Business Associate Agreement

This Business Associate Agreement (the "Agreement") is between the practice that accepts it (the "Practice"), which is a covered entity under the Health Insurance Portability and Accountability Act of 1996 and its regulations ("HIPAA"), and myDxHub, LLC ("myDxHub"), which acts as the Practice's business associate when it handles protected health information on the Practice's behalf.

myDxHub is a healthcare technology company. It is not a laboratory and not a medical or dental practice. The Practice orders tests, independent laboratories perform them, and the Practice's providers review them. myDxHub receives the results and carries them into a record the patient controls, and provides the Practice with the tools to order, receive, review and export (together, the "Services").

Capitalized terms not defined here have the meanings given in HIPAA, including "Protected Health Information" or "PHI", "Breach", "Security Incident", "Subcontractor", "Unsecured PHI" and "Secretary".

myDxHub may use and disclose PHI only as this Agreement permits or requires, or as required by law. Specifically, myDxHub may use and disclose PHI to provide the Services to the Practice: to receive results from laboratories the Practice has directed to it, to store them, to display them to the Practice and to the patient, to generate reports the Practice requests, to send the notices the Services send, and to make records available for export.

myDxHub may use PHI for its own proper management and administration and to carry out its legal responsibilities, and may disclose PHI for those purposes only where the disclosure is required by law or where myDxHub obtains reasonable written assurances from the recipient that the PHI will be held confidentially and used or further disclosed only as required by law or for the purpose for which it was disclosed, and that the recipient will notify myDxHub of any instance of which it is aware in which the confidentiality of the PHI has been breached.

myDxHub will not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by the Practice, except for the specific uses and disclosures set out in the paragraph above. myDxHub will request, use and disclose only the minimum PHI necessary to accomplish the intended purpose.

myDxHub will not sell PHI, will not use PHI for marketing, and will not use or disclose PHI for its own commercial purposes beyond providing the Services.

The Services are built so that each patient controls who may open their record. A provider at the Practice can open a patient's clinical records only while the patient allows it, and the patient may end that access at any time. This is a feature of the Services that the Practice accepts; it is not a use or disclosure by myDxHub, and it does not relieve the Practice of any of its own obligations to maintain its records.

When a patient ends a provider's access, records the provider already opened remain available to that provider for 30 days, the same way a printed copy would, and every such opening is recorded in the patient's access history. The Practice is expected to keep its own copy of the records it created by exporting them from the Services within that window.

myDxHub will use appropriate administrative, physical and technical safeguards, and will comply with Subpart C of 45 CFR Part 164 (the Security Rule) with respect to electronic PHI, to prevent use or disclosure of PHI other than as this Agreement provides.

Without limiting the sentence above, myDxHub encrypts PHI in transit and at rest, limits access to PHI by role and by the patient's own consent settings enforced in the database, records every opening of a patient's clinical record in an access history the patient can read, archives that history to write-once storage, and designates a Security Official and a Privacy Official responsible for these safeguards.

myDxHub will report to the Practice any use or disclosure of PHI not permitted by this Agreement, any Security Incident of which it becomes aware, and any Breach of Unsecured PHI, without unreasonable delay and in no case later than ten (10) business days after discovery. [ATTORNEY: confirm the ten-day period, or set another.]

A report of a Breach will include, to the extent known at the time and supplemented as information becomes available: the identity of each individual whose Unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used or disclosed; a description of what happened, including the date of the Breach and the date of its discovery; the types of PHI involved; the steps individuals should take to protect themselves; what myDxHub is doing to investigate, mitigate and prevent recurrence; and a contact for further information. myDxHub will cooperate with the Practice in the Practice's own notifications.

The parties acknowledge that attempted but unsuccessful Security Incidents occur continuously against any system connected to the internet, such as scans, pings and failed sign-in attempts that do not result in unauthorized access to or use of PHI. This paragraph is notice of those, and myDxHub will provide aggregate information about them on the Practice's reasonable request rather than reporting each one.

myDxHub will mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure of PHI by myDxHub in violation of this Agreement.

myDxHub will ensure that any Subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions, conditions and requirements that apply to myDxHub under this Agreement, in accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2).

myDxHub's Subcontractors with respect to PHI are its cloud infrastructure provider, with which it has an executed business associate addendum, and the company that maintains the software of the Services on its behalf. A current list is available to the Practice on request.

Access (45 CFR 164.524). The Services give each patient direct access to their own records and a complete export of them, at any time, without a request. Where the Practice receives a request for access to PHI that myDxHub holds and that the patient cannot reach directly, myDxHub will make the PHI available to the Practice within ten (10) business days so the Practice can meet its obligation.

Amendment (45 CFR 164.526). The Services let a patient file a request for correction in their own words, and record the Practice's decision and its reason alongside the request. myDxHub does not change clinical values on its own; where a correction requires a change to a record the Practice created, myDxHub will make the amendment the Practice directs within ten (10) business days of the direction, and will forward to the Practice any correction request it receives that the Practice has not yet seen.

Accounting of disclosures (45 CFR 164.528). myDxHub records every opening of a patient's clinical records, keeps that history for six (6) years, and will provide the Practice, within ten (10) business days of a request, the information the Practice needs to respond to a patient's request for an accounting.

Where myDxHub carries out one or more of the Practice's obligations under Subpart E of 45 CFR Part 164, it will comply with the requirements of Subpart E that apply to the Practice in the performance of that obligation.

myDxHub will make its internal practices, books and records relating to the use and disclosure of PHI received from, or created or received by myDxHub on behalf of, the Practice available to the Secretary of the U.S. Department of Health and Human Services for the purpose of determining the Practice's and myDxHub's compliance with HIPAA.

This Agreement takes effect when the Practice accepts it and continues for as long as the Practice uses the Services, unless terminated earlier under this section.

Either party may terminate this Agreement if the other party has materially breached it and has not cured the breach within thirty (30) days of written notice, or immediately if cure is not possible. Termination of this Agreement ends the Practice's use of the Services.

On termination, the records the Practice created remain available to the Practice for thirty (30) days for return by export from the Services. After that period myDxHub removes the Practice's account, its users, and the copies of records its providers retained. Records that patients hold in their own accounts are the patients' to keep or delete; myDxHub continues to protect them under the safeguards in this Agreement for as long as it holds them, and will not use or disclose them for any purpose other than those permitted here. [ATTORNEY: this reflects the patient-ownership model of the Services and departs from the usual "return or destroy all PHI" clause; please confirm the approach or redraft.]

Where return or destruction of PHI is infeasible, myDxHub will extend the protections of this Agreement to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as it maintains the PHI.

Sections 4, 5, 7, 8 and 9 survive termination.

A reference to a section of HIPAA means that section as in effect or as amended. The parties will amend this Agreement as necessary to comply with changes in HIPAA, and any ambiguity will be resolved to permit compliance with HIPAA.

Nothing in this Agreement creates rights in any third party. myDxHub is not the agent of the Practice, and nothing here creates an agency relationship.

This Agreement is accepted electronically by a person who represents that they are authorized to bind the Practice. myDxHub keeps a record of each acceptance: the version accepted, the date and time, and the name, email address and role of the person who accepted it. That record is available to the Practice in its settings.

This Agreement is the complete business associate agreement between the parties for the Services and prevails over any conflicting term of myDxHub's Terms of Service with respect to PHI.