

Business Associate shall make PHI maintained in a Designated Record Set available to Covered Entity or, at Covered Entity's direction, to an Individual, in the time and manner designated by Covered Entity, but in no event later than 15 days after request, to meet Covered Entity's obligations under 45 CFR § 164.524.

3.6 Amendment of PHI

Business Associate shall make PHI available for amendment and incorporate any amendments to PHI in accordance with 45 CFR § 164.526 within 15 days of notification by Covered Entity.

3.7 Accounting of Disclosures

Business Associate shall document and make available to Covered Entity or an Individual, in the time and manner designated by Covered Entity, information required to provide an accounting of disclosures in accordance with 45 CFR § 164.528, but in no event later than 15 days after request.

Accounting Requirements:

• Maintain records of all disclosures for at least 6 years
• Include: date, name/address of recipient, description of PHI, purpose of disclosure
• Exclude disclosures for treatment, payment, healthcare operations, or to the Individual

3.8 Books and Records

Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining Covered Entity's compliance with the HIPAA Privacy Rule. Access shall be provided within 10 business days of request.

3.9 Minimum Necessary

Business Associate shall request, use, and disclose only the minimum amount of PHI necessary to accomplish the intended purpose, in accordance with 45 CFR § 164.502(b) and § 164.514(d).

3.10 Data Integrity and Availability

Business Associate shall implement policies and procedures to ensure the confidentiality, integrity, and availability of PHI, and protect against reasonably anticipated threats, hazards, or unauthorized uses or disclosures.

3.11 Privacy Rule Compliance

To the extent Business Associate carries out one or more of Covered Entity's obligations under Subpart E of 45 CFR Part 164, Business Associate shall comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligations.

4. OBLIGATIONS OF COVERED ENTITY

4.1 Permissible Requests

Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Covered Entity, except as permitted for Business Associate's proper management and administration or legal responsibilities.

4.2 Appropriate Safeguards

Covered Entity shall implement and maintain appropriate safeguards to protect PHI provided to Business Associate.

4.3 Notice of Privacy Practices

Covered Entity shall provide Business Associate with a copy of its Notice of Privacy Practices and any changes thereto, to the extent such Notice or changes affect Business Associate's obligations under this Agreement.

4.4 Authorization and Consent

Covered Entity shall obtain any necessary patient authorizations, consents, or permissions required for Business Associate to perform services under the Services Agreement.

4.5 Restrictions

Covered Entity shall notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR § 164.522, to the extent such restriction affects Business Associate's use or disclosure of PHI.

5. TERM AND TERMINATION

5.1 Term

This Agreement shall commence on the Effective Date and shall terminate on the earlier of:

• Termination of the Services Agreement, or
• Termination pursuant to Section 5.2 or 5.3 of this Agreement

5.2 Termination for Cause by Covered Entity

Covered Entity may terminate this Agreement immediately upon written notice if:

• Business Associate breaches a material term of this Agreement and fails to cure within 30 days of written notice (or immediately if cure is not possible)
• Business Associate has a pattern or practice of non-compliance that constitutes a material breach

5.3 Termination for Cause by Business Associate

Business Associate may terminate this Agreement immediately upon written notice if Covered Entity materially breaches its obligations under Section 4 and fails to cure within 30 days of written notice.

5.4 Effect of Termination

A. Return or Destruction. Within thirty (30) days after termination, Business Associate shall, at Covered Entity's election, return or destroy all PHI, and shall destroy or cryptographically erase all backup copies within sixty (60) days, with written certification. Upon request made before termination or during the thirty (30) day period, Business Associate shall make PHI available for export in a standard format (such as DICOM and PDF) before destruction.

B. Exception for Infeasibility If Business Associate determines that return or destruction is infeasible, Business Associate shall:

• Notify Covered Entity in writing of the conditions making return or destruction infeasible
• Extend the protections of this Agreement to such PHI
• Limit further uses and disclosures to those purposes that make return or destruction infeasible
• Not use or disclose such PHI except as Required by Law or for such limited purposes
• Return or destroy the PHI when feasibility is no longer an obstacle

Audit logs required to be retained for six (6) years under HIPAA may contain PHI; return or destruction is infeasible, and Business Associate shall retain them subject to this Agreement and destroy them at the end of the retention period.

C. Survival The obligations of Business Associate under this Section 5.4 shall survive termination of this Agreement.

6. BREACH NOTIFICATION OBLIGATIONS

6.1 Discovery of Breach

Business Associate shall, following the discovery of a Breach of Unsecured PHI:

A. Notification Timeline

• Within 24 hours: Provide initial notification to Covered Entity
• Within 7 days: Provide detailed Breach report

B. Required Information

• Identification of each Individual whose Unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, or disclosed
• Date of the Breach and date of discovery
• Description of the types of Unsecured PHI involved
• Brief description of what happened
• Description of what Business Associate is doing to investigate, mitigate, and prevent recurrence
• Contact information for Business Associate representative
• Any other available information required for Covered Entity's notification obligations under 45 CFR Part 164, Subpart D

6.2 Covered Entity's Rights

Covered Entity has the sole right to determine whether a Breach has occurred and what notifications are required under 45 CFR Part 164, Subpart D.

6.3 Cooperation

Business Associate shall cooperate with Covered Entity in investigating and mitigating the Breach and shall provide additional information as requested.

7. INDEMNIFICATION

7.1 Business Associate Indemnification

Business Associate shall indemnify, defend, and hold harmless Covered Entity from and against any claims, damages, costs, or expenses (including reasonable attorneys' fees) arising from:

• Business Associate's breach of this Agreement
• Business Associate's violation of the HIPAA Rules
• Business Associate's unauthorized use or disclosure of PHI
• Any Breach caused by Business Associate or its subcontractors

7.2 Covered Entity Indemnification

Covered Entity shall indemnify, defend, and hold harmless Business Associate from and against any claims, damages, costs, or expenses (including reasonable attorneys' fees) arising from:

• Covered Entity's breach of this Agreement
• Covered Entity's failure to obtain proper patient authorization
• Covered Entity's instructions that cause Business Associate to violate HIPAA Rules

7.3 Limitation

Business Associate's total aggregate liability under Section 7.1 shall not exceed the fees paid by Customer to Business Associate in the twelve (12) months immediately preceding the event giving rise to the claim. This limit does not apply to liability arising from Business Associate's gross negligence or willful misconduct, or to the extent liability cannot be limited by applicable law.

8. MISCELLANEOUS PROVISIONS

8.1 Regulatory Changes

The parties acknowledge that state and federal laws relating to data security and privacy are rapidly evolving and that amendments may be required to this Agreement to comply with such changes. The parties agree to negotiate in good faith to amend this Agreement as necessary to comply with applicable law.

8.2 Amendment

This Agreement may be amended only by written agreement signed by both parties. However, Business Associate may amend this Agreement to the extent necessary to comply with changes in HIPAA Rules or other applicable laws, by providing 30 days written notice to Covered Entity.

8.3 Interpretation

Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits Covered Entity to comply with the HIPAA Rules.

8.4 Survival

The obligations of Business Associate under Sections 3.7 (Accounting), 3.8 (Books and Records), 5.4 (Effect of Termination), 6 (Breach Notification), and 7 (Indemnification) shall survive termination of this Agreement.

8.5 No Third-Party Beneficiaries

Nothing in this Agreement shall confer upon any person other than the parties and their respective successors or assigns, any rights, remedies, obligations, or liabilities whatsoever.

8.6 Relationship to Services Agreement

This Agreement supplements and is part of the Services Agreement. In the event of any conflict between this Agreement and the Services Agreement, the terms of this Agreement shall control with respect to PHI.

8.7 Notices

All notices under this Agreement shall be in writing and sent in accordance with the notice provisions of the Services Agreement.

8.8 Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the State of New York, without regard to its conflict-of-law principles, except to the extent that applicable federal law or non-waivable laws of another jurisdiction apply.

8.9 Customers That Are Business Associates

If Customer is a Business Associate of a Covered Entity, references to "Covered Entity" in this Agreement mean Customer, and this Agreement is intended to satisfy the subcontractor requirements of 45 CFR § 164.502(e)(1)(ii).

Acceptance

By checking the box to accept this Agreement during account creation, the Customer agrees to be bound by this Agreement. This Agreement is effective on the date of acceptance.

View or download PDF