WPS Business Associate Agreement

All use of this online platform is subject to this Business Associate Agreement (“BAA”), which is entered into by and between you, the user (“Covered Entity”), and WPS, a division of Manson Western Corporation, a California corporation (“WPS”), as of the date you acknowledge your acceptance of the BAA by clicking the “I Agree” button at the bottom of this page.

RECITALS

1. WHEREAS, Covered Entity is an entity or practitioner subject to the provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA);
2. WHEREAS, WPS operates an online platform that enables users to upload, store, and download electronic data (which may include protected health information) for the purposes of psychological and educational assessment, scoring, and reporting.
3. WHEREAS, Covered Entity desires to utilize WPS’ online platform (such utilization, operation, and administration of the platform constitutes the “Business Relationship,” as that term is used herein, between the parties), and as a result, WPS may have access to certain Protected Health Information (“PHI”) in the course of the parties’ Business Relationship;
4. WHEREAS, the parties desire to protect the privacy of the PHI and to comply with HIPAA, and therefore enter into this BAA setting forth the terms and conditions of WPS’ use of PHI.

In consideration of the mutual promises set forth below, the parties agree as follows:

1. DEFINITIONS
   • 1.1     General Rule. Capitalized terms not otherwise defined in this BAA shall have the same meaning as those terms in the Privacy Rule, the Security Rule, the Breach Notification Rule, and in HIPAA and the HITECH Act, and any regulations promulgated thereunder, as and when amended from time to time.
   • 1.2     “HIPAA” means the Health Insurance Portability & Accountability Act of 1996, P.L. 104-191 as and when amended from time to time.
   • 1.3     “HIPAA Regulations” means the regulations promulgated under HIPAA and the HITECH Act by the U.S. Department of Health and Human Services (“HHS”), including, but not limited to the Privacy Rule, the Security Rule and the Breach Notification Rule, as and when amended from time to time.
   • 1.4     “HITECH Act” means the Health Information Technology for Economic and Clinical Health Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009, as and when amended from time to time.
   • 1.5     “Privacy Rule” means the Standards for Privacy of Individually Identifiable Health Information, codified at 45 C.F.R. parts 160 and 164, Subparts A and E, as amended from time to time.
   • 1.6     “PHI” means Protected Health Information as that term is defined under the Privacy Rule, including but not limited to, 45 C.F.R. Section 160.103.
   • 1.7     “Secretary” means the Secretary of HHS.
   • 1.8     “Security Rule” means the Standards for Security for the Protection of Electronic Protected Health Information, codified at 45 C.F.R. parts 160 and 164, Subpart C, as amended from time to time.
2. Obligations and Activities of WPS
   Except as otherwise limited in this BAA, WPS may use or disclose PHI to perform functions related to the Business Relationship. WPS will use commercially reasonable efforts to comply with applicable provisions of HIPAA, and shall not use or disclose PHI other than as permitted by this BAA or as required by law.
   
   Further, WPS agrees to:
   1. Not use or disclose protected health information other than as permitted or required by the Agreement or as required by law;
   2. Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information, to prevent use or disclosure of protected health information other than as provided for by the Agreement;
   3. Report to covered entity any use or disclosure of protected health information not provided for by the Agreement of which it becomes aware, including breaches of unsecured protected health information as required at 45 CFR 164.410, and any security incident of which it becomes aware;
   4. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of WPS agree to the same restrictions, conditions, and requirements that apply to WPS with respect to such information;
   5. Make available protected health information in a designated record sent to Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.524;
   6. Make any amendment(s) to protected health information in a designated record set as directed or agreed to by Covered Entity pursuant to 45 CFR 164.526, or take another measures as necessary to satisfy covered entity’s obligations under 45 CFR 164.526;
   7. Maintain and make available the information required to provide an accounting of disclosures to Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.528;
   8. To the extent WPS is to carry out one or more of Covered Entity’s obligation(s) under Subpart E of 45 CFR Part 164 (if such obligation is made an obligation of WPS by a separate written agreement between the parties), comply with the requirements of Subpart E that apply to the covered entity in the performance of such obligation(s); and
   9. Make its internal practices, books, and records reasonably available to the Secretary for purposes of determining compliance with the HIPAA Rules.
3. Permitted Uses and Disclosures by WPS
   1. WPS may use or disclose protected health information as necessary to perform the services in conjunction with the Business Relationship. Protected health information will be de-identified before it is used for any purpose outside the service agreement (e.g., as part of a research project).
   2. WPS may use or disclose protected health information as required by law.
   3. WPS agrees to make uses and disclosures and requests for protected health information consistent with Covered Entity’s minimum necessary policies and procedures as they are communicated in writing by Covered Entity to WPS.
   4. WPS may not use or disclose protected health information in a manner that would, if done by covered entity, violate Subpart E of 45 CFR Part 164, except that WPS may use protected health information for the proper management and administration of WPS or to carry out the legal responsibilities of WPS.
4. Provisions for Covered Entity to Inform WPS of Privacy Practices and Restrictions
   1. Covered Entity shall notify WPS in writing of any limitation(s) in the notice of privacy practices of Covered Entity under 45 CFR 164.520, to the extent that such limitation may affect WPS’s use or disclosure of protected health information. Covered Entity shall hold WPS harmless from any uses or disclosures by WPS if written notification of the limitation(s) has not been received from Covered Entity.
   2. Covered Entity shall timely notify WPS of any changes in, or revocation of, the permission by an individual to use or disclose his or her protected health information, to the extent that such changes may affect WPS’s use or disclosure of protected health information. Covered Entity shall hold WPS harmless from any such uses or disclosures by WPS if written notification of the change(s) or revocation of permission has not been received from Covered Entity.
   3. Covered entity shall notify WPS of any restriction on the use or disclosure of protected health information that covered entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect WPS’s use or disclosure of protected health information.
5. Permissible Requests by Covered Entity
   
   Covered entity shall not request WPS to use or disclose protected health information in any manner that would not be permissible, if done by Covered Entity, under Subpart E of 45 CFR Part 164.
   
   
6. Term and Termination
   1. Term. The Term of the BAA shall be effective as of the Effective Date, and shall remain in effect during the period of the Business Relationship or until the date Covered Entity terminates for cause as authorized in paragraph (2) of this Section.
   2. Termination for Cause. WPS authorizes termination of this BAA by Covered Entity, if Covered Entity determines WPS has violated a material term of the BAA, and WPS has not cured the breach or ended the violation within the reasonable time specified by Covered Entity.
   3. Obligations of WPS Upon Termination. Upon termination of this BAA by Covered Entity, WPS shall destroy all protected health information received from Covered Entity, or created, maintained, or received by WPS on behalf of Covered Entity. If WPS determines that return or destruction is not feasible, WPS shall retain the PHI, subject to all of the protections of this BAA, and shall make no further Use or Disclosure of the PHI, except as for those purposes that make the destruction of the PHI not feasible, or for the proper management and administration of WPS, or to carry out the legal responsibilities of WPS.
7. Miscellaneous
   1. Regulatory References. A reference in this BAA to a section in the HIPAA Rules means the section as in effect or as amended.
   2. WPS Covered Entity Status. Nothing herein constitutes or should be interpreted as causing WPS to be recognized as a covered entity, as that term is defined by HIPAA and the HIPAA Regulations.
   3. Modifications in Writing. This BAA is intended by the parties hereto as a final expression of their agreement and understanding with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements and understandings relating thereto; it may not be modified or terminated except by a writing signed by the parties hereto.
   4. Headings. The headings of this BAA are for convenience of reference only, are not part of this Agreement, and do not affect its interpretation.
   5. Third Party Beneficiaries. Except as expressly provided for in this BAA or as required by law, there are no third party beneficiaries to this BAA.
   6. Governing Law/Venue. This BAA shall be governed by the laws of the State of California. Any claim or controversy arising out of or relating to this BAA shall be filed and litigated exclusively in the courts of Los Angeles County, California.
   7. Scanned Signatures. A scanned signature to this BAA shall have the full force and authority as an original signature
   8. Counterparts. This BAA may be executed in one or more counterparts; each counterpart shall be deemed an original.