Terms of Service

If Client, or its customer, client, patient, associate, employee or agent, or a third-party beneficiary to this Agreement shall be required under any state or federal law by the very nature of their industry, occupation, service or product, and/or if any information used or shared pursuant to this Agreement qualifies for special state or federal law protections, the following terms and conditions shall apply and incorporated into the Agreement and these Terms of Service:

Definitions:

The following terms used in this section shall have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

• "ARRA" shall mean the American Recovery and Reinvestment Act of 2009.
• "Business Associate" shall generally have the same meaning as the term "business associate" at 45 CFR 160.103. The business associate under this Section shall mean MyAdvice.
• "Covered Entity" shall generally have the same meaning as the term "covered entity" at 45 CFR 160.103. The covered entity under this Section shall mean Client.
• "Data Controller" shall also refer to and mean Client. A data controller has control over the purpose and manner of which personal data, personally identifiable information, and any protected health information (PHI) (as those terms are defined under applicable law) is collected, stored and analyzed.
• "Data Processor" shall also refer to and mean MyAdvice. A data processor collects, stores, or analyzes personally identifiable information at the direction of the data controller.
• "HIPAA Rules" shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.
• "HITECH" shall mean the Health Information Technology for Economic and Clinical Health Act of 2009.

Obligations and Activities of Business Associate

MyAdvice agrees to be bound by the following provisions:

• Not to use or disclose protected health information other than as permitted or required by the Agreement or as required by law;
• To use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information, to prevent use or disclosure of protected health information other than as provided for by this Section;
• To report to Covered Entity any Breach of Unsecured Protected Health Information not provided for by the BAA of which it becomes aware within 30 calendar days of "discovery" within the meaning of the HITECH Act. Such notice shall include the identification of each individual whose Unsecured Protected Health Information has been, or is reasonably believed by MyAdvice to have been, accessed, acquired, or disclosed in connection with such Breach. MyAdvice also shall provide any additional information reasonably requested by Covered Entity for purposes of investigating the Breach and any other available information that Covered Entity is required to include to the individual under 45 C.F.R. § 164.404(c) at the time of notification or promptly thereafter as information becomes available. MyAdvice's notification of a Breach of Unsecured Protected Health Information under this Section shall comply in all respects with each applicable provision of Section 13400 of Subtitle D (Privacy) of ARRA, the HIPAA Rules, and related guidance issued by governmental entities from time to time.
• In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, to ensure that any subcontractors that create, receive, maintain, or transmit Protected Health Information on behalf of MyAdvice agree to the same restrictions, conditions, and requirements that apply to MyAdvice with respect to such information;
• To make available Protected Health Information in a Designated Record Set to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 CFR 164.524;
• To make any amendment(s) to protected health information in a designated record set as directed or agreed to by the covered entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy covered entity's obligations under 45 CFR 164.526;
• To maintain and make available the information required to provide an accounting of disclosures to the Covered Entity as necessary to satisfy Covered Entity's obligations under 45 CFR 164.528;
• To the extent MyAdvice is to carry out one or more of Covered Entity's obligation(s) under Subpart E of 45 CFR Part 164, to comply with the requirements of Subpart E that apply to the covered entity in the performance of such obligation(s); and
• To make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

Obligations and Activities of Covered Entity

Client as the Covered Entity agrees:

• Not to furnish, deliver, or disclose protected health information to MyAdvice other than as expressly provided in this Section, or as permitted under applicable law, and for no other reasons;
• Not to furnish, deliver, or disclose the identity, name, address, phone number, email address or any other contact information (collectively, the "Identity Information") of any patient of covered entity or of any other person for any reason, other as expressly provided in this Section, or as permitted under applicable law, or pursuant to an informed written consent signed by any such patient or person;
• Not to furnish, deliver, or disclose any photographs, images, videos, or likeness, in any format, whether analog, physical, digital, or otherwise (collectively, the "Images") of any patients of covered entity or any other person for any reason other than as expressly provided in this Section, or as permitted under applicable law, or pursuant to an informed written consent signed by any such patient or person;
• To indemnify, defend, and hold MyAdvice harmless, to the maximum extent permitted by law, from any and all damages, fines, amounts paid in settlement, judgments, investigations, government and administration proceedings, claims, lawsuit, proceedings or any other liabilities (including the reasonable fees of attorneys, experts, and other professionals) with respect to or arising out of, (i) the breach of this Section, or (ii) the retention, possession, use, or disclosure by covered entity or MyAdvice of protected health information, Identity Information or Images on the Internet, to a webhost, to another covered entity, to another MyAdvice, to a subcontractor, or to any other party in any manner or via any medium whatsoever, or whether transmitted by encrypted or unencrypted e-mail, Internet file transfer or other web or Internet protocol, text or SMS messaging, or any other mode of telecommunications.
• The indemnity, hold harmless, and defense obligations of covered entity that are specified in the immediately preceding paragraph (d) shall apply and be binding upon all of the following (each, an "affiliate"): the present, former, and future shareholders, officers, directors, members, managers, and agents of covered entity, and parties under common control or affiliated with covered entity or any of the foregoing persons or entities.
• Covered entity is, and shall be, responsible and liable to MyAdvice for any actions taken, or omissions made, by any affiliate with respect to the obligations, liabilities, rights, or remedies of covered entity or any affiliate, whether occurring under this Section, under the Terms and Conditions, or otherwise.
• Each affiliate is, and shall be, jointly and severally liable to MyAdvice, for any actions taken, or omissions made, by covered entity or another affiliate with respect to the obligations, liabilities, rights, or remedies of covered entity or any affiliate, whether occurring under this Section, under the Terms and Conditions, or otherwise.

Permitted Uses and Disclosures by MyAdvice

Client as the Covered Entity agrees to be bound by the following provisions:

• MyAdvice may only use or disclose protected health information as provided in this Section, the Terms and Conditions, and as permitted or required by applicable Laws.
• MyAdvice is authorized in its sole discretion to use protected health information to de-identify the information in accordance with 45 CFR 164.5 14(a)-(c).
• MyAdvice may use or disclose protected health information as required by law.
• MyAdvice agrees to make uses and disclosures and requests for protected health information consistent with covered entity's minimum necessary policies and procedures.
• MyAdvice may not use or disclose protected health information in a manner that would violate Subpart E of 45 CFR Part 164 if done by covered entity.

Client's Duty to Inform re: Privacy Practices and Restrictions

• Covered Entity shall notify MyAdvice of any limitation(s) in the notice of privacy practices of covered entity under 45 CFR 164.520, to the extent that such limitation may affect MyAdvice's use or disclosure of Protected Health Information, Identity Information, or Images.
• Covered Entity shall notify MyAdvice of any changes in, or revocation of, the permission by an individual to use or disclose his or her Protected Health Information, Identity Information, or Images, to the extent that such changes may affect MyAdvice's use or disclosure of Protected Health Information, Identity Information, or Images.
• Covered Entity shall notify MyAdvice of any restriction on the use or disclosure of Protected Health Information that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect MyAdvice's use or disclosure of Protected Health Information.
• Covered Entity shall post a notice of privacy practices on its Website that is compliant with the HIPAA Rules, and shall, whenever it updates or modifies the notice of privacy practices that it uses in its general business, post such updated or modified notice of privacy practices on Covered Entity's Website.
• The notice of privacy practices shall set forth that Covered Entity has the right to transmit Protected Health Information, Identity Information, and Images via unencrypted email or other unsecure means.

Impermissible Requests by Covered Entity

Client (or the Covered Entity) shall not request MyAdvice to use or disclose protected health information in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Covered Entity.

Client Compliance

Client acknowledges and agrees that, in the context of the Agreement, Client shall be responsible for compliance with applicable law pertaining to data controllers. Notwithstanding anything herein to the contrary, MyAdvice shall not be liable for, and Client agrees to indemnify and hold harmless MyAdvice and its affiliates and intended third-party beneficiaries from and against any and all claims, investigations, proceedings, demands, liabilities, costs, losses and expenses whatsoever (including, without limitation, reasonable attorneys' fees) arising from collection, storage, sharing or usage of personal data or placement of cookies.

Right to Terminate for Cause Under this Section

Client acknowledges and agrees that, in the context of the Agreement, Client shall be responsible for compliance with applicable law pertaining to data controllers. Notwithstanding anything herein to the contrary, MyAdvice shall not be liable for, and Client agrees to indemnify and hold harmless MyAdvice and its affiliates and intended third-party beneficiaries from and against any and all claims, investigations, proceedings, demands, liabilities, costs, losses and expenses whatsoever including, without limitation, reasonable attorneys' fees) arising from collection, storage, sharing or usage of personal data or placement of cookies.

• Either Party authorizes termination of this Agreement by the other Party, if such Party determines that the other Party has violated a material term contained within Section 10 and the other Party has not cured the breach or ended the violation  (after written notice) within thirty (30) days of receiving such notification.
• Obligations of Business Associate Upon Termination. Upon termination of this Agreement, MyAdvice, with respect to protected health information received from Client or the covered entity, or created, maintained, or received by MyAdvice on behalf of Client or the covered entity, shall:
  • Retain only that protected health information which is necessary for MyAdvice to continue its proper management and administration or to carry out its legal responsibilities;
  • Return to covered entity (or, if agreed to by covered entity, destroy) the remaining protected health information that the business associate still maintains in any form;
  • Continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information to prevent use or disclosure of the protected health information, other than as provided for in this Section, for as long as business associate retains the protected health information;
  • Not use or disclose the protected health information retained by business associate other than for the purposes for which such protected health information was retained and subject to the same conditions which applied prior to termination; and
  • Return to Client or the covered entity (or, if agreed to by Client or the covered entity, destroy) the protected health information retained by MyAdvice when it is no longer needed by MyAdvice for its proper management and administration or to carry out its legal responsibilities.

Survival

The obligations of MyAdvice under this Section shall survive the termination of the Agreement.