This Business Associate Agreement (“BAA”) and the terms and conditions contained herein apply to CUSTOMER’s use of those services specified within an Order Form entered into by and between Inovalon Provider, Inc. (“INOVALON”) and CUSTOMER, as expressly incorporated into and made a part of the Order Form by reference therein. By way of execution of the Order Form, both INOVALON and CUSTOMER have agreed to be bound by this BAA, which shall be effective as of the date of CUSTOMER’s signature on the Order Form (“Effective Date”). Each may be referred to herein individually as a “Party” or collectively as the “Parties.”

CUSTOMER is either a Covered Entity or a Business Associate providing services to Covered Entities (“Clients”); and

INOVALON provides services to CUSTOMER pursuant to one or more underlying agreements by and between INOVALON and CUSTOMER (“Order Form(s)”), pursuant to which INOVALON may create, receive, maintain, or transmit Protected Health Information (“PHI”) of CUSTOMER or Clients in order to enable INOVALON to perform one or more services for CUSTOMER related to the Treatment, Payment or Health Care Operations of a Covered Entity; and

In providing services to CUSTOMER, INOVALON is either CUSTOMER’s Business Associate, to the extent CUSTOMER is a Covered Entity, or CUSTOMER’s Subcontractor, to the extent CUSTOMER is a Business Associate of their Clients; and

The Parties desire to comply with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the Final Rule for Standards for Privacy of Individually Identifiable Health Information adopted by the United States Department of Health and Human Services and codified at 45 C.F.R. Part 160 and Part 164, Subparts A, C (“Security Rule”), and E (“Privacy Rule”) as well as Subtitle D of the Health Information Technology for Economic and Clinical Health Act (“HITECH”).

The Parties to this BAA hereby agree as follows:

1. Definitions and Scope.  Capitalized terms within this BAA shall have the same meaning as those terms are defined at 45 C.F.R. §§ 160.103, 164.103, 164.304, 164.402 and 164.501. This BAA applies to uses and disclosures of all PHI that INOVALON creates for or on behalf of, or receives from or on behalf of, CUSTOMER.

2. Obligations of INOVALON.

2.1.	INOVALON agrees to use appropriate safeguards in compliance with 45 C.F.R. § 164, Subpart C, in the same manner that those requirements apply to CUSTOMER, to prevent use or disclosure of the PHI other than as provided for in this BAA. INOVALON agrees to implement Administrative Safeguards, Physical Safeguards and Technical Safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of PHI.
2.2.	INOVALON agrees to mitigate, to the extent practicable, any harmful effect that is known to INOVALON of a use or disclosure of PHI by INOVALON in violation of 45 C.F.R. § 164, Subpart E or the requirements of this BAA.
2.3.	INOVALON agrees to report to CUSTOMER any use or disclosure of PHI not provided for by this BAA of which it becomes aware, including, following the discovery of a Breach of unsecured PHI or a successful Security Incident, notifying CUSTOMER of such fact in accordance with 45 C.F.R. § 164.410. Such notification shall contain the information as required by 45 C.F.R. § 164.410(c)(1)-(2). CUSTOMER acknowledges and agrees that this section constitutes notice by INOVALON to CUSTOMER of the potential occurrence and/or ongoing existence of attempted but Unsuccessful Security Incidents (as defined below) for which no additional notice to CUSTOMER shall be required. “Unsuccessful Security Incidents” shall mean and include, but not be limited to, pings and other broadcast attacks on INOVALON’s firewall, port scans, unsuccessful log-on attempts, denials of service, and any combination of the above, so long as no such incident results in unauthorized access, use or disclosure of PHI.
2.4.	INOVALON agrees to ensure that any Subcontractors to whom it provides PHI received from, or created or received by INOVALON on behalf of CUSTOMER agrees to the same restrictions and conditions that apply through this BAA to INOVALON with respect to such information by way of a contractual agreement that complies with 45 C.F.R. §§ 164.314(a), 504(e)(1)(i) and this BAA.
2.5.	INOVALON agrees to provide to CUSTOMER or an Individual access to PHI in a Designated Record Set at the request of CUSTOMER or an Individual and in the time and manner designated by CUSTOMER or such Individual, in order to meet the requirements under 45 C.F.R. § 164.524. INOVALON must provide CUSTOMER or the Individual with the information requested in the form and format requested by CUSTOMER or the Individual if it is readily producible in such form and format; or, if not, in a readable hard copy or electronic form and format as agreed to by INOVALON and CUSTOMER or the Individual.
2.6.	INOVALON agrees to make any amendment(s) to PHI in a Designated Record Set that CUSTOMER directs or agrees to pursuant to 45 C.F.R. §164.526 at the request of CUSTOMER and in the time and manner designated by CUSTOMER. If INOVALON receives a request for amendment to PHI directly from CUSTOMER’s Client or an Individual, as applicable, INOVALON shall promptly notify CUSTOMER upon receipt of such request.
2.7.	INOVALON agrees to make its internal practices, books, and records relating to the use and disclosure of PHI received from or created or received by INOVALON on behalf of CUSTOMER available to the Secretary for the purposes of the Secretary determining CUSTOMER’s or a Covered Entity’s compliance with the Privacy Rule and Security Rule.
2.8.	INOVALON agrees to document disclosures of PHI and information related to such disclosures as would be required for CUSTOMER (and/or its Clients) to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. §164.528. INOVALON agrees to provide to CUSTOMER information collected in accordance with this BAA, to permit CUSTOMER to respond to a request by a Client or an Individual for an accounting of disclosures for PHI in accordance with 45 C.F.R. §164.528.
2.9.	INOVALON agrees that it will not receive remuneration for certain communications that fall within the exceptions to the definition of Marketing under 45 C.F.R. §164.501 unless a valid authorization, in compliance with 45 C.F.R. § 164.508(b), is obtained from the Individual who is the subject of such communication.
2.10.	If applicable, INOVALON agrees that it will not use or disclose genetic information for underwriting purposes, as that term is defined in 45 C.F.R. § 164.502(a)(5)(i).

3. Permitted Uses and Disclosures.

3.1.	Except as otherwise limited in this BAA, INOVALON may use or disclose PHI only as permitted or required by this BAA or as Required by Law.
3.2.	INOVALON may use or disclose PHI to perform the services under the Order Form(s), to the extent that such use or disclosure would not violate the requirements of 45 C.F.R. Part 164, Subpart E, if such use or disclosure was done by a Covered Entity.
3.3.	INOVALON may use or disclose PHI for Treatment, Payment, or Health Care Operations of a Covered Entity or for any other permissible use pursuant to HIPAA.
3.4.	INOVALON may use PHI for the proper management and administration or to carry out the legal responsibilities of INOVALON.
3.5.	INOVALON may disclose PHI for the proper management and administration of INOVALON, provided that disclosures are Required by Law, or INOVALON obtains reasonable assurances from the person to whom the information is to be disclosed that it will remain confidential and used or further disclosed only as Required by Law or for the purpose for which it was disclosed to the person, and that the person will notify INOVALON of any instances of which the person is aware in which the confidentiality of the information has been breached.
3.6.	INOVALON may use PHI to provide Data Aggregation services, including services to Covered Entities as permitted by 45 C.F.R. §164.504 (e)(2)(i)(B).
3.7.	INOVALON may use or disclose PHI pursuant to a valid authorization that complies with 45 C.F.R. § 164.508.
3.8.	So as to enable the capabilities of the platform and services of INOVALON, INOVALON may de-identify PHI so long as such de-identification conforms to the methods as stated in 45 C.F.R. § 164.514(b). PHI that has been appropriately de-identified is not considered PHI for the purposes of HIPAA and this BAA.
3.9.	INOVALON may use PHI to report a good faith belief that a Covered Entity has engaged in conduct that is unlawful or otherwise violates professional or clinical standards, or that the care, services, or conditions provided by the Covered Entity potentially endangers one or more patients, workers, or the public so long as such disclosure is in adherence with 45 C.F.R. §164.502(j).

4. Obligations of Customer.

4.1.	CUSTOMER shall notify INOVALON of any limitation(s) in its own or a Client’s notice of privacy practices for PHI in accordance with 45 C.F.R. § 164.520, to the extent that such limitation may affect INOVALON’s use or disclosure of PHI.
4.2.	CUSTOMER shall notify INOVALON of any changes in, or revocation of, permission by an Individual to use or disclose PHI of which the CUSTOMER is aware, to the extent that such changes may affect INOVALON’s use or disclosure of PHI.
4.3.	CUSTOMER shall notify INOVALON of any restriction to the use or disclosure of PHI that was agreed to in accordance with 45 C.F.R. §164.522 of which the CUSTOMER is aware, to the extent that such restriction may affect INOVALON’s use or disclosure of PHI.
4.4.	To the extent that the service(s) provided by INOVALON pursuant to an Order Form allow for CUSTOMER to submit eligibility transactions to CMS’ HIPAA Eligibility Transaction System (“HETS”), CUSTOMER shall ensure and warrants to INOVALON that CUSTOMER’s use of HETS shall at all times be in accordance with the in effect HETS Rules of Behavior, as published and publicly made available by CMS and as may be updated by CMS from time to time.

5. Term and Termination.

5.1.	The term of this BAA shall begin as of the Effective Date and shall terminate: (i) upon expiration or termination of all Order Forms; (ii) in accordance with paragraph 5.2. of this Section 5; or (iii) when all of the PHI provided by CUSTOMER to INOVALON, or created or received by INOVALON on behalf of CUSTOMER, is destroyed, or, if it is infeasible to destroy such PHI, protections are extended to such information in accordance with the termination provisions of this Section 5, whichever occurs first.
5.2.	Upon CUSTOMER’s knowledge of a material breach of this BAA by INOVALON, CUSTOMER shall either: (i) Provide notification to and an opportunity for INOVALON to cure the material breach, not to be less than thirty (30) days from INOVALON’s receipt of such notice, and may terminate this BAA and, to the extent an Order Form relies on this BAA and the ability to utilize PHI pursuant to its terms and conditions, terminate such related Order Form should INOVALON not cure such material breach to CUSTOMER’s reasonable expectation; or (ii) in the event such material breach is reasonably determined by CUSTOMER to be incurable, immediately terminate this BAA and, to the extent an Order Form relies on this BAA and the ability to utilize PHI pursuant to its terms and conditions, terminate such related Order Form.
5.3.	Except as provided in paragraph 5.4. of this Section 5, upon any termination or expiration of this BAA, INOVALON will maintain PHI received from CUSTOMER, or created or received by INOVALON on behalf of CUSTOMER, for a maximum period of twelve (12) months in order for CUSTOMER to resubmit transactions as necessary. Thereafter, CUSTOMER’s PHI will be destroyed, and INOVALON shall retain no copies of the PHI.
5.4.	Notwithstanding paragraph 5.3 of this Section 5, in the event INOVALON determines that destroying the PHI is infeasible, INOVALON shall extend the protections of this BAA to such PHI and limit further uses and disclosures of such PHI to those purposes that make the destruction infeasible for so long as INOVALON maintains such PHI. INOVALON will ensure that its Subcontractors adhere to these same provisions.

6. Miscellaneous.

6.1.	A reference in this BAA to a section of HIPAA, including specifically the Privacy Rule or Security Rule, means the section as then in effect or as amended.
6.2.	The Parties agree to take such action to amend this BAA from time to time as is necessary for both CUSTOMER and INOVALON to comply with the requirements of HIPAA, the Privacy Rules, Security Rules, and HITECH.
6.3.	Nothing express or implied in this BAA is intended to confer, nor shall anything herein confer upon any person other than CUSTOMER, INOVALON and their respective successors and assigns, any rights, remedies, obligations or liabilities whatsoever.
6.4.	Modification of the terms of this BAA shall not be effective or binding upon the Parties unless and until such modification is committed to writing and executed by the Parties hereto.
6.5.	CUSTOMER may not assign any rights, nor may it delegate its duties, under this BAA without the prior written consent of INOVALON, which consent will not be unreasonably withheld. Subject to the requirements of this provision, this BAA will be binding upon and inure to the benefit of the respective successors and permitted assigns of the Parties.
6.6.	Should any provision of this BAA be found unenforceable, it shall be deemed severable and the remainder of the BAA shall continue in full force and effect as if the unenforceable provision had never been made a part hereof.
6.7.	This BAA and the rights and obligations of the Parties hereunder shall in all respects be governed by, and construed in accordance with, the laws of the State of Minnesota, including all matters of construction, validity and performance.
6.8.	All notices and communications required or permitted to be given hereunder shall be sent by certified or regular mail at such address as a Party shall from time to time designate in writing to the other Party and shall be effective from the date of mailing.
6.9.	This BAA, including such portions as are incorporated by reference herein, constitutes the entire agreement by, between and among the Parties, and the Parties acknowledge that they do not rely upon any representations or undertakings by any person or party, past or future, not expressly set forth in writing herein.