Business Associate Agreement

This Business Associate Agreement (the “Agreement”) is entered into on the Effective Date, between Navina Inc. (“Business Associate” or “Navina”) and Customer named under an applicable Order Form, called the “Covered Entity” (each a “Party” and collectively the “Parties”).

The Parties have agreed that Business Associate provides certain services (the “Services”), as described under the Underlying Agreement signed by the Parties, for or on behalf of the Covered Entity and that provision of the Services may involve the creation, receipt, maintenance or transmission of PHI (as defined below). The purpose of this Agreement is to set forth the obligations of the Parties with respect to such PHI in accordance with applicable federal law.

WHEREAS, Covered Entity wishes to allow the Business Associate to have access to Protected Health Information (“PHI”) and including Electronic Protected Health Information (“EPHI”), as those terms are defined in Section 1.1 below, referred to hereafter as PHI that is either provided to the Business Associate by Covered Entity, or received, viewed, maintained, transmitted or created by the Business Associate on behalf of Covered Entity in the course of performing the Services to, for, or on behalf of Covered Entity pursuant to the Underlying Agreement; and

WHEREAS, the Business Associate requires access to such PHI in order to effectively perform such Services; and

WHEREAS, Covered Entity and Business Associate are subject to the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and as may be further modified or superseded from time to time, (collectively “HIPAA”), and among other obligations under HIPAA are required to enter into agreements with respect to the use and disclosure and safeguarding of PHI; and

WHEREAS, the Parties desire to enter into this Agreement in order to set forth the terms and conditions pursuant to which PHI will be handled by the Business Associate and certain third parties, as applicable, during the duration of this Agreement and upon its termination, cancellation, expiration or other conclusion.

NOW, THEREFORE, in consideration of the mutual promises and covenants set forth herein, and for good and valuable consideration receipt of which is hereby acknowledged, the Parties hereby agree as follows:

1. Definitions
   
   1. Catch-all definition. The following terms used in this Agreement shall have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Electronic Protected Health Information, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.
   2. “Business Associate” shall generally have the same meaning as the term “business associate” at 45 CFR 160.103, and in reference to the Party to this Agreement, shall mean the Business Associate as defined above in this Agreement.
   3. “Covered Entity” shall generally have the same meaning as the term “covered entity” at 45 CFR 160.103, and in reference to the Party to this agreement, shall mean the Covered Entity as defined above in this Agreement.
   4. “Underlying Agreement” means, collectively, the Navina Master SaaS Agreement entered between Business Associate and Covered Entity, the Order Form(s) executed thereunder, and the Navina Products and Services Schedule.
   5. “HIPAA Rules” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.
   6. “CFR” shall mean the Code of Federal Regulations.
2. Obligations and Activities of Business Associate. Business Associate agrees to:
   
   1. Not use or disclose PHI other than as permitted or required by the Underlying Agreement, this Agreement or as Required by Law;
   2. Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to EPHI, to prevent use or disclosure of PHI other than as provided for by the Agreement;
   3. Report to Covered Entity any use or disclosure of PHI not provided for by the Agreement of which it becomes aware, including Breaches of Unsecured PHI as required at 45 CFR 164.410, and any Security Incident of which it becomes aware. Notwithstanding the foregoing, Covered Entity acknowledges that Business Associate routinely experiences unsuccessful Security Incidents that do not result in unauthorized access to, or use or disclosure of, PHI, such as pings, port scans, phishing attempts and other unsuccessful Security Incidents. Business Associate hereby notifies Covered Entity of such unsuccessful Security Incidents, and the Parties acknowledge and agree that no further notice shall be required of such unsuccessful Security Incidents so long as such incidents do not result in unauthorized access to, or use or disclosure of, PHI or control of PHI or Business Associate’s systems;
   4. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, require that any Subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree in writing to restrictions and conditions on the use and/or disclosure of PHI that are no less restrictive than those that apply to Business Associate with respect to such information;
   5. Make available PHI in a Designated Record Set to the Covered Entity to meet Covered Entity’s obligations under 45 CFR 164.524;
   6. Make any amendment(s) to PHI in a Designated Record Set as agreed to by the Covered Entity pursuant to 45 CFR 164.526, provided that Covered Entity informs Business Associate of such amendment(s) in accordance with the provisions set forth in 45 CFR 164.526;
   7. Maintain and make available the information required to provide an accounting of disclosures to the Covered Entity as necessary to meet Covered Entity’s obligations under 45 CFR 164.528;
   8. To the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such obligation(s); and
   9. Make its internal practices, books, and records available to the Secretary for purposes of determining Covered Entity’s compliance with the HIPAA Rules.
3. Other Permitted Uses and Disclosures by Business Associate.
   
   1. Business Associate may use or disclose PHI as necessary to perform the Services to Covered Entity set forth in this Agreement and the Underlying Agreement.
   2. Business Associate may use or disclose PHI as Required by Law.
   3. Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate, provided that any such disclosures are Required by Law or any third party to which Business Associate discloses PHI for those purposes provides assurances that: (i) the information will be held confidentially and used or further disclosed only as Required by Law or for the purposes for which it was disclosed to the third party; and (ii) the third party will notify Business Associate of any instances of which it becomes aware in which the confidentiality of the information has been breached.
   4. Business Associate may provide Data Aggregation services relating to the Health Care Operations of the Covered Entity.
   5. Notwithstanding the provisions of this Agreement, Business Associate may de-identify the PHI in accordance with 45 CFR § 164.514 and use and disclose such de-identified information.
4. Privacy Practices and Restrictions
   
   1. Covered Entity shall notify Business Associate of any limitation(s) in the Notice of Privacy Practices of Covered Entity under 45 CFR 164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI.
   2. Covered Entity shall provide all notices and obtain all required consents from an Individual to allow Business Associate to use and disclose the PHI as set forth in this Agreement and the Underlying Agreement.
   3. Covered Entity shall notify Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes may affect Business Associate’s use or disclosure of PHI.
   4. Covered Entity shall notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI.
5. Term and Termination
   
   1. Term. The term of this Agreement shall be effective as of the Effective Date, and shall continue in effect until the earliest of: (1) the Agreement is terminated by Covered Entity as provided in Section 5.2; or (2) the Underlying Agreement is completed, concluded or otherwise terminated, in which case this Agreement will terminate automatically and without the need for any further action or notice on the part of either Covered Entity or Business Associate, and such automatic termination shall occur simultaneously with the conclusion, completion or termination of the arrangement for Services as defined in the Underlying Agreement, whichever of the above options is sooner.
   2. Termination for Cause. Business Associate authorizes termination of this Agreement by Covered Entity, if Covered Entity determines Business Associate has violated a material term of the Agreement, and Business Associate has not cured the breach or ended the violation after thirty (30) days following notice to Business Associate.
   3. Obligations of Business Associate upon Termination. Upon termination of this Agreement for any reason, Business Associate shall destroy all PHI received from Covered Entity, or created, maintained, or received by Business Associate on behalf of Covered Entity, that the Business Associate still maintains in any form and retain no copies, if it is feasible to do so. If return or destruction of the PHI is not feasible, Business Associate shall extend the protections contained in this Agreement to Business Associate’s use and/or disclosure of any PHI retained after the termination or expiration of this Agreement, and limit any further uses and/or disclosures solely to the purposes that make return or destruction of the PHI infeasible.
6. Miscellaneous.
   
   1. Regulatory References. A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended.
   2. Amendment. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with the requirements of the HIPAA Rules and any other applicable law. To the extent of any amendment to final regulations promulgated by the U.S. Department of Health and Human Services with respect to HIPAA, the Parties shall negotiate in good faith to amend this Agreement to the extent such changes are directly applicable to the Services provided by Business Associate on behalf of Covered Entity in order for the Parties to remain in compliance with all applicable regulations.
   3. Interpretation. Any ambiguity in this Agreement shall be interpreted to permit compliance with the HIPAA Rules.
   4. Notices. All notices under this Agreement shall be in writing. Notices to Business Associate shall be sent to the address set forth in the applicable Order Form, with a copy to legal@navina.ai. Notices to Covered Entity shall be sent to the address set forth in the applicable Order Form. Notices shall be effective: (i) upon personal delivery; (ii) one (1) business day after deposit with a nationally recognized overnight courier; or (iii) upon sending by email to an email address provided by the receiving Party, provided no delivery failure notification is received by the sender within 24 hours of transmission.
   5. Conflicts. The terms and conditions of this Agreement will supersede and control any conflicting term or condition of the Underlying Agreement (including the Order Form and the Products and Services Schedule) that addresses privacy and confidentiality of confidential medical information, including Protected Health Information. All non-conflicting terms and conditions of the Underlying Agreement remain in full force and effect.
   6. Survival of Certain Terms. In the event that this Agreement ends or is terminated pursuant to Section 5 and Business Associate concludes in accordance with Section 5.3 that the destruction of PHI is not feasible, those terms of this Agreement that are required to continue its protections of PHI shall survive termination for as long as the Business Associate retains PHI.
   7. No Third Party Beneficiaries. Nothing contained herein, whether express or implied, is intended to confer, nor shall anything herein confer, upon any person other than the Parties and their respective successors or assigns of the Parties, any rights, remedies, obligations, or liabilities whatsoever.
   8. Disputes. If any controversy, dispute or claim arises between the Parties with respect to this Agreement, the Parties shall make good faith efforts to resolve such matters informally.
   9. Governing Law. This Agreement shall be governed by and construed in accordance with the substantive laws of the state of New York without regard to conflicts of law principles.
   10. Counterparts. This Agreement may be executed in counterparts, each of which shall be deemed to be an original, with all of such counterparts together shall constitute one and the same contract.
   11. Severability. The provisions of this Agreement shall be deemed severable and if any portion shall be held invalid, illegal or unenforceable for any reason, the remainder of this Agreement shall be effective and binding upon the Parties.

‍