Business Associate Agreement

WHEREAS, Business Associate provides care coordination, behavioral health routing, and clinical assessment services to Covered Entity through the Atlas HLTH platform; and

WHEREAS, in connection with providing such services, Business Associate may create, receive, maintain, or transmit Protected Health Information ("PHI") on behalf of Covered Entity; and

WHEREAS, the parties desire to enter into this Business Associate Agreement ("Agreement") to comply with the requirements of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and their implementing regulations (collectively, "HIPAA Rules");

NOW, THEREFORE, in consideration of the mutual promises and covenants contained herein, the parties agree as follows:

1.1 "Business Associate" shall have the meaning given to such term under 45 CFR § 160.103.

1.2 "Covered Entity" shall have the meaning given to such term under 45 CFR § 160.103.

1.3 "Protected Health Information" or "PHI" shall have the meaning given to such term under 45 CFR § 160.103, limited to the information created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity.

1.4 "Security Incident" shall have the meaning given to such term under 45 CFR § 164.304.

1.5 "Breach" shall have the meaning given to such term under 45 CFR § 164.402.

2.1 Use and Disclosure. Business Associate shall not use or disclose PHI other than as permitted or required by this Agreement or as required by law. Business Associate may use or disclose PHI: (a) for the proper management and administration of Business Associate; (b) to carry out the legal responsibilities of Business Associate; or (c) as required by law.

2.2 Safeguards. Business Associate shall use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this Agreement.

2.3 Reporting. Business Associate shall report to Covered Entity: (a) any use or disclosure of PHI not provided for by this Agreement of which it becomes aware; (b) any Security Incident of which it becomes aware; and (c) any Breach of Unsecured PHI as required at 45 CFR § 164.410, without unreasonable delay and in no case later than 60 days after discovery.

2.4 Subcontractors. Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate under this Agreement.

2.5 Access. To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate shall make PHI available to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 CFR § 164.524.

2.6 Amendment. To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate shall make PHI available for amendment and incorporate any amendments to PHI as directed by Covered Entity pursuant to 45 CFR § 164.526.

2.7 Accounting of Disclosures. Business Associate shall maintain and make available the information required to provide an accounting of disclosures to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 CFR § 164.528.

2.8 Government Access. Business Associate shall make its internal practices, books, and records available to the Secretary of the Department of Health and Human Services for purposes of determining compliance with the HIPAA Rules.

2.9 Minimum Necessary. Business Associate shall use, disclose, and request only the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure, or request.

3.1 Services. Business Associate may use and disclose PHI as necessary to perform the services described in the applicable service agreement between the parties, including: care coordination, behavioral health routing, clinical triage and assessment, referral management, provider matching, and related care coordination activities.

3.2 Operations. Business Associate may use PHI for the proper management and administration of Business Associate and to carry out its legal responsibilities.

3.3 De-identified Data. Business Associate may de-identify PHI in accordance with 45 CFR § 164.514(b) and use such de-identified data for product improvement, research, and analytics purposes.

4.1 Permissions. Covered Entity shall notify Business Associate of any limitation in its Notice of Privacy Practices that would affect Business Associate's use or disclosure of PHI.

4.2 Restrictions. Covered Entity shall notify Business Associate of any changes in, or revocation of, permission by an individual to use or disclose PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI.

4.3 Lawful Requests. Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Covered Entity.

5.1 Term. This Agreement shall be effective as of the date first written above and shall terminate upon the termination or expiration of the service agreement between the parties, unless earlier terminated as provided herein.

5.2 Termination for Cause. Either party may terminate this Agreement immediately upon written notice if the other party has materially breached any provision of this Agreement and has not cured such breach within 30 days after written notice.

5.3 Effect of Termination. Upon termination, Business Associate shall return or destroy all PHI received from, or created or received by Business Associate on behalf of, Covered Entity. If return or destruction is not feasible, Business Associate shall extend the protections of this Agreement to such PHI and limit further uses and disclosures to those purposes that make the return or destruction of the PHI infeasible.

6.1 Amendment. The parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with the requirements of HIPAA Rules.

6.2 Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits Covered Entity to comply with the HIPAA Rules.

6.3 Survival. The obligations of Business Associate under Section 5.3 shall survive the termination of this Agreement.

6.4 Entire Agreement. This Agreement constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior agreements, understandings, negotiations, and discussions, whether oral or written.