Nesso Business Associate Agreement

This Business Associate Agreement ("Agreement" or "BAA") is entered into by and between you ("Covered Entity" or "Customer") and Nesso Labs, Inc. ("Business Associate," "Nesso," "we," or "us"). By creating an account or using our services, you agree to the terms of this Agreement.

This Agreement is effective as of the date you first accept our Terms of Service or otherwise begin using our services (the "Effective Date"). You represent that you are lawfully able to enter into contracts, and if you are entering into this Agreement for an entity, such as the practice you work for, you represent that you have legal authority to bind that entity.

This Agreement, together with the Service Agreement as amended by this Agreement, (a) is intended by the parties as a final, complete and exclusive expression of the terms of their agreement; and (b) supersedes all prior agreements and understandings (whether oral or written) between the parties with respect to the subject matter hereof.

WHEREAS, Nesso Labs, Inc. ("Nesso") may have access to Protected Health Information ("PHI") in performing its services for Customer, and both Parties desire to comply with the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), and the regulations promulgated thereunder (collectively, "HIPAA").

NOW, THEREFORE, the parties agree as follows:

1. Definitions

The following terms used in this Agreement shall have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

"Business Associate" shall generally have the same meaning as the term "business associate" at 45 CFR 160.103, and in reference to the party to this Agreement, shall mean Nesso Labs, Inc.

"Covered Entity" shall generally have the same meaning as the term "covered entity" at 45 CFR 160.103, and in reference to the party to this Agreement, shall mean Customer.

"HIPAA Rules" shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.

"Service Agreement" means the Terms of Service or other agreement governing Customer's use of Nesso's services.

2. Obligations of Nesso (Business Associate)

Nesso agrees to:

1. Not use or disclose PHI other than as permitted or required by this Agreement or as required by law.
   ‍
2. Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this Agreement.
   ‍
3. Report to Customer any use or disclosure of PHI not provided for by this Agreement of which Nesso becomes aware, including Breaches of Unsecured Protected Health Information as required at 45 CFR 164.410, and any Security Incident of which Nesso becomes aware.
   ‍
4. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Nesso agree to the same restrictions, conditions, and requirements that apply to Nesso with respect to such information.
   ‍
5. Make available PHI in a Designated Record Set to Customer as necessary to satisfy Customer's obligations under 45 CFR 164.524.
   ‍
6. Make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by Customer pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Customer's obligations under 45 CFR 164.526.
   ‍
7. Maintain and make available the information required to provide an accounting of disclosures to Customer as necessary to satisfy Customer's obligations under 45 CFR 164.528.
   ‍
8. To the extent Nesso is to carry out one or more of Customer's obligation(s) under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to Customer in the performance of such obligation(s).
   ‍
9. Make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

3. Permitted Uses and Disclosures by Nesso

1. Nesso may only use or disclose PHI as necessary to perform the services set forth in the Service Agreement.
   ‍
2. Nesso may use or disclose PHI as required by law.
   ‍
3. Nesso agrees to make uses and disclosures and requests for PHI consistent with Customer's minimum necessary policies and procedures.
   ‍
4. Nesso may not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Customer, except for the specific uses and disclosures set forth in this Section.
   ‍
5. Nesso may use PHI for its proper management and administration or to carry out its legal responsibilities.
   ‍
6. Nesso may disclose PHI for its proper management and administration or to carry out its legal responsibilities, provided the disclosures are Required By Law, or Nesso obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as Required By Law or for the purposes for which it was disclosed to the person, and the person notifies Nesso of any instances of which it is aware in which the confidentiality of the information has been breached.
   ‍
7. Nesso may provide Data Aggregation services relating to Customer's health care operations.
   ‍
8. Nesso may use de-identified information (de-identified in accordance with 45 CFR §164.514(a)-(c)) in aggregate form to improve its services, conduct research, or develop new features.
   ‍
9. Nesso will not receive direct or indirect remuneration in exchange for PHI.

4. Provisions for Covered Entity to Inform Business Associate of Privacy Practices and Restrictions

Customer agrees to:

1. Notify Nesso of any limitation(s) in the Notice of Privacy Practices of Customer under 45 CFR 164.520, to the extent that such limitation may affect Nesso's use or disclosure of PHI.
   ‍
2. Notify Nesso of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes may affect Nesso's use or disclosure of PHI.
   ‍
3. Notify Nesso of any restriction on the use or disclosure of PHI that Customer has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect Nesso's use or disclosure of PHI.
   ‍
4. Not request that Nesso use or disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Customer.

5. Term and Termination

(a) Term. This Agreement shall be effective as of the Effective Date and shall remain in effect until the termination of the Service Agreement or until all PHI is returned or destroyed, whichever is later.

(b) Termination for Cause. Customer may terminate this Agreement if Nesso materially breaches this Agreement and fails to cure such breach within thirty (30) days of receiving written notice from Customer.

(c) Obligations Upon Termination. Upon termination of this Agreement for any reason, Nesso shall, at Customer's election, return or destroy all PHI received from Customer, or created or received by Nesso on behalf of Customer. This provision shall apply to PHI that is in the possession of subcontractors of Nesso.

If return or destruction is not feasible, Nesso shall provide to Customer notification of the conditions that make return or destruction infeasible. Until the PHI is deleted, Nesso shall continue to ensure compliance with this Agreement and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible.

(d) Survival. The obligations of Nesso under this Section shall survive the termination of this Agreement.

6. Amendment

The parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with the requirements of the HIPAA Rules and any other applicable law.

7. Limitation of Liability

Nesso's liability to Customer under or in connection with this BAA (including, without limitation, for any breach of this BAA or of HIPAA) shall be subject to the limitations of liability set out in the Service Agreement.

8. Miscellaneous

(a) Regulatory References. A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended.

(b) Interpretation. Any ambiguity in this Agreement shall be interpreted to permit compliance with the HIPAA Rules.

Contact Information

If you have any questions about this Business Associate Agreement, please contact us at:

Nesso Labs, Inc.
Email: hello@nessoapp.com