Business Associate Agreement

HIPAA Business Associate Agreement (BAA)

eSmith IT Consulting Inc. | Authorized IT Provider

1. Definitions

This Business Associate Agreement ("BAA") formally establishes the compliance relationship between eSmith IT Consulting Inc., operating as the "Business Associate," and the electronically signing organization identified below, operating as the "Covered Entity."

• HIPAA Rules shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.
• Protected Health Information (PHI) shall have the same meaning as the term "protected health information" in 45 CFR § 160.103.

2. Obligations and Activities of Business Associate

The Business Associate (eSmith IT) agrees to:

1. Not use or disclose PHI other than as permitted or required by this Agreement, the underlying Master Services Agreement, or as required by law.
2. Use appropriate administrative, physical, and technical safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this Agreement.
3. Report to the Covered Entity any unauthorized use or disclosure of PHI not provided for by the Agreement of which it becomes aware, including breaches of unsecured PHI as required at 45 CFR 164.410, and any successful security incident.
4. Ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information in accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2).
5. Make available PHI in a designated record set to the Covered Entity as necessary to satisfy the Covered Entity's obligations under 45 CFR 164.524.

3. Permitted Uses and Disclosures by Business Associate

Except as otherwise limited in this Agreement, the Business Associate may use or disclose PHI to perform technical functions, IT management activities, data backups, network defense audits, or services for, or on behalf of, the Covered Entity as specified in the underlying Master Services Agreement, provided that such use or disclosure would not violate the HIPAA Rules if done by the Covered Entity.

4. Obligations of Covered Entity

The Covered Entity shall notify the Business Associate of any limitation(s) in its notice of privacy practices, changes in permission by individuals to use or disclose PHI, or any restriction on the use or disclosure of PHI that the Covered Entity has agreed to under 45 CFR 164.522, to the extent that such changes may affect the Business Associate's use or disclosure of PHI within the managed IT ecosystem.

5. Term and Termination

A. Term: The Term of this Agreement shall be effective as of the date of electronic signature and shall terminate when all PHI provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or, if it is infeasible to return or destroy PHI, protections are extended to such information.

B. Termination for Cause: Business Associate authorizes termination of this Agreement by Covered Entity if Covered Entity determines Business Associate has violated a material term of the Agreement and Business Associate has not cured the breach within 30 days of written notice.