HIPAA Business Associate Agreement

This Business Associate Agreement (the "Agreement") is between Quillentra ("Business Associate" or "Quillentra") and the practice or organization that accepts it ("Covered Entity"). It forms part of the Quillentra Terms of Service (the "Terms").

Covered Entity uses Quillentra to create clinical documentation. In providing that service, Business Associate creates, receives, maintains and transmits Protected Health Information on Covered Entity's behalf. This Agreement sets out how Business Associate will protect that information, as required by HIPAA, the HITECH Act and their implementing regulations.

If Covered Entity is itself a business associate of another covered entity, "Covered Entity" in this Agreement means that business associate. Quillentra acts as its subcontractor, and this Agreement serves as the required subcontractor agreement.

Terms used but not defined in this Agreement have the meanings given in the HIPAA Rules. These include: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information ("PHI"), Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information and Use.

• "HIPAA Rules" means the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Parts 160 and 164, as amended.
• "PHI" in this Agreement is limited to PHI that Business Associate creates, receives, maintains or transmits on behalf of Covered Entity. It includes electronic PHI.

Business Associate agrees to:

1. Not use or disclose PHI other than as permitted or required by this Agreement or as Required by Law.
2. Use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI. The purpose is to prevent any use or disclosure of PHI other than as this Agreement provides. These safeguards include encryption of PHI in transit and at rest, authentication of every user (single-use sign-in codes or a federated identity provider, with multi-factor authentication for password sign-ins), automatic logoff and an audit trail of access to PHI.
3. Report to Covered Entity any use or disclosure of PHI not provided for by this Agreement of which it becomes aware. This includes Breaches of Unsecured PHI as required at 45 CFR 164.410, and any Security Incident of which it becomes aware. Business Associate will report a Breach of Unsecured PHI without unreasonable delay, and in no case later than 60 calendar days after discovery. The report will include, to the extent possible, the identification of each Individual affected. It will also include any other available information Covered Entity needs to notify Individuals under 45 CFR 164.404(c), and Business Associate will supplement it as information becomes available.
4. Treat this paragraph as notice of unsuccessful Security Incidents, which need no further report. Examples include pings, port scans, blocked sign-in attempts and denial-of-service attempts that do not result in unauthorized access to, or use or disclosure of, PHI.
5. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractor that creates, receives, maintains or transmits PHI on Business Associate's behalf agrees in writing to the same restrictions, conditions and requirements that apply to Business Associate. The current list of Subcontractors is published on Quillentra's Data retention & deletion page.
6. Make PHI in a Designated Record Set available to Covered Entity, so that Covered Entity can meet its obligations under 45 CFR 164.524. Covered Entity can export this information at any time from within the service. On request, Business Associate will otherwise provide it within fifteen (15) days.
7. Make any amendment to PHI in a Designated Record Set that Covered Entity directs or agrees to under 45 CFR 164.526. Covered Entity can make such amendments directly within the service.
8. Maintain the information needed for Covered Entity to provide an accounting of disclosures under 45 CFR 164.528, and provide it to Covered Entity within fifteen (15) days of a request.
9. Forward to Covered Entity within ten (10) business days any request it receives directly from an Individual for access, amendment or an accounting of disclosures, and not respond to the Individual except as Covered Entity directs.
10. Comply with the requirements of Subpart E of 45 CFR Part 164 that apply to Covered Entity, to the extent Business Associate carries out any of Covered Entity's obligations under that Subpart.
11. Make its internal practices, books and records available to the Secretary, for purposes of determining compliance with the HIPAA Rules.
12. Limit its uses, disclosures and requests of PHI to the Minimum Necessary to accomplish the intended purpose.
13. Mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure of PHI in violation of this Agreement.
14. Not sell PHI, not use or disclose PHI for marketing, and not use PHI to train artificial-intelligence models.

1. Business Associate may use and disclose PHI to perform the services described in the Terms for Covered Entity. This includes transcription, drafting and editing of clinical documents, the clinical assistant, storage, export, support, and securing the service.
2. Business Associate may use or disclose PHI as Required by Law.
3. Business Associate will not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity. The exceptions are the uses permitted in paragraphs 4 and 5.
4. Business Associate may use PHI for its proper management and administration, or to carry out its legal responsibilities.
5. Business Associate may disclose PHI for its proper management and administration, or to carry out its legal responsibilities, in either of two cases. The first is where the disclosure is Required by Law. The second is where Business Associate obtains reasonable assurances from the recipient that the information will remain confidential, and will be used or further disclosed only as Required by Law or for the purpose for which it was disclosed. The recipient must also agree to notify Business Associate of any instance in which the confidentiality of the information has been breached.

Covered Entity agrees to:

1. Notify Business Associate of any limitation in its Notice of Privacy Practices under 45 CFR 164.520, to the extent it may affect Business Associate.
2. Notify Business Associate of any change in, or revocation of, an Individual's permission to use or disclose PHI, to the extent it may affect Business Associate.
3. Notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to under 45 CFR 164.522, to the extent it may affect Business Associate.
4. Not ask Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Covered Entity.
5. Manage its own workforce's access to the service and to PHI it copies or exports from the service. This includes inviting and removing members, assigning roles, choosing practice settings such as shared visits and audio retention, and obtaining any patient notice or consent the law requires before recording.

1. Term. This Agreement takes effect when Covered Entity accepts it, which happens when its practice is created in Quillentra. It continues until the Terms end, or until it is terminated under paragraph 2.
2. Termination for cause. Covered Entity may terminate this Agreement and the Terms if Business Associate has violated a material term of this Agreement and has not cured the violation within thirty (30) days of written notice.
3. Return or destruction of PHI. Before termination, Covered Entity may export its PHI from the service. After termination, Business Associate will destroy all PHI it maintains in any form, and will retain no copies. PHI is deleted from active systems within thirty (30) days, and expires from encrypted backups within 35 days after that. Business Associate will ensure its Subcontractors do the same. Where returning or destroying PHI is infeasible, the protections of this Agreement continue for as long as Business Associate retains it. Business Associate will also limit further uses and disclosures to the purposes that make return or destruction infeasible.
4. Survival. Business Associate's obligations under this section survive termination.

1. Regulatory references. A reference to a section of the HIPAA Rules means that section as in effect or as amended.
2. Amendment. The parties will amend this Agreement as necessary to comply with changes to the HIPAA Rules. Quillentra may update this Agreement by publishing a new version and notifying Covered Entity at least 30 days before it takes effect, except where an earlier effective date is required by law.
3. Interpretation. Any ambiguity in this Agreement will be resolved to permit compliance with the HIPAA Rules.
4. Conflicts. If this Agreement conflicts with the Terms or any other agreement between the parties on the handling of PHI, this Agreement controls.
5. No third-party beneficiaries. Nothing in this Agreement gives any person other than the parties any rights, remedies or obligations.
6. Governing law. This Agreement is governed by the laws of the jurisdiction in which Quillentra is organized, to the extent not preempted by the HIPAA Rules or other federal law.
7. Notices. Business Associate sends notices to Covered Entity's account owner's email address on file. Covered Entity sends notices to legal@quillentra.com. Security concerns go to security@quillentra.com.
8. Electronic acceptance. This Agreement is accepted electronically. Quillentra records the date, the accepting user and the version accepted. No signature is required for it to be binding. Covered Entity's owners and admins can download an executed copy, with a certificate of acceptance, at any time from Settings → Organization → General.