OutSystems Business Associate Agreement

Updated: Friday, March 11, 2022 - 18:00 GMT

AGREEMENT ENTERED INTO BY OUTSYSTEMS AS A BUSINESS ASSOCIATE AND ITS CUSTOMER AS COVERED ENTITY

1 - GENERAL PROVISIONS
2 - OBLIGATIONS OF COMPANY
3 - OBLIGATIONS OF COVERED ENTITY
4 - TERMINATION OF THE MASTER SUBSCRIPTION AGREEMENT
5 - LIABILITY

1. GENERAL PROVISIONS

1.1 Status of Parties under HIPAA. The parties acknowledge and agree that [Customer] ("Covered Entity") is a Covered Entity and OutSystems ("Company") is a Business Associate of Covered Entity when Company creates, receives, maintains, transmits, uses or discloses Protected Health Information on behalf of Covered Entity ("PHI"). This Addendum shall apply to OutSystems and any of its commonly owned or controlled affiliates that create, receive, maintain or transmit PHI on behalf of Covered Entity.

1.2 Effect.To the extent that Company receives PHI in order to perform Business Associate activities, the terms and provisions of this Addendum shall supersede any conflicting or inconsistent terms and provisions in the Master Subscription Agreement to the extent of such conflict or inconsistency.

1.3 Defined Terms. Capitalized terms used in the Master Subscription Agreement (including this Addendum) without definition shall have the respective meanings assigned to such terms by the Administrative Simplification section of the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act and their implementing regulations as amended from time to time (collectively, "HIPAA").

1.4 No Third Party Beneficiaries. The parties have not created and do not intend to create by the Master Subscription Agreement any third party rights, including, but not limited to, third party rights for Covered Entity's patients.

1.5 HIPAA Amendments. Any future amendments to HIPAA affecting business associate agreements are hereby incorporated by reference into this Addendum as if set forth in this Addendum in their entirety, effective on the later of the effective date of this Addendum or such subsequent date as may be specified by HIPAA.

1.6 Regulatory References. A reference in this Addendum to a section in HIPAA means the section as it may be amended from time to time.

1.7 Independent Contractor Status. The parties acknowledge and agree that Company is at all times acting as an independent contractor of Covered Entity and not as an agent or employee of Covered Entity under the Master Subscription Agreement.

2. OBLIGATIONS OF COMPANY

2.1 Use and Disclosure of PHI. Company may use and disclose PHI as permitted or required under the Master Subscription Agreement (including this Addendum) or as Required by Law, but shall not otherwise use or disclose any PHI. Company shall not use or disclose PHI received from Covered Entity in any manner that would constitute a violation of HIPAA if so used or disclosed by Covered Entity (except as set forth in Sections 2.1(a), (b) and (c) of this Addendum). To the extent Company carries out any of Covered Entity's obligations under the HIPAA privacy standards, Company shall comply with the requirements of the HIPAA privacy standards that apply to Covered Entity in the performance of such obligations. Without limiting the generality of the foregoing, Company is permitted to use or disclose PHI as set forth below:

(i) Company may use PHI internally for Company's proper management and administration or to carry out its legal responsibilities;

(ii) Company may disclose PHI to a third party for Company's proper management and administration, provided that the disclosure is Required by Law or Company obtains reasonable assurances from the third party to whom the PHI is to be disclosed that the third party will (1) protect the confidentiality of the PHI, (2) only use or further disclose the PHI as Required by Law or for the purpose for which the PHI was disclosed to the third party and (3) notify Covered Entity of any instances of which the third party is aware in which the confidentiality of the PHI has been breached;

(iii) Company may use PHI to provide Data Aggregation services relating to the Health Care Operations of Covered Entity if required or permitted under the Master Subscription Agreement; and

(iv) Company may use PHI to create de-identified health information in accordance with the HIPAA de-identification requirements. Company may disclose de-identified health information for any purpose permitted by law.

2.2 Safeguards. Company shall use appropriate safeguards to prevent the use or disclosure of PHI other than as permitted or required by this Addendum. In addition, Company shall implement Administrative Safeguards, Physical Safeguards and Technical Safeguards that reasonably and appropriately protect the Confidentiality, Integrity and Availability of PHI transmitted or maintained in Electronic Media ("EPHI") that it creates, receives, maintains or transmits on behalf of Covered Entity. Company shall comply with the HIPAA Security Rule with respect to EPHI.

2.3 Minimum Necessary Standard To the extent required by the "minimum necessary" requirements of HIPAA, Company shall only request, use and disclose the minimum amount of PHI necessary to accomplish the purpose of the request, use or disclosure.

2.4 Mitigation. Company shall take reasonable steps to mitigate, to the extent practicable, any harmful effect (that is known to Company) of a use or disclosure of PHI by Company in violation of this Addendum.

2.5 Trading Partner Agreement. Company shall not take any of the following actions: (a) change the definition, Data Condition, or use of a Data Element or Segment in a Standard, except where necessary to implement state or federal law, or to protect against fraud and abuse, (b) add any Data Elements or Segments to the maximum defined Data Set, (c) use any code or Data Elements that are either marked "not used" in the Standard's Implementation Specification or are not in the Standard's Implementation Specification(s), or (d) change the meaning or intent of the Standard's Implementation Specification(s).

2.6 Subcontractors. Company shall enter into a written agreement meeting the requirements of 45 C.F.R. §§ 164.504(e) and 164.314(a)(2) with each Subcontractor (including, without limitation, a Subcontractor that is an agent under applicable law) that creates, receives, maintains or transmits PHI on behalf of Company. Company shall ensure that the written agreement with each Subcontractor obligates the Subcontractor to comply with restrictions and conditions that are at least as restrictive as the restrictions and conditions that apply to Company under this Addendum.

2.7 Reporting Requirements

(i) If Company becomes aware of a use or disclosure of PHI in violation of this Addendum by Company or a third party to which Company disclosed PHI, Company shall report the use or disclosure to Covered Entity without unreasonable delay.

(ii) Company shall report any Security Incident involving EPHI of which it becomes aware in the following manner: (1) any actual, successful Security Incident will be reported to Covered Entity in writing without unreasonable delay, and (2) any attempted, unsuccessful Security Incident of which Company becomes aware will be reported to Covered Entity orally or in writing on a reasonable basis, as requested by Covered Entity. If the HIPAA security regulations are amended to remove the requirement to report unsuccessful attempts at unauthorized access, the requirement hereunder to report such unsuccessful attempts will no longer apply as of the effective date of the amendment.

(iii) Company shall, following the discovery of a Breach of Unsecured PHI, notify Covered Entity of the Breach in accordance with 45 C.F.R. § 164.410 without unreasonable delay and in no case later than 60 days after discovery of the Breach.

2.8 Access to PHI. The Company does not presently maintain any Designated Record Sets on behalf of Covered Entity. If in the future Company maintains a Designated Record Set on behalf of the Covered Entity, then within 15 business days of a written request by Covered Entity for access to PHI about an Individual contained in any Designated Record Set of Covered Entity maintained by Company, if any, Company shall make available to Covered Entity such PHI for so long as Company maintains such information in the Designated Record Set. If Company receives a request for access to PHI directly from an Individual, Company shall forward such request to Covered Entity within ten business days. Covered Entity shall have the sole responsibility to make decisions regarding whether to approve a request for access to PHI.

2.9 Availability of PHI for Amendment. The Company does not presently maintain any Designated Record Sets on behalf of Covered Entity. If in the future Company maintains a Designated Record Set on behalf of the Covered Entity, then within 15 business days of receipt of a written request from Covered Entity for the amendment of an Individual's PHI contained in any Designated Record Set of Covered Entity maintained by Company, if any, Company shall provide such information to Covered Entity for amendment and incorporate any such amendments in the PHI (for so long as Company maintains such information in the Designated Record Set) as required by 45 C.F.R. § 164.526. If Company receives a request for amendment to PHI directly from an Individual, Company shall forward such request to Covered Entity within ten business days. Covered Entity shall have the sole responsibility to make decisions regarding whether to approve a request for an amendment to PHI.

2.10 Accounting of Disclosures. Within 30 business days of written notice by Covered Entity to Company that it has received a request for an accounting of disclosures of PHI (other than disclosures to which an exception to the accounting requirement applies), Company shall make available to Covered Entity such information as is in Company's possession and is required for Covered Entity to make the accounting required by 45 C.F.R. § 164.528. If Company receives a request for an accounting directly from an Individual, Company shall forward such request to Covered Entity within ten business days. Covered Entity shall have the sole responsibility to provide an accounting of disclosures to the Individual.

2.11 Availability of Books and Records Following reasonable advance written notice, Company shall make its internal practices, books and records relating to the use and disclosure of PHI received from, or created or received by Company on behalf of, Covered Entity available to the Secretary for purposes of determining Covered Entity's compliance with HIPAA.

3. OBLIGATIONS OF COVERED ENTITY

3.1 Permissible Requests. Covered Entity shall not request Company to use or disclose PHI in any manner that would not be permissible under HIPAA if done directly by Covered Entity (except as provided in Sections 2.1(a), (b) and (c) of this Addendum).

3.2 Minimum Necessary PHI. When Covered Entity discloses PHI to Company, Covered Entity shall provide the minimum amount of PHI necessary for the accomplishment of Company's purpose. For these purposes, Covered Entity undertakes to not include any PHI in the logs and URL of its application. In case this is not possible, Covered Entity undertakes to encrypt such PHI.

3.3 Permissions; Restrictions. Covered Entity represents and warrants that it has obtained and will obtain any consents, authorizations and/or other legal permissions required under HIPAA and other applicable law for the disclosure of PHI to Company. Covered Entity shall notify Company of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes may affect Company's use or disclosure of PHI. Covered Entity shall not agree to any restriction on the use or disclosure of PHI under 45 C.F.R. § 164.522 that restricts Company's use or disclosure of PHI under this Addendum unless such restriction is Required By Law or Company grants its written consent, which consent shall not be unreasonably withheld.

3.4 Notice of Privacy Practices. Except as Required By Law, with Company's consent or as set forth in the Master Subscription Agreement, Covered Entity shall not include any limitation in the Covered Entity's notice of privacy practices that limits Company's use or disclosure of PHI under the Master Subscription Agreement.

4. TERMINATION OF THE MASTER SUBSCRIPTION AGREEMENT

4.1 Termination Upon Breach of this Addendum. Any other provision of the Master Subscription Agreement notwithstanding, either party (the "Non-Breaching Party") may terminate the Master Subscription Agreement upon 30 days advance written notice to the other party (the "Breaching Party") in the event that the Breaching Party breaches this Addendum in any material respect and such breach is not cured to the reasonable satisfaction of the Non-Breaching Party within such 30-day period.

4.2 Destruction of PHI upon Termination. Upon expiration or earlier termination of the Master Subscription Agreement, Company shall destroy all PHI received from Covered Entity or created or received by Company on behalf of Covered Entity and which Company still maintains in any form. Notwithstanding the foregoing, to the extent that Company reasonably determines that it is not feasible to destroy such PHI, the terms and provisions of this Addendum shall survive termination of the Master Subscription Agreement and such PHI shall be used or disclosed solely for such purpose or purposes which prevented the destruction of such PHI.

5. LIABILITY

Each party's and all of its affiliates' liability, taken together in the aggregate, arising out of or related to this Addendum, and all Addendums between authorized affiliates and OutSystems, whether in contract, tort or under any other theory of liability, is subject to the 'Limitation of Liability' section of the Master Subscription Agreement, and any reference in such section to the liability of a party means the aggregate liability of that party and all of its affiliates under the Master Subscription Agreement and all Addendums togethe