Loading...
HomeMy WebLinkAbout5996 k Barracuda HIPAA BUSINESS ASSOCIATE AGREEMENT Barracuda Networks, Inc. ("Business Associate") and is-Cs t,, L ("CoveredEntity") agree to this HIPAA Business Associate Agreement ("Business Associate Agreement").This Business Associate Agreement is effective as of the date last signed below("Effective Date"). RECITALS The Covered Entity wishes to disclose certain information to the Business Associate,some of which may constitute Protected Health Information (as defined below), in connection with the functions, activities and services that Business Associate performs for Covered Entity in accordance with Business Associate's general terms and conditions and any additional agreements for Business Associate's services entered into between the parties(the"Underlying Agreement(s)"). Therefore, in consideration of the mutual promises below, and intending to be legally bound hereby,the parties agree as follows: I. Definitions. Unless the context clearly indicates otherwise, terms used, but not otherwise defined, in this Business Associate Agreement shall have the same meaning as those terms in the HIPAA Rules(defined below). a. "Breach" shall have the same meaning as the term"breach" under 45 C.F.R. §164.402, except that in the context of a breach of an agreement or contract, including this Business Associate Agreement, or in the context of a"material breach,"the term "breach" shall refer to a failure to perform a term of an agreement and shall be given the meaning afforded the term under ordinary contract law. b. "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Pub. L.No. 104-191. c. "HITECH Act" means the Health Information Technology for Economic and Clinical Health Act of 2009. d. "HIPAA Rules" means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164. e. "Protected Health Information" or "PHI" shall have the same meaning as the term "protected health information" in 45 CFR §160.103, limited to the information received or created by Business Associate from or on behalf of Covered Entity. f. "Secretary" means the Secretary of the Department of Health and Human Services ("HHS")or his designee. g. "UHCIA"means the Uniform Health Care Information Act,Chapter 70.02 RCW. BAA Agreement Page 1 of 6 10/07/2015 Confidential information of Barracuda Networks,inc. k Barracuda 2. Obligations of the Business Associate. a. The Business Associate shall not use or disclose PHI other than as permitted or required by this Business Associate Agreement or as Required By Law. b. The Business Associate shall use appropriate safeguards, and comply with Subpart C of 45 CFR part 164 with respect to electronic PHI,to prevent the use or disclosure of PHI other than as provided for by this Business Associate Agreement. c. Upon"discovery,"as the term is defined in 45 C.F.R. §164.410,by Business Associate of a Breach of unsecured PHI, Business Associate agrees to report such Breach to Covered Entity without unreasonable delay, and in any case within 30 calendar days of Business Associate's "discovery"of such Breach. Such notice shall include the identification of each Individual whose Unsecured PHI has been,or is reasonably believed by Business Associate to have been,accessed, acquired, or disclosed in connection with such Breach. In addition,Business Associate shall provide any additional information reasonably requested by Covered Entity for purposes of investigating the Breach and any other available information that Covered Entity is required to include to the Individual under 45 C.F.R. §164.404(c) at the time of notification or promptly thereafter as information becomes available. Business Associate's notification of a Breach of Unsecured PHI under this Section shall comply in all respects with each applicable provision of the HIPAA Rules and the HITECH Act. d. Business Associate agrees to report to Covered Entity any use or disclosure of PHI not provided for by this Business Associate Agreement of which it becomes aware, and any security incident of which it becomes aware. e. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, the Business Associate shall ensure that any subcontractor that creates, receives, maintains, or transmits PHI on behalf of the Business Associate agrees in writing to the same restrictions, conditions and requirements that apply to the Business Associate under this Business Associate Agreement with respect to such PHI. f. Within a reasonable period of time,but no later than 15 working days from the receipt of a request from Covered Entity, and in the manner agreed to between the parties, Business Associate agrees to provide access to PHI in a Designated Record Set to Covered Entity as necessary to meet the Covered Entity's obligations under 45 CFR§164.524 and RCW 70.02.080. g. Within a reasonable period of time, but no later than 10 working days after receiving a request, Business Associate agrees to make any amendment(s)to PHI in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR §164.526_and RCW 70.02.100. Notwithstanding the foregoing, Business Associate need not make amendments to PHI in a Designated Record Set unless the Covered Entity is unable to make such amendments to such PHI. h. Business Associate agrees that when requesting, using or disclosing PHI, such request, use or disclosure shall be to the minimum extent necessary to accomplish the intended purpose of such request,use or disclosure. BAA Agreement Page 2 of 6 10/0712013 ConfIdential Information of Barracuda Networks,Inc. Barracuda i. Business Associate agrees to make internal practices, books and records relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of, Covered Entity available to the Secretary, in a time and manner designated by the Secretary, for purposes of the Secretary determining Covered Entity's compliance with the HIPAA Rules. j. Business Associate agrees to maintain and make available to the Covered Entity, within 30 calendar days of the receipt of a request from Covered Entity, any information required for Covered Entity to respond to a request by an Individual or the Secretary for an accounting of PHI disclosures as necessary to satisfy the Covered Entity's obligations under 45 C.F.R. 164.528 and RCW 70.02.020. k. Business Associate agrees to account for any disclosure of PHI used or maintained as an electronic record of health-related information on an Individual that is created,gathered,managed and consulted by authorized health care clinicians and staff ("Electronic Health Record" or "EHR") in a manner consistent with 45 C.F.R. §164.528; provided that an Individual shall have the right to receive an accounting of disclosures of EHR by the Business Associate made on behalf of the Covered Entity only during the six years prior to the date on which the accounting is Covered Entity. requested from 1. Business Associate agrees to comply with the "Prohibition on Sale of Electronic Health Records or Protected Health Information," as provided in section 13405(d) of Subtitle D (Privacy) of the HITECH Act, and the "Conditions on Certain Contacts as Part of Health Care Operations,"as provided in section 13406 of Subtitle D(Privacy)of the HITECH Act. m. Business Associate acknowledges that, as of the Effective Date of this Business Associate Agreement, it shall be liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. 1320d-5 and 1320d-6, as amended, for failure to comply with any of the use and disclosure requirements of this Business Associate Agreement. n. Business Associate shall comply with any applicable provisions of the HIPAA Rules and with any provisions, if any, in the Washington UNCIA that are directly applicable to Business Associate in its role as a service provider for Covered entity. o. To the extent that Business Associate is to carry out an obligation of the Covered Entity under Subpart E of 45 CFR Part 164 and the UHCIA, Business Associate shall comply with the requirements of that subpart that apply to the Covered Entity in the performance of such obligation. 3. Permitted Uses and Disclosures by Business Associate. Except as otherwise limited in this Business Associate Agreement, Business Associate may use or disclose PHI to perform under the Underlying Agreement(s), provided that such use or disclosure would not violate Subpart E of 45 CFR Part 164 if done by Covered Entity. BAA Agreement Page 3 of 6 10/07/2013 Confidential Information of Barracuda Networks,Inc. Barracuda 4. Obligations of and Permissible Requests by Covered Entity. a. Covered Entity shall notify Business Associate of any limitation(s) in its notice of privacy practices of Covered Entity in accordance with 45 CFR §164.520,to the extent that such limitation may affect Business Associate's use or disclosure of PHI. b. Covered Entity shall notify Business Associate of any changes in, or revocation of, permission by Individual to use or disclose PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI. c. Covered Entity shall notify Business Associate of any restrictions on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522,to the extent that such restriction may affect Business Associate's use or disclosure of PHI. d. Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Covered Entity. 5. Term and Termination. a. Term. The Term of this Business Associate Agreement shall be effective as of the Effective Date, and shall terminate when all of the PHI received or created by Business Associate from or on behalf of Covered Entity is destroyed or returned to Covered Entity, or, if it is not feasible to return or destroy PHI, protections are extended to such information, in accordance with the termination provisions in this Section. b. Termination for Breach. Upon either party's knowledge of material breach by the other party, the non-breaching party shall provide an opportunity for the breaching party to cure the breach or end the violation within a reasonable timeframe, not to exceed 30 days from receipt of written notification of the breach. If the breaching party does not cure the breach or end the violation, or if a material term of this Business Associate Agreement has been breached and a cure is not possible, the non-breaching party may terminate this Business Associate Agreement and the applicable Underlying Agreement(s),upon written notice to the other party. c. Judicial or Administrative Proceeding. Either party may terminate this Agreement, effective immediately, if(i)the other party is named as a defendant in a criminal proceeding for a violation of the HIPAA Rules or(ii)a finding or stipulation that the other party has violated any standard or requirement of the HIPAA Rules or other security or privacy laws is made in any administrative or civil proceeding in which the party has been joined. d. Termination of Underlying Agreement.Upon termination or expiration of the Underlying Agreement(s) for any reason, either party may terminate this Business Associate Agreement immediately upon written notice. e. Effect of Termination. Upon termination of this Business Associate Agreement for any reason,the Business Associate shall return or destroy all PHI received from Covered Entity, and the Business Associate shall retain no copies of the PHI. In the event that the return or destruction of PHI is not feasible, the Business Associate shall extend the protections of this Business BAA Agreement Page 4 of 6 10/07/2013 Confidential Information of Barracuda Networks,inc. 1 14 Barracuda 1( Associate Agreement to such PHI and limit further uses or disclosures to those purposes that make the return or destruction not feasible,for so long as the Business Associate maintains such PHI. 6. Miscellaneous. a. Regulatory References. A reference in this Business Associate Agreement to a section in the HIPAA Rules means the section as in effect or as amended. b. Amendment. The parties agree to negotiate in good faith to amend this Business Associate Agreement from time to time as is necessary for Covered Entity to comply with the requirements of the HIPAA Rules,the UHCIA and the HITECH Act. c. Survival. The respective rights and obligations of Business Associate under Section 5e of this Business Associate Agreement shall survive the termination of this Business Associate Agreement. d. Interpretation. Any ambiguity in this Business Associate Agreement shall be resolved to permit Covered Entity to comply with the UHCIA and the HIPAA Rules. Any inconsistency between this Business Associate Agreement and the UHCIA rules and the HIPAA Rules, including all amendments, as interpreted by the HHS, court or another regulatory agency with authority over the parties, shall be interpreted according to the interpretation of the HHS, the court or the regulatory agency.Any provisions of this Business Associate Agreement that are not mandated by the HIPAA Rules, but are nonetheless permitted by the HIPAA Rules, shall be adhered to as stated in this Business Associate Agreement. e. Entire Agreement; Other Provisions. This Business Associate Agreement, together with the Underlying Agreement(s), states the entire understanding and agreement between the parties with respect to the subject matter hereof, and supersedes and replaces all prior and contemporaneous understandings or agreements,written or oral,regarding such subject matter. If any express terms of this Business Associate Agreement conflict with the Underlying Agreement(s), then this Business Associate Agreement, if applicable, shall control as to those terms. The Underlying Agreement(s) shall control in all other instances, including, without limitation,liability,remedies,limitation of liability, limitation of remedies,warranties,disclaimer of warranties, or indemnification. This Business Associate Agreement may not be modified unless done so in writing and signed by a duly authorized representative of both parties. If any provision of this Business Associate Agreement, or part thereof, is found to be invalid, the remaining provisions shall remain in effect. f. Except to the extent preempted by federal law,this Business Associate Agreement shall be governed by and construed in accordance with the same internal Iaws as stated in the applicable Underlying Agreement(s). BAA Agreement Page 5 of 8 10/0712013 Confidential Information of Barracuda Networks,Inc. 1 Barracuda 411( IN WITNESS WHEREOF, the parties hereto have duly executed this Business Associate Agreement as of the Effective Date. COVERED ENTITY BUSINESS ASSOCIATE ( , m,,i 0?„) Barracuda Networks,Inc. 3111-* 4 0.- ci, 4,-;+e 610o 3175 South Winchester Blvd. ZZie-pniit44ou` V'AqX.. r) Campbell,CA 95008 (....41P,MIE lith. . )1. Signed Signed Diane Honda K � 4- � Print Name Print Name hisM40944/ Itiv- aryl cS1-4,14-5 VP,General Counsel Title Title) -3h7,f 4 March 17,2015 Date Date BM Agreement Page 6 of 6 10/0712013 Confidential Information of Barracuda Networks,inc.