REFERRING PRACTICE TERMS OF SERVICE
General Terms and Conditions and BAA
The General Terms and Conditions set forth below, including the BAA (as defined below), are a part of the Referring Practice Terms of Service between Glidian and Referring Practice that references and incorporates them.
1.Certain Definitions.
- “BAA” means the Business Associate Addendum attached hereto as Exhibit A, as amended or replaced from time to time, which is incorporated herein and made a part of this Agreement by this reference.
- “HIPAA” means Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act, and the regulations promulgated under the foregoing from time to time by the United States Department of Health and Human Services, each as amended from time to time.
-
- “Participating Provider” has the meaning ascribed on the Cover Page.
-
- “Performing Provider” has the meaning ascribed on the Cover Page.
-
- “Referring Practice Data” means all PHI (as defined in the BAA) and other information disclosed or made available to Glidian by or on behalf of Referring Practice in the course of or related to Glidian’s provision of the Services.
-
- “Restricted Payor” has the meaning ascribed on the Cover Page.
-
- “Services” has the meaning ascribed on the Cover Page.
-
-
- Term. The term of this Agreement shall commence upon the Effective Date and shall continue until terminated as provided herein. Either party may terminate this Agreement by notice to the other party for convenience or upon the breach of the other party.
-
- Services. Subject to terms and conditions of this Agreement, including Referring Practice’s performance of its responsibilities set forth in this Agreement, Glidian shall perform the Services with regard to the Participating Providers.
-
- No Charges; Taxes. Referring Practice shall pay no fees, expenses, or other charges pursuant to this Agreement. Referring Practice shall be responsible for and shall pay when due all taxes, levies, or assessments based on or in any way measured by this Agreement or the Services, excluding taxes based on Glidian’s net income.
-
- Addition and Removal of Participating Providers. From time to time, (i) upon notice to Glidian (which may be in email if receipt is acknowledged by Glidian), Participating Providers may be added or removed and (ii) upon request by Glidian that is accepted by Referring Practice (each of which may be in email), Participating Providers may be added. In either case, this Agreement shall be deemed so amended.
-
- Referring Practice Responsibilities. Referring Practice shall assist and cooperate with Glidian in its provision of the Services by providing or making available such information, documentation, access to personnel, and other efforts as reasonably requested by Glidian from time to time. Subject to Glidian’s compliance with the BAA and HIPAA, Referring Practice shall be responsible for obtaining and maintaining all consents and authorizations of any patients and other individuals necessary for Glidian’s use and disclosure of information regarding such persons in the performance of the Services. To the extent that the Services necessitate or would be facilitated by Glidian’s access to online systems made available to Referring Practice by Restricted Payors for such purpose, Referring Practice shall provide (or cause such Restricted Payors to provide) Glidian access to such systems subject to Glidian’s acceptance of such written terms of use as Referring Practice or such Restricted Payor reasonably may require. Subject to Glidian’s compliance with the BAA and HIPAA, Referring Practice shall be responsible for obtaining and maintaining all consents and authorizations of any of Referring Practice’s licensors, vendors, or personnel, or of any other third parties or government agencies, necessary for Glidian’s access to the such systems and for Glidian to provide the Services. Referring Practice represents and warrants that that it is and will remain compliant in all material respects with all of its agreements with Restricted Payors and that any act of Glidian contemplated or authorized under this Agreement will not violate any such agreement. Glidian shall not be liable for, and Referring Practice shall indemnify, defend, and hold harmless Glidian, its affiliates, and their respective directors, officers, and employees from and against, any loss, liability, damage, award, settlement, claim, suit, proceeding, cost, and expense (including reasonable legal fees and disbursements and costs of investigation, litigation, expert witness fees, settlement, judgment, interest, and penalties) arising from or related Referring Practice’s failure to perform the foregoing responsibilities or Referring Practice’s breach of the foregoing representation and warranties.
-
- Referring Practice Data. As between Glidian and Referring Practice, Referring Practice has and retains exclusive ownership of all Referring Practice Data and all intellectual property and proprietary rights therein. Referring Practice grants to Glidian a non-exclusive, royalty free license during the term of this Agreement (i) to use and disclose Referring Practice Data to perform its obligations under this Agreement and for purposes of monitoring, correcting, and improving the Services, (ii) to de-identify Referring Practice Data in accordance with HIPAA and such that it reasonably cannot be used to identify Referring Practice, or any Referring Practice personnel solely for the foregoing purposes. Referring Practice hereby assigns to Glidian any and all right, title, and interest in and to any such de-identified data; provided, however, that to the extent that any portion of the foregoing or proprietary rights in or based upon the foregoing is not assigned or assignable to Glidian pursuant to this paragraph, Referring Practice grants to Glidian a perpetual, irrevocable, worldwide, royalty-free, non-exclusive, transferable license to use, adapt, translate, create derivative works from, perform, display, make, have made, import, disclose, exploit, sublicense, and exercise the foregoing.
-
- Disclosure to Performing Provider. Referring Practice expressly acknowledges and agrees that Glidian may disclose to the relevant Performing Provider the outcome of the Services with regard to a given patient, including whether the Restricted Payor granted prior approval, the benefits confirmed with a Restricted Payor, and any conditions stipulated by a Restricted Payor with regard to the foregoing.
-
- No Guarantee of Outcome. Referring Practice expressly acknowledges and agrees that Glidian makes no guarantees or assurances regarding the outcomes of outcomes of the Services and that the determinations as to prior authorization or medical necessity of health care services are made solely by the relevant Restricted Payors.
-
- Disclaimers. THE SERVICES ARE PROVIDED “AS IS,” AND GLIDIAN DISCLAIMS ANY AND ALL WARRANTIES, CONDITIONS, OR REPRESENTATIONS (EXPRESS OR IMPLIED, ORAL OR WRITTEN) WITH RESPECT TO THE SERVICES, INCLUDING ANY AND ALL IMPLIED WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY, OR FITNESS OR SUITABILITY FOR ANY PURPOSE (WHETHER OR NOT THE GLIDIAN KNOWS, HAS REASON TO KNOW, HAS BEEN ADVISED, OR OTHERWISE IS IN FACT AWARE OF ANY SUCH PURPOSE), WHETHER ALLEGED TO ARISE BY LAW, BY REASON OF CUSTOM OR USAGE IN THE TRADE, BY COURSE OF DEALING, OR OTHERWISE.
-
- Risk Allocation.
-
-
- EXCLUSION OF INDIRECT DAMAGES. WITHOUT LIMITING A PARTY’S EXPRESS INDEMNIFICATION OBLIGATIONS UNDER THIS AGREEMENT WITH REGARD TO CLAIMS OF THIRD PARTIES, NEITHER PARTY WILL BE LIABLE TO THE OTHER PARTY (NOR TO ANY PERSON CLAIMING RIGHTS DERIVED FROM THE OTHER PARTY’S RIGHTS) FOR INCIDENTAL, CONSEQUENTIAL, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES OF ANY KIND (INCLUDING WITHOUT LIMITATION LOST PROFITS, LOSS OF OR DAMAGE TO DATA, LOSS OF BUSINESS, OR OTHER ECONOMIC DAMAGE), WHETHER ARISING IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, AND REGARDLESS OF WHETHER THE PARTY LIABLE OR ALLEGEDLY LIABLE WAS ADVISED, HAD OTHER REASON TO KNOW, SHOULD HAVE ANTICIPATED, OR IN FACT KNEW OF THE POSSIBILITY THEREOF. IN NO EVENT SHALL EITHER PARTY BE LIABLE FOR COSTS OF PROCUREMENT OF SUBSTITUTE GOODS BY ANYONE. THE PROVISIONS OF THIS PARAGRAPH ARE INDEPENDENT OF, SEVERABLE FROM, AND TO BE ENFORCED INDEPENDENTLY OF ANY OTHER ENFORCEABLE OR UNENFORCEABLE PROVISION OF THIS AGREEMENT.
-
- MAXIMUM AGGREGATE LIABILITY. EXCEPT WITH REGARD TO A PARTY’S EXPRESS INDEMNIFICATION OBLIGATIONS UNDER THIS AGREEMENT, IN NO EVENT SHALL A PARTY’S AGGREGATE LIABILITY TO THE OTHER PARTY (INCLUDING LIABILITY TO ANY PERSON OR PERSONS WHOSE CLAIM OR CLAIMS ARE BASED ON OR DERIVED FROM A RIGHT OR RIGHTS CLAIMED BY OR THROUGH SUCH PARTY), WITH RESPECT TO ANY AND ALL CLAIMS AT ANY AND ALL TIMES ARISING FROM OR RELATED TO THE SUBJECT MATTER OF THIS AGREEMENT, IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, EXCEED $250. THE PROVISIONS OF THIS PARAGRAPH ARE INDEPENDENT OF, SEVERABLE FROM, AND TO BE ENFORCED INDEPENDENTLY OF ANY OTHER ENFORCEABLE OR UNENFORCEABLE PROVISION OF THIS AGREEMENT.
-
- Intentional Risk Allocation. Referring Practice acknowledges and agrees that the Services are provided free of charge and that Glidian would be unwilling to enter this Agreement on such basis without the exclusions and limitations set forth herein. Each party acknowledges that the provisions of this Agreement were negotiated, as a material part of the agreement memorialized herein, to reflect an informed, voluntary allocation between them of all risks (both known and unknown) associated with the transactions involved with this Agreement. The warranty disclaimers and limitations in this Agreement are intended, and have as their essential purpose, to limit the circumstances of liability. The remedy limitations and the limitations of liability are separately intended, and have as their essential purpose, to limit the forms of relief available to the parties.
-
-
- Other Provisions.
-
-
- Nature of Relationship. Glidian shall provide all Services hereunder as an independent contractor to Referring Practice. Nothing contained herein shall be deemed to create any agency, partnership, joint venture, or other relationship between the parties or any of their affiliates, and neither party shall have the right, power, or authority under this Agreement to create any duty or obligation on behalf of the other party.
-
- Force Majeure. Neither party shall be liable for any failure to perform its obligations under this Agreement if such failure (i) arises, directly or indirectly, out of causes reasonably beyond the direct control of such party and not due to such party’s own fault or negligence or that of its contractors or representatives or other persons acting on its behalf and (ii) cannot be overcome by the exercise of due diligence and reasonably could not have been prevented through commercially reasonable measures, including acts of God, acts of terrorists or criminals, acts of domestic or foreign governments, change in any law or regulation, fires, floods, explosions, epidemics, disruptions in communications, power, or other utilities, strikes or other labor problems, riots, or unavailability of supplies.
-
- Notice. Except as otherwise expressly provided herein, notices shall be given under this Agreement in writing, in the English language, (i) by personal delivery, provided that if the applicable person is an entity, such delivery shall be to an officer of such entity or, if none, to an individual serving in a similar capacity (in which case such notices shall be deemed given upon such personal delivery), (ii) by certified or registered U.S. mail, postage pre-paid, from within the United States (in which case such notices shall be deemed given on the third business day after deposit), (iii) with next-business-day instruction by a recognized overnight courier, pre-paid, with next-business-day delivery instruction (in which case such notices shall be deemed given on the next business day after deposit), or (iv) to Referring Practice, by e-mail (in which case such notice shall be deemed given upon transmission unless Glidian receives a non-delivery email message within a reasonable time thereafter). Notices shall be sent to Glidian at Attn: Legal Department, Glidian, Inc., 224 Sequoia Ave., South San Francisco, CA 94080, with copy to Steve F. Wood, Esq., Baker Donelson, 211 Commerce Street, Suite 800, Nashville, Tennessee 37201, and to Referring Practice at the address set forth on the Cover Page. Either party may change its address for purposes of notice by written notice thereof to the other party.
-
- Governing Law; Venue. This Agreement shall be construed and enforced in accordance with the laws of the state of California (other than its conflicts of law provisions) and venue shall be exclusive in the federal or state courts in San Francisco, California.
-
- Severability. If any one or more of the provisions of this Agreement should be ruled wholly or partly invalid or unenforceable by a court or other government body of competent jurisdiction, then (i) the validity and enforceability of all provisions of this Agreement not ruled to be invalid or unenforceable will be unaffected; (ii) the effect of the ruling will be limited to the jurisdiction of the court or other government body making the ruling; (iii) the provision(s) held wholly or partly invalid or unenforceable would be deemed amended, and the court or other government body is authorized to reform the provision(s), to the minimum extent necessary to render them valid and enforceable in conformity with the parties’ intent as manifested herein; and (iv) if the ruling, and/or the controlling principle of law or equity leading to the ruling, subsequently is overruled, modified, or amended by legislative, judicial or administrative action, then the provision(s) in question as originally set forth in this Agreement will be deemed valid and enforceable to the maximum extent permitted by the new controlling principle of law or equity.
-
- Entire Agreement. This Agreement constitutes the entire agreement between the parties concerning the subject matter hereof. No prior or contemporaneous representations, inducements, promises, or agreements, oral or otherwise, between the parties with reference thereto will be of any force or effect. Each party represents and warrants that, in entering into and performing its obligations under this Agreement, it does not and will not rely on any promise, inducement, or representation allegedly made by or on behalf of the other party with respect to the subject matter hereof, nor on any course of dealing or custom and usage in the trade, except as such promise, inducement, or representation may be expressly set forth herein.
-
- Amendment and Waiver. No modification or amendment to this Agreement will be valid or binding unless in writing and duly executed by the party or parties to be bound thereby (which may be accomplished in electronic form or by electronic means). The failure of either party at any time to require performance by the other party of any provision of this Agreement shall in no way affect the right of such party to require performance of that provision. Any waiver by either party of any breach of this Agreement shall not be construed as a waiver of any continuing or succeeding breach of such provision, a waiver of the provision itself or a waiver of any right under this Agreement.
-
- No Third Party Beneficiaries. This Agreement is not intended to confer, nor shall any provision hereof be interpreted to confer, upon any person other than the parties and the respective successors or permitted assigns of the parties, any rights, remedies, obligations, or liabilities whatsoever.
-
- Interpretation. The division of this Agreement into articles, sections, and subsections and the use of captions and headings in connection therewith are solely for convenience and shall have no legal effect in construing the provisions of this Agreement. Unless otherwise indicated, references to articles, sections, subsections, and paragraphs are to provisions of this Agreement and references to exhibits and schedules are to exhibits and schedules appended to this Agreement. Unless the context otherwise requires, (i) references to any party to this Agreement include references to such party’s successors and permitted assigns, (ii) references to “person” include references to any individual, corporation, limited liability company, partnership, company, firm, association, joint venture, trust, governmental body, or other entity, (iii) any of the terms defined herein may be used in the singular or the plural depending on the reference, (iv) a masculine, feminine, or neuter pronoun includes the other genders as appropriate in the context, and (v) the term “including” means “including without limitation” unless otherwise expressly indicated in a given instance.
-
- Survival. The covenants herein concerning indemnification and any other provision that, by its nature, is intended to survive this Agreement shall survive any termination or expiration of this Agreement.
-
- Successors and Assigns. This Agreement will be binding upon and inure to the benefit of the parties and their successors and assigns permitted by this Agreement.
-
EXHIBITA
BusinessAssociate Addendum
THIS BUSINESSASSOCIATE ADDENDUM (the “Addendum”) supplements andis made a part of the Referring Practice Terms of Service betweenGlidian and Referring Practice (the “Agreement”).
Referring Practiceis a Covered Entity (or is a Business Associate to one or moreCovered Entities) pursuant to HIPAA. Referring Practice has engagedGlidian to perform the Services pursuant to the Agreement. In thecourse of providing the Services, Referring Practice may makeavailable to Glidian or have Glidian obtain or create on its behalfinformation that may be deemed Protected Health Information subjectto the provisions of HIPAA and information subject to protectionunder other federal or state laws.
In order to complywith the applicable provisions of HIPAA and other federal or statelaws as applicable, the parties agree as follows:
- Definitions.
-
-
- Capitalized terms used but not otherwise defined in this Addendum shall have the meanings ascribed in HIPAA (whether or not such terms are capitalized therein) or in the Agreement, as the case may be.
-
- “Electronic PHI” means PHI that is Electronic Protected Health Information.
-
- “PHI” means Protected Health Information received or accessed by Glidian from or on behalf of Referring Practice or created, transmitted, or maintained by Glidian for or on behalf of Referring Practice.
-
-
- Permitted Uses. Glidian may use PHI only as permitted or required by this Addendum and only for the following purposes: (i) as necessary to perform the Services; (ii) to provide Data Aggregation services relating to the Health Care Operations of Referring Practice, but only incident to the performance of the Services; (iii) to de-identify PHI in accordance with the standards set forth under HIPAA, but only incident to the performance of the Services; (iv) to carry out its legal responsibilities; (v) for the proper business management and administration of Glidian; and (v) as Required By Law.
-
- Permitted Disclosures. Glidian may disclose PHI only as permitted or required by this Addendum for the following purposes: (i) as necessary to perform the Services; (ii) for the proper business management and administration of Glidian or to carry out its legal responsibilities, if Required By Law or if Glidian has obtained reasonable assurances that the recipient will (A) hold such PHI in confidence, (B) use or further disclose it only for the purpose for which it was received or as Required By Law, and (C) notify Glidian of any instance of which the recipient becomes aware in which the confidentiality of such PHI has been breached; and (iii) as otherwise Required By Law.
-
- Prohibited Uses and Disclosures.
-
-
- Subject to Referring Practice’s compliance with its obligations set forth in Section 16 as applicable, Glidian shall not use or further disclose PHI in a manner that would violate HIPAA if done by Referring Practice.
-
- If Referring Practice notifies Glidian that Referring Practice has agreed to be bound by additional restrictions on the uses or disclosures of PHI pursuant to Section 16, Glidian shall be bound by such additional restrictions and shall not use or disclose PHI in violation of such additional restrictions.
-
- Glidian shall not sell PHI or otherwise receive remuneration, directly or indirectly, in exchange for PHI.
-
- Glidian shall not use or disclose PHI for purposes of marketing or fundraising.
-
-
- Subcontractors and Agents. Any disclosure to a Subcontractor of Glidian shall be pursuant to a written agreement between Glidian and such Subcontractor containing substantially the same restrictions and conditions on the use, disclosure, and safeguarding of PHI as are set forth in this Addendum.
-
- Minimum Necessary. Glidian shall request, access, use, and disclose only the minimum amount of PHI necessary, in accordance with HIPAA, to perform the Services.
-
- Certain Privacy Rule Compliance. To the extent that Glidian is to carry out one or more of Referring Practice's obligations under Subpart E of Part 164 of HIPAA (generally known as the HIPAA Privacy Rule), Glidian shall comply with such requirements that apply to Referring Practice in the performance of such obligations.
-
- Safeguards. Glidian at all times shall maintain administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, availability, and integrity of Electronic PHI that it creates, receives, maintains, or transmits in accordance with the regulations set forth at 45 CFR § 164.308, 45 CFR § 164.310, and 45 CFR § 164.312 and shall maintain policies and procedures and other documentation in accordance the regulations set forth at 45 CFR § 164.316. Glidian acknowledges that such provisions apply to Glidian in the same manner that they apply to Covered Entities.
-
- Breach Investigation and Reporting.
-
-
- As soon as practicable following any actual or reasonably suspected impermissible use or disclosure of PHI, Glidian shall assess whether such actual or suspected impermissible use or disclosure was of PHI that is Unsecured Protected Health Information and, if so (or if Glidian cannot determine reasonably conclusively to the contrary), Glidian shall make an evaluation of whether there is a low probability that the PHI has been compromised. In making such evaluation, Glidian shall conduct a risk assessment that considers, at a minimum, (i) the nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re identification, (ii) the unauthorized person who used the protected health information or to whom the disclosure was made, (iii) whether the protected health information was actually acquired or viewed, and (iv) the extent to which the risk to the protected health information has been mitigated, and Glidian shall evaluate the overall possibility that the PHI has been compromised by considering all of the above, and any other relevant factors, in combination.
-
- If pursuant to the evaluation described in Section 9.1 Glidian determines that such impermissible use or disclosure constitutes a Breach of PHI that is Unsecured Protected Health Information, Glidian shall provide Referring Practice in writing, without unreasonable delay but in no case later than 10 days following such determination, written notice setting forth the date of discovery thereof, the identities of affected individuals (or, if such identities are unknown at that time, the classes of such individuals), a general description of the nature of the incident, and such other information as is required pursuant to HIPAA or reasonably requested by Referring Practice. Glidian shall supplement such notice with information not available at the time of the initial notification as promptly thereafter as the information becomes available to Glidian.
-
- If pursuant to the evaluation described in Section 9.1 Glidian determines that such impermissible use or disclosure does not constitute a Breach of PHI that is Unsecured Protected Health Information, Glidian shall notify Referring Practice in writing of such impermissible use or disclosure of PHI and of such determination promptly following such determination.
-
- For purposes hereof, an actual or suspected use or disclosure shall be deemed impermissible if it is not or would not be permitted by this Agreement or if it is or would be in violation of HIPAA.
-
- For purposes hereof, an impermissible use or disclosure shall be deemed discovered by Glidian as of the first day on which such impermissible use or disclosure is known to Glidian or, by exercising reasonable diligence, would have been known to Glidian, and Glidian shall be deemed to have knowledge of an impermissible use or disclosure if such impermissible use or disclosure is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the impermissible use or disclosure, who is a workforce member of Glidian or an agent of Glidian (determined in accordance with the federal common law of agency).
-
-
- Security Incident Reporting. Glidian shall report to Referring Practice in writing any Security Incident involving Electronic PHI, other than a Security Incident that involves an actual or suspected impermissible use or disclosure of PHI, within 30 days of Glidian’s discovery thereof. The parties acknowledge and agree that this section constitutes notice by Glidian to Referring Practice of the ongoing occurrence of events that may constitute Security Incidents but that are trivial, routine, do not constitute a material threat to the security of PHI, and do not result in unauthorized access to or use or disclosure of PHI (such as typical pings and port scans), for which no additional notice to Referring Practice shall be required.
-
- Mitigation. Glidian shall take all actions reasonably necessary and shall cooperate with Referring Practice as reasonably requested to mitigate, to the extent practicable, any harmful effect of any use or disclosure of PHI in violation of the terms and conditions of this Addendum or of any applicable law.
-
- Access and Amendment. With respect to an Individual as to whom Glidian maintains PHI, Glidian shall notify Referring Practice promptly upon receipt of a request from such an Individual for access to or a copy of such Individual’s PHI or to amend such Individual’s PHI. To the extent permitted under HIPAA, and except as otherwise required upon the order of a court of competent jurisdiction, (i) Glidian shall direct such Individual to make such request of Referring Practice and (ii) Glidian shall not consent to such access, deliver such copy, or comply with such request except as directed by Referring Practice. With respect to PHI maintained by Glidian in a Designated Record Set, to the extent required by HIPAA, Glidian shall (i) make available PHI to Individuals or Referring Practice, as reasonably requested by Referring Practice and in accordance with HIPAA and (ii) upon receipt of notice from Referring Practice, promptly amend any portion of the PHI so that Referring Practice may meet its amendment obligations under HIPAA.
-
- Accounting for Disclosures. Glidian shall document all disclosures of PHI by Glidian and information related to such disclosures as would be required for Referring Practice to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with HIPAA. Glidian shall maintain such information for the applicable period set forth in HIPAA. Glidian shall deliver such information to Referring Practice or, upon Referring Practice’s request, to the Individual, in the time and manner reasonably designated by Referring Practice, in order for Referring Practice to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with HIPAA. The obligations set forth in this section shall survive the expiration or any termination of this Agreement and shall continue, as to a given instance of a disclosure, until the earlier of (i) the passing of the time required for such information to be maintained pursuant to HIPAA or (ii) the delivery to Referring Practice of all such information in a form and medium reasonably satisfactory to Referring Practice and the return or destruction of all PHI as provided in this Agreement.
-
- Audit. If Glidian receives a request, made on behalf of the Secretary of the Department of Health and Human Services, that Glidian make its internal practices, books, and records relating to the use or disclosure of PHI available to the Secretary of the Department of Health and Human Services for the purposes of determining Referring Practice’s or Glidian’s compliance with HIPAA, Glidian promptly shall notify Referring Practice of such request and, unless enjoined from doing so by order of a court of competent jurisdiction in response to a challenge raised by Referring Practice or Glidian (which challenge Glidian shall not be obligated to raise), Glidian shall comply with such request to the extent required of it by applicable law. Nothing in this Agreement shall waive any attorney-client privilege or other privilege applicable to either party.
-
- Compliance with Law. Glidian shall comply with all applicable federal and state laws regarding individually identifiable information contained in or associated with PHI, including without limitation any state data breach laws or other state laws regarding the protection of such information. Nothing in this Agreement shall be construed to require Glidian to use or disclose PHI without a written authorization from an Individual who is the subject thereof, or written authorization from any other person, where such authorization would be required under federal or state law for such use or disclosure.
-
- Obligations of Referring Practice. Referring Practice shall (i) notify Glidian of any limitation in Referring Practice’s Notice of Privacy Practices to the extent that such limitation may affect Glidian's use or disclosure of PHI, (ii) notify Glidian of any changes in, or revocation of, permission by an Individual to use or disclose PHI, to the extent that such change may affect Glidian’s use or disclosure of PHI, (iii) notify Glidian of any restriction on the use or disclosure of PHI to which Referring Practice has agreed in accordance with HIPAA, to the extent that such restriction may affect Glidian's use or disclosure of PHI, and (iv) obtain any authorization or consents as may be Required by Law for any of the uses or disclosures of PHI necessary for Glidian to provide to the Services.
-
- Term and Termination. This Addendum shall become effective on the Effective Date and shall continue in effect until the earlier to occur of (i) the expiration or termination of all Agreements or (ii) termination pursuant to this section. Either party may terminate this Addendum effective immediately if the other party has breached a material provision of this Addendum and failed to cure such breach within 30 days of being notified by the other party of the breach. If the non-breaching party reasonably determines that cure is not possible, such party may terminate this Addendum effective immediately upon written notice to other party.
-
- Effect of Termination. Upon termination of this Addendum, subject to any applicable provisions of the Agreement, Glidian shall return to Referring Practice or destroy all PHI that Glidian maintains in any form and retain no copies of such PHI or, if return or destruction is not feasible (including without limitation if Glidian is required by applicable law to retain any such PHI for a time following termination), notify Referring Practice thereof and extend the protections of this Addendum to the PHI and limit its further use or disclosure to those purposes that make the return or destruction of the PHI infeasible. The requirements of this section shall survive termination or expiration of this Addendum and shall be in force as long as any PHI remains in the custody or control of Glidian.
-
- Miscellaneous.
-
-
- Amendments. Any provision of the Agreement to the contrary notwithstanding, upon the enactment of any law or regulation affecting the use or disclosure of PHI, or on the publication of any decision of a court of competent jurisdiction relating to any such law, or the publication of any interpretive policy or opinion of any governmental agency charged with the enforcement of any such law or regulation, Referring Practice may, by written notice to Glidian, propose to amend this Addendum in such a manner as Referring Practice reasonably determines necessary to comply therewith, and such proposed amendment shall become operative unless Glidian rejects such amendment by written notice to Referring Practice within 30 days thereafter, in which case, unless the parties agree on an amendment within 30 days after Glidian’s notice, either party may terminate this Addendum by written notice to the other.
-
- Notice. Written notice pursuant to Section 9 or Section 10 sent with next-business-day instruction by recognized overnight document delivery service to the address provided herein shall be deemed given upon deposit with such overnight delivery service.
-
- Interpretation. In the event of a conflict between the provisions of this Addendum and any other provisions of the Agreement, the provisions of this Addendum shall control. In the event of an inconsistency between the provisions of this Addendum and mandatory provisions of HIPAA, as amended, or its interpretation by any court or regulatory agency with authority over either party hereto, HIPAA (interpreted by such court or agency, if applicable) shall control. Where provisions of this Addendum are different from those mandated under HIPAA, but are nonetheless permitted by such rules as interpreted by relevant courts or agencies, the provisions of this Addendum shall control.
-
REFERRING PRACTICE TERMS OF SERVICE
General Terms and Conditions and BAA
The General Terms and Conditions set forth below, including the BAA (as defined below), are a part of the Referring Practice Terms of Service between Glidian and Referring Practice that references and incorporates them.
1. Certain Definitions.
“BAA” means the Business Associate Addendum attached hereto as Exhibit A, as amended or replaced from time to time, which is incorporated herein and made a part of this Agreement by this reference.
“HIPAA” means Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act, and the regulations promulgated under the foregoing from time to time by the United States Department of Health and Human Services, each as amended from time to time.
“Participating Provider” has the meaning ascribed on the Cover Page.
“Performing Provider” has the meaning ascribed on the Cover Page.
“Referring Practice Data” means all PHI (as defined in the BAA) and other information disclosed or made available to Glidian by or on behalf of Referring Practice in the course of or related to Glidian’s provision of the Services.
“Restricted Payor” has the meaning ascribed on the Cover Page.
“Services” has the meaning ascribed on the Cover Page.
2. Term. The term of this Agreement shall commence upon the Effective Date and shall continue until terminated as provided herein. Either party may terminate this Agreement by notice to the other party for convenience or upon the breach of the other party.
3. Services. Subject to terms and conditions of this Agreement, including Referring Practice’s performance of its responsibilities set forth in this Agreement, Glidian shall perform the Services with regard to the Participating Providers.
4. No Charges; Taxes. Referring Practice shall pay no fees, expenses, or other charges pursuant to this Agreement. Referring Practice shall be responsible for and shall pay when due all taxes, levies, or assessments based on or in any way measured by this Agreement or the Services, excluding taxes based on Glidian’s net income.
5. Addition and Removal of Participating Providers. From time to time, (i) upon notice to Glidian (which may be in email if receipt is acknowledged by Glidian), Participating Providers may be added or removed and (ii) upon request by Glidian that is accepted by Referring Practice (each of which may be in email), Participating Providers may be added. In either case, this Agreement shall be deemed so amended.
6. Referring Practice Responsibilities. Referring Practice shall assist and cooperate with Glidian in its provision of the Services by providing or making available such information, documentation, access to personnel, and other efforts as reasonably requested by Glidian from time to time. Subject to Glidian’s compliance with the BAA and HIPAA, Referring Practice shall be responsible for obtaining and maintaining all consents and authorizations of any patients and other individuals necessary for Glidian’s use and disclosure of information regarding such persons in the performance of the Services. To the extent that the Services necessitate or would be facilitated by Glidian’s access to online systems made available to Referring Practice by Restricted Payors for such purpose, Referring Practice shall provide (or cause such Restricted Payors to provide) Glidian access to such systems subject to Glidian’s acceptance of such written terms of use as Referring Practice or such Restricted Payor reasonably may require. Subject to Glidian’s compliance with the BAA and HIPAA, Referring Practice shall be responsible for obtaining and maintaining all consents and authorizations of any of Referring Practice’s licensors, vendors, or personnel, or of any other third parties or government agencies, necessary for Glidian’s access to the such systems and for Glidian to provide the Services. Referring Practice represents and warrants that that it is and will remain compliant in all material respects with all of its agreements with Restricted Payors and that any act of Glidian contemplated or authorized under this Agreement will not violate any such agreement. Glidian shall not be liable for, and Referring Practice shall indemnify, defend, and hold harmless Glidian, its affiliates, and their respective directors, officers, and employees from and against, any loss, liability, damage, award, settlement, claim, suit, proceeding, cost, and expense (including reasonable legal fees and disbursements and costs of investigation, litigation, expert witness fees, settlement, judgment, interest, and penalties) arising from or related Referring Practice’s failure to perform the foregoing responsibilities or Referring Practice’s breach of the foregoing representation and warranties.
7. Referring Practice Data. As between Glidian and Referring Practice, Referring Practice has and retains exclusive ownership of all Referring Practice Data and all intellectual property and proprietary rights therein. Referring Practice grants to Glidian a non-exclusive, royalty free license during the term of this Agreement (i) to use and disclose Referring Practice Data to perform its obligations under this Agreement and for purposes of monitoring, correcting, and improving the Services, (ii) to de-identify Referring Practice Data in accordance with HIPAA and such that it reasonably cannot be used to identify Referring Practice, or any Referring Practice personnel solely for the foregoing purposes. Referring Practice hereby assigns to Glidian any and all right, title, and interest in and to any such de-identified data; provided, however, that to the extent that any portion of the foregoing or proprietary rights in or based upon the foregoing is not assigned or assignable to Glidian pursuant to this paragraph, Referring Practice grants to Glidian a perpetual, irrevocable, worldwide, royalty-free, non-exclusive, transferable license to use, adapt, translate, create derivative works from, perform, display, make, have made, import, disclose, exploit, sublicense, and exercise the foregoing.
8. Disclosure to Performing Provider. Referring Practice expressly acknowledges and agrees that Glidian may disclose to the relevant Performing Provider the outcome of the Services with regard to a given patient, including whether the Restricted Payor granted prior approval, the benefits confirmed with a Restricted Payor, and any conditions stipulated by a Restricted Payor with regard to the foregoing.
9. No Guarantee of Outcome. Referring Practice expressly acknowledges and agrees that Glidian makes no guarantees or assurances regarding the outcomes of outcomes of the Services and that the determinations as to prior authorization or medical necessity of health care services are made solely by the relevant Restricted Payors.
10. Disclaimers. THE SERVICES ARE PROVIDED “AS IS,” AND GLIDIAN DISCLAIMS ANY AND ALL WARRANTIES, CONDITIONS, OR REPRESENTATIONS (EXPRESS OR IMPLIED, ORAL OR WRITTEN) WITH RESPECT TO THE SERVICES, INCLUDING ANY AND ALL IMPLIED WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY, OR FITNESS OR SUITABILITY FOR ANY PURPOSE (WHETHER OR NOT THE GLIDIAN KNOWS, HAS REASON TO KNOW, HAS BEEN ADVISED, OR OTHERWISE IS IN FACT AWARE OF ANY SUCH PURPOSE), WHETHER ALLEGED TO ARISE BY LAW, BY REASON OF CUSTOM OR USAGE IN THE TRADE, BY COURSE OF DEALING, OR OTHERWISE.
11. Risk Allocation.
a. EXCLUSION OF INDIRECT DAMAGES. WITHOUT LIMITING A PARTY’S EXPRESS INDEMNIFICATION OBLIGATIONS UNDER THIS AGREEMENT WITH REGARD TO CLAIMS OF THIRD PARTIES, NEITHER PARTY WILL BE LIABLE TO THE OTHER PARTY (NOR TO ANY PERSONCLAIMING RIGHTS DERIVED FROM THE OTHER PARTY’S RIGHTS) FOR INCIDENTAL, CONSEQUENTIAL, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES OF ANY KIND (INCLUDING WITHOUT LIMITATION LOST PROFITS, LOSS OF OR DAMAGE TO DATA, LOSS OF BUSINESS, OR OTHER ECONOMIC DAMAGE), WHETHER ARISING IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, AND REGARDLESS OF WHETHER THE PARTY LIABLE OR ALLEGEDLY LIABLE WAS ADVISED, HAD OTHER REASON TO KNOW, SHOULD HAVE ANTICIPATED, OR IN FACT KNEW OF THE POSSIBILITY THEREOF. IN NO EVENT SHALL EITHER PARTY BE LIABLE FOR COSTS OF PROCUREMENT OF SUBSTITUTE GOODS BY ANYONE. THE PROVISIONS OF THIS PARAGRAPH ARE INDEPENDENT OF, SEVERABLE FROM, AND TO BE ENFORCED INDEPENDENTLY OF ANY OTHER ENFORCEABLE OR UNENFORCEABLE PROVISION OF THIS AGREEMENT.
b. MAXIMUM AGGREGATE LIABILITY. EXCEPT WITH REGARD TO A PARTY’S EXPRESS INDEMNIFICATION OBLIGATIONS UNDER THIS AGREEMENT, IN NO EVENT SHALL A PARTY’S AGGREGATE LIABILITY TO THE OTHER PARTY (INCLUDING LIABILITY TO ANY PERSON OR PERSONS WHOSE CLAIM OR CLAIMS ARE BASED ON OR DERIVED FROM A RIGHT OR RIGHTS CLAIMED BY OR THROUGH SUCH PARTY), WITH RESPECT TO ANY AND ALL CLAIMS AT ANY AND ALL TIMES ARISING FROM OR RELATED TO THE SUBJECT MATTER OF THIS AGREEMENT, IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, EXCEED $250. THE PROVISIONS OF THIS PARAGRAPH ARE INDEPENDENT OF, SEVERABLE FROM, AND TO BE ENFORCED INDEPENDENTLY OF ANY OTHER ENFORCEABLE OR UNENFORCEABLE PROVISION OF THIS AGREEMENT.
c. Intentional Risk Allocation. Referring Practice acknowledges and agrees that the Services are provided free of charge and that Glidian would be unwilling to enter this Agreement on such basis without the exclusions and limitations set forth herein. Each party acknowledges that the provisions of this Agreement were negotiated, as a material part of the agreement memorialized herein, to reflect an informed, voluntary allocation between them of all risks (both known and unknown) associated with the transactions involved with this Agreement. The warranty disclaimers and limitations in this Agreement are intended, and have as their essential purpose, to limit the circumstances of liability. The remedy limitations and the limitations of liability are separately intended, and have as their essential purpose, to limit the forms of relief available to the parties.
12. Other Provisions.
a. Nature of Relationship. Glidian shall provide all Services hereunder as an independent contractor to Referring Practice. Nothing contained herein shall be deemed to create any agency, partnership, joint venture, or other relationship between the parties or any of their affiliates, and neither party shall have the right, power, or authority under this Agreement to create any duty or obligation on behalf of the other party.
b. Force Majeure. Neither party shall be liable for any failure to perform its obligations under this Agreement if such failure (i) arises, directly or indirectly, out of causes reasonably beyond the direct control of such party and not due to such party’s own fault or negligence or that of its contractors or representatives or other persons acting on its behalf and (ii) cannot be overcome by the exercise of due diligence and reasonably could not have been prevented through commercially reasonable measures, including acts of God, acts of terrorists or criminals, acts of domestic or foreign governments, change in any law or regulation, fires, floods, explosions, epidemics, disruptions in communications, power, or other utilities, strikes or other labor problems, riots, or unavailability of supplies.
c. Notice. Except as otherwise expressly provided herein, notices shall be given under this Agreement in writing, in the English language, (i) by personal delivery, provided that if the applicable person is an entity, such delivery shall be to an officer of such entity or, if none, to an individual serving in a similar capacity (in which case such notices shall be deemed given upon such personal delivery), (ii) by certified or registered U.S. mail, postage pre-paid, from within the United States (in which case such notices shall be deemed given on the third business day after deposit), (iii) with next-business-day instruction by a recognized overnight courier, pre-paid, with next-business-day delivery instruction (in which case such notices shall be deemed given on the next business day after deposit), or (iv) to Referring Practice, by e-mail (in which case such notice shall be deemed given upon transmission unless Glidian receives a non-delivery email message within a reasonable time thereafter). Notices shall be sent to Glidian at Attn: Legal Department, Glidian, Inc., 224 Sequoia Ave., South San Francisco, CA 94080, with copy to Steve F. Wood, Esq., Baker Donelson, 211 Commerce Street, Suite 800, Nashville, Tennessee 37201, and to Referring Practice at the address set forth on the Cover Page. Either party may change its address for purposes of notice by written notice thereof to the other party.
d. Governing Law; Venue. This Agreement shall be construed and enforced in accordance with the laws of the state of California (other than its conflicts of law provisions) and venue shall be exclusive in the federal or state courts in San Francisco, California.
e. Severability. If any one or more of the provisions of this Agreement should be ruled wholly or partly invalid or unenforceable by a court or other government body of competent jurisdiction, then (i) the validity and enforceability of all provisions of this Agreement not ruled to be invalid or unenforceable will be unaffected; (ii) the effect of the ruling will be limited to the jurisdiction of the court or other government body making the ruling; (iii) the provision(s) held wholly or partly invalid or unenforceable would be deemed amended, and the court or other government body is authorized to reform the provision(s), to the minimum extent necessary to render them valid and enforceable in conformity with the parties’ intent as manifested herein; and (iv) if the ruling, and/or the controlling principle of law or equity leading to the ruling, subsequently is overruled, modified, or amended by legislative, judicial or administrative action, then the provision(s) in question as originally set forth in this Agreement will be deemed valid and enforceable to the maximum extent permitted by the new controlling principle of law or equity.
f. Entire Agreement. This Agreement constitutes the entire agreement between the parties concerning the subject matter hereof. No prior or contemporaneous representations, inducements, promises, or agreements, oral or otherwise, between the parties with reference thereto will be of any force or effect. Each party represents and warrants that, in entering into and performing its obligations under this Agreement, it does not and will not rely on any promise, inducement, or representation allegedly made by or on behalf of the other party with respect to the subject matter hereof, nor on any course of dealing or custom and usage in the trade, except as such promise, inducement, or representation may be expressly set forth herein.
g. Amendment and Waiver. No modification or amendment to this Agreement will be valid or binding unless in writing and duly executed by the party or parties to be bound thereby (which may be accomplished in electronic form or by electronic means). The failure of either party at any time to require performance by the other party of any provision of this Agreement shall in no way affect the right of such party to require performance of that provision. Any waiver by either party of any breach of this Agreement shall not be construed as a waiver of any continuing or succeeding breach of such provision, a waiver of the provision itself or a waiver of any right under this Agreement.
h. No Third Party Beneficiaries. This Agreement is not intended to confer, nor shall any provision hereof be interpreted to confer, upon any person other than the parties and the respective successors or permitted assigns of the parties, any rights, remedies, obligations, or liabilities whatsoever.
i. Interpretation. The division of this Agreement into articles, sections, and subsections and the use of captions and headings in connection therewith are solely for convenience and shall have no legal effect in construing the provisions of this Agreement. Unless otherwise indicated, references to articles, sections, subsections, and paragraphs are to provisions of this Agreement and references to exhibits and schedules are to exhibits and schedules appended to this Agreement. Unless the context otherwise requires, (i) references to any party to this Agreement include references to such party’s successors and permitted assigns, (ii) references to “person” include references to any individual, corporation, limited liability company, partnership, company, firm, association, joint venture, trust, governmental body, or other entity, (iii) any of the terms defined herein may be used in the singular or the plural depending on the reference, (iv) a masculine, feminine, or neuter pronoun includes the other genders as appropriate in the context, and (v) the term “including” means “including without limitation” unless otherwise expressly indicated in a given instance.
j. Survival. The covenants herein concerning indemnification and any other provision that, by its nature, is intended to survive this Agreement shall survive any termination or expiration of this Agreement.
k. Successors and Assigns. This Agreement will be binding upon and inure to the benefit of the parties and their successors and assigns permitted by this Agreement.
EXHIBIT A
Business Associate Addendum
THIS BUSINESS ASSOCIATE ADDENDUM (the “Addendum”) supplements and is made a part of the Referring Practice Terms of Service between Glidian and Referring Practice (the “Agreement”).
Referring Practice is a Covered Entity (or is a Business Associate to one or more Covered Entities) pursuant to HIPAA. Referring Practice has engaged Glidian to perform the Services pursuant to the Agreement. In the course of providing the Services, Referring Practice may make available to Glidian or have Glidian obtain or create on its behalf information that may be deemed Protected Health Information subject to the provisions of HIPAA and information subject to protection under other federal or state laws.
In order to comply with the applicable provisions of HIPAA and other federal or state laws as applicable, the parties agree as follows:
1. Definitions.
1. Capitalized terms used but not otherwise defined in this Addendum shall have the meanings ascribed in HIPAA (whether or not such terms are capitalized therein) or in the Agreement, as the case may be.
2. “Electronic PHI” means PHI that is Electronic Protected Health Information.
3. “PHI” means Protected Health Information received or accessed by Glidian from or on behalf of Referring Practice or created, transmitted, or maintained by Glidian for or on behalf of Referring Practice.
2. Permitted Uses. Glidian may use PHI only as permitted or required by this Addendum and only for the following purposes: (i) as necessary to perform the Services; (ii) to provide Data Aggregation services relating to the Health Care Operations of Referring Practice, but only incident to the performance of the Services; (iii) to de-identify PHI in accordance with the standards set forth under HIPAA, but only incident to the performance of the Services; (iv) to carry out its legal responsibilities; (v) for the proper business management and administration of Glidian; and (v) as Required By Law.
3. Permitted Disclosures. Glidian may disclose PHI only as permitted or required by this Addendum for the following purposes: (i) as necessary to perform the Services; (ii) for the proper business management and administration of Glidian or to carry out its legal responsibilities, if Required By Law or if Glidian has obtained reasonable assurances that the recipient will (A) hold such PHI in confidence, (B) use or further disclose it only for the purpose for which it was received or as Required By Law, and (C) notify Glidian of any instance of which the recipient becomes aware in which the confidentiality of such PHI has been breached; and (iii) as otherwise Required By Law.
4. Prohibited Uses and Disclosures. Subject to Referring Practice’s compliance with its obligations set forth in Section 16 as applicable, Glidian shall not use or further disclose PHI in a manner that would violate HIPAA if done by Referring Practice. If Referring Practice notifies Glidian that Referring Practice has agreed to be bound by additional restrictions on the uses or disclosures of PHI pursuant to Section 16, Glidian shall be bound by such additional restrictions and shall not use or disclose PHI in violation of such additional restrictions. Glidian shall not sell PHI or otherwise receive remuneration, directly or indirectly, in exchange for PHI. Glidian shall not use or disclose PHI for purposes of marketing or fundraising.
5. Subcontractors and Agents. Any disclosure to a Subcontractor of Glidian shall be pursuant to a written agreement between Glidian and such Subcontractor containing substantially the same restrictions and conditions on the use, disclosure, and safeguarding of PHI as are set forth in this Addendum.
6. Minimum Necessary. Glidian shall request, access, use, and disclose only the minimum amount of PHI necessary, in accordance with HIPAA, to perform the Services.
7. Certain Privacy Rule Compliance. To the extent that Glidian is to carry out one or more of Referring Practice's obligations under Subpart E of Part 164 of HIPAA (generally known as the HIPAA Privacy Rule), Glidian shall comply with such requirements that apply to Referring Practice in the performance of such obligations.
8. Safeguards. Glidian at all times shall maintain administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, availability, and integrity of Electronic PHI that it creates, receives, maintains, or transmits in accordance with the regulations set forth at 45 CFR § 164.308, 45 CFR § 164.310, and 45 CFR § 164.312 and shall maintain policies and procedures and other documentation in accordance the regulations set forth at 45 CFR § 164.316. Glidian acknowledges that such provisions apply to Glidian in the same manner that they apply to Covered Entities.
9. Breach Investigation and Reporting.
1. As soon as practicable following any actual or reasonably suspected impermissible use or disclosure of PHI, Glidian shall assess whether such actual or suspected impermissible use or disclosure was of PHI that is Unsecured Protected Health Information and, if so (or if Glidian cannot determine reasonably conclusively to the contrary), Glidian shall make an evaluation of whether there is a low probability that the PHI has been compromised. In making such evaluation, Glidian shall conduct a risk assessment that considers, at a minimum, (i) the nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re identification, (ii) the unauthorized person who used the protected health information or to whom the disclosure was made, (iii) whether the protected health information was actually acquired or viewed, and (iv) the extent to which the risk to the protected health information has been mitigated, and Glidian shall evaluate the overall possibility that the PHI has been compromised by considering all of the above, and any other relevant factors, in combination.
2. If pursuant to the evaluation described in Section 9.1 Glidian determines that such impermissible use or disclosure constitutes a Breach of PHI that is Unsecured Protected Health Information, Glidian shall provide Referring Practice in writing, without unreasonable delay but in no case later than 10 days following such determination, written notice setting forth the date of discovery thereof, the identities of affected individuals (or, if such identities are unknown at that time, the classes of such individuals), a general description of the nature of the incident, and such other information as is required pursuant to HIPAA or reasonably requested by Referring Practice. Glidian shall supplement such notice with information not available at the time of the initial notification as promptly thereafter as the information becomes available to Glidian.
3. If pursuant to the evaluation described in Section 9.1 Glidian determines that such impermissible use or disclosure does not constitute a Breach of PHI that is Unsecured Protected Health Information, Glidian shall notify Referring Practice in writing of such impermissible use or disclosure of PHI and of such determination promptly following such determination.
4. For purposes hereof, an actual or suspected use or disclosure shall be deemed impermissible if it is not or would not be permitted by this Agreement or if it is or would be in violation of HIPAA.
5. For purposes hereof, an impermissible use or disclosure shall be deemed discovered by Glidian as of the first day on which such impermissible use or disclosure is known to Glidian or, by exercising reasonable diligence, would have been known to Glidian, and Glidian shall be deemed to have knowledge of an impermissible use or disclosure if such impermissible use or disclosure is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the impermissible use or disclosure, who is a workforce member of Glidian or an agent of Glidian (determined in accordance with the federal common law of agency).
10. Security Incident Reporting. Glidian shall report to Referring Practice in writing any Security Incident involving Electronic PHI, other than a Security Incident that involves an actual or suspected impermissible use or disclosure of PHI, within 30 days of Glidian’s discovery thereof. The parties acknowledge and agree that this section constitutes notice by Glidian to Referring Practice of the ongoing occurrence of events that may constitute Security Incidents but that are trivial, routine, do not constitute a material threat to the security of PHI, and do not result in unauthorized access to or use or disclosure of PHI (such as typical pings and port scans), for which no additional notice to Referring Practice shall be required.
11. Mitigation. Glidian shall take all actions reasonably necessary and shall cooperate with Referring Practice as reasonably requested to mitigate, to the extent practicable, any harmful effect of any use or disclosure of PHI in violation of the terms and conditions of this Addendum or of any applicable law.
12. Access and Amendment. With respect to an Individual as to whom Glidian maintains PHI, Glidian shall notify Referring Practice promptly upon receipt of a request from such an Individual for access to or a copy of such Individual’s PHI or to amend such Individual’s PHI. To the extent permitted under HIPAA, and except as otherwise required upon the order of a court of competent jurisdiction, (i) Glidian shall direct such Individual to make such request of Referring Practice and (ii) Glidian shall not consent to such access, deliver such copy, or comply with such request except as directed by Referring Practice. With respect to PHI maintained by Glidian in a Designated Record Set, to the extent required by HIPAA, Glidian shall (i) make available PHI to Individuals or Referring Practice, as reasonably requested by Referring Practice and in accordance with HIPAA and (ii) upon receipt of notice from Referring Practice, promptly amend any portion of the PHI so that Referring Practice may meet its amendment obligations under HIPAA.
13. Accounting for Disclosures. Glidian shall document all disclosures of PHI by Glidian and information related to such disclosures as would be required for Referring Practice to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with HIPAA. Glidian shall maintain such information for the applicable period set forth in HIPAA. Glidian shall deliver such information to Referring Practice or, upon Referring Practice’s request, to the Individual, in the time and manner reasonably designated by Referring Practice, in order for Referring Practice to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with HIPAA. The obligations set forth in this section shall survive the expiration or any termination of this Agreement and shall continue, as to a given instance of a disclosure, until the earlier of (i) the passing of the time required for such information to be maintained pursuant to HIPAA or (ii) the delivery to Referring Practice of all such information in a form and medium reasonably satisfactory to Referring Practice and the return or destruction of all PHI as provided in this Agreement.
14. Audit. If Glidian receives a request, made on behalf of the Secretary of the Department of Health and Human Services, that Glidian make its internal practices, books, and records relating to the use or disclosure of PHI available to the Secretary of the Department of Health and Human Services for the purposes of determining Referring Practice’s or Glidian’s compliance with HIPAA, Glidian promptly shall notify Referring Practice of such request and, unless enjoined from doing so by order of a court of competent jurisdiction in response to a challenge raised by Referring Practice or Glidian (which challenge Glidian shall not be obligated to raise), Glidian shall comply with such request to the extent required of it by applicable law. Nothing in this Agreement shall waive any attorney-client privilege or other privilege applicable to either party.
15. Compliance with Law. Glidian shall comply with all applicable federal and state laws regarding individually identifiable information contained in or associated with PHI, including without limitation any state data breach laws or other state laws regarding the protection of such information. Nothing in this Agreement shall be construed to require Glidian to use or disclose PHI without a written authorization from an Individual who is the subject thereof, or written authorization from any other person, where such authorization would be required under federal or state law for such use or disclosure.
16. Obligations of Referring Practice. Referring Practice shall (i) notify Glidian of any limitation in Referring Practice’s Notice of Privacy Practices to the extent that such limitation may affect Glidian's use or disclosure of PHI, (ii) notify Glidian of any changes in, or revocation of, permission by an Individual to use or disclose PHI, to the extent that such change may affect Glidian’s use or disclosure of PHI, (iii) notify Glidian of any restriction on the use or disclosure of PHI to which Referring Practice has agreed in accordance with HIPAA, to the extent that such restriction may affect Glidian's use or disclosure of PHI, and (iv) obtain any authorization or consents as may be Required by Law for any of the uses or disclosures of PHI necessary for Glidian to provide to the Services.
17. Term and Termination. This Addendum shall become effective on the Effective Date and shall continue in effect until the earlier to occur of (i) the expiration or termination of all Agreements or (ii) termination pursuant to this section. Either party may terminate this Addendum effective immediately if the other party has breached a material provision of this Addendum and failed to cure such breach within 30 days of being notified by the other party of the breach. If the non-breaching party reasonably determines that cure is not possible, such party may terminate this Addendum effective immediately upon written notice to other party.
18. Effect of Termination. Upon termination of this Addendum, subject to any applicable provisions of the Agreement, Glidian shall return to Referring Practice or destroy all PHI that Glidian maintains in any form and retain no copies of such PHI or, if return or destruction is not feasible (including without limitation if Glidian is required by applicable law to retain any such PHI for a time following termination), notify Referring Practice thereof and extend the protections of this Addendum to the PHI and limit its further use or disclosure to those purposes that make the return or destruction of the PHI infeasible. The requirements of this section shall survive termination or expiration of this Addendum and shall be in force as long as any PHI remains in the custody or control of Glidian.
19. Miscellaneous.
1. Amendments. Any provision of the Agreement to the contrary notwithstanding, upon the enactment of any law or regulation affecting the use or disclosure of PHI, or on the publication of any decision of a court of competent jurisdiction relating to any such law, or the publication of any interpretive policy or opinion of any governmental agency charged with the enforcement of any such law or regulation, Referring Practice may, by written notice to Glidian, propose to amend this Addendum in such a manner as Referring Practice reasonably determines necessary to comply therewith, and such proposed amendment shall become operative unless Glidian rejects such amendment by written notice to Referring Practice within 30 days thereafter, in which case, unless the parties agree on an amendment within 30 days after Glidian’s notice, either party may terminate this Addendum by written notice to the other.
2. Notice. Written notice pursuant to Section 9 or Section 10 sent with next-business-day instruction by recognized overnight document delivery service to the address provided herein shall be deemed given upon deposit with such overnight delivery service.
3. Interpretation. In the event of a conflict between the provisions of this Addendum and any other provisions of the Agreement, the provisions of this Addendum shall control. In the event of an inconsistency between the provisions of this Addendum and mandatory provisions of HIPAA, as amended, or its interpretation by any court or regulatory agency with authority over either party hereto, HIPAA (interpreted by such court or agency, if applicable) shall control. Where provisions of this Addendum are different from those mandated under HIPAA, but are nonetheless permitted by such rules as interpreted by relevant courts or agencies, the provisions of this Addendum shall control.