Last Updated April 7, 2021
This HIPAA Business Associate Agreement (the “Agreement”) is made and entered between Verkada, Inc., a Delaware corporation (“Business Associate”) and you, the party who accepted this Agreement (“Covered Entity”) whether by clicking a box indicating acceptance, navigating through a login page where a link to this Agreement is provided, or providing another form of electronic acceptance.
This Agreement is effective between Verkada and the Covered Entity as of the date that Covered Entity accepts the terms of this Agreement as indicated above (the “Effective Date”). Verkada reserves the right to modify or update the terms of this Agreement in its discretion, the effective date of which will be the earlier of (i) 30 days from the date of such update or modification and (ii) to Covered Entity’s continued participation in Verkada’s programs.
Covered Entity is or may be subject to the requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (“HITECH”) and the implementing regulations thereof (the “HIPAA Regulations”). As used herein, “PHI” refers to Protected Health Information maintained, transmitted, created or received by Business Associate for or from Covered Entity.
Business Associate may maintain, transmit create or receive data for or from Covered Entity that constitutes Protected Health Information (as defined in the HIPAA Regulations) to perform tasks on behalf of Covered Entity;
To the extent required by the HIPAA Regulations and applicable state law, Business Associate is or may be directly subject to certain privacy and security obligations and penalty provisions of HIPAA, HITECH, the HIPAA Regulations and state law.
The parties agree as follows:
Use and Disclosure. Business Associate may use and disclose PHI only as permitted or required by this Agreement or as required by law. Business Associate may use or disclose PHI as required to perform its obligations under any underlying service agreements or end user agreements entered into between the parties in connection with Covered Entity’s purchase of goods and/or services from Business Associate (collectively, “Service Agreement”) between the parties to perform the services as described in the Service Agreement (“Services”), provided that Business Associate shall not use or disclose PHI in any manner that would constitute a violation of the HIPAA Regulations if done by Covered Entity. The Services are not intended to be used as part of any life-saving or emergency systems, and Covered Entity will not use the Services in any such environment. Further, Covered Entity will not manually label, tag, or otherwise associate any PHI with Business Associate’s hardware products by means of the Services. To the extent Covered Entity notifies Business Associate of a reasonable restriction request granted by Covered Entity that would limit Business Associate’s use or disclosure of PHI, Business Associate will use its commercially reasonable efforts to comply with the restriction. To the extent Business Associate is to carry out an obligation of Covered Entity under the HIPAA Regulations, Business Associate shall comply with the requirements of the HIPAA Regulations that apply to Covered Entity in the performance of such obligation.
Appropriate Safeguards. Business Associate agrees to maintain reasonable and appropriate administrative, technical and physical safeguards to protect PHI from uses or disclosures not permitted by this Agreement, including maintaining policies and procedures to detect, prevent or mitigate identity theft based on PHI or information derived from PHI. In addition, Business Associate agrees to comply with the applicable requirements of the HIPAA Regulations with respect to electronic PHI and any guidance issued by the Secretary of the Department of Health and Human Services (“HHS”).
Incident Notification. To the extent Business Associate becomes aware of or discovers (i) any use or disclosure of PHI in violation of this Agreement, (ii) any Security Incident, or (iii) any Breach of Unsecured Protected Health Information (each as defined in the HIPAA Regulations) related to any individual who is the subject of PHI, Business Associate shall promptly report such use, disclosure, incident, or breach to Covered Entity and shall include the information specified in the HIPAA Regulations. Business Associate shall mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure of PHI by Business Associate not permitted by this Agreement.
Subcontractors. In accordance with the HIPAA Regulations, Business Associate shall ensure that each subcontractor or agent that handles PHI on behalf of Business Associate agrees in writing to be bound by the same restrictions, terms and conditions that apply to Business Associate pursuant to this Agreement.
Access to Designated Record Sets. Within fifteen (15) days of a request by Covered Entity for access to PHI about an individual contained in a Designated Record Set (as defined at the HIPAA Regulations), Business Associate shall make available to Covered Entity such PHI in the form requested by Covered Entity. If the requested PHI is maintained electronically, Business Associate shall provide a copy of the PHI in the electronic form and format requested by the individual, if it is readily producible, or, if not, in a readable electronic form and format as agreed to by Covered Entity and the individual. In the event that any individual requests access to PHI directly from Business Associate, Business Associate shall within ten (10) days forward such request to Covered Entity. Any denials of access to the PHI requested shall be the responsibility of Covered Entity.
Amendments to Designated Record Sets. Within fifteen (15) days of receipt of a request from Covered Entity for the amendment of an individual’s PHI contained in a Designated Record Set (for so long as the PHI is maintained in the Designated Record Set), Business Associate shall provide such information to Covered Entity for amendment and incorporate any such amendments in the PHI. In the event a request for an amendment is delivered directly to Business Associate, Business Associate shall within ten (10) days of receiving such request forward the request to Covered Entity.
Access to Books and Records. Except for disclosures of PHI by Business Associate that are excluded from the accounting obligation as set forth in the HIPAA Regulations or regulations issued pursuant to HITECH, Business Associate shall record for each disclosure the information required to be recorded by covered entities pursuant to the HIPAA Regulations. Within twenty (20) days of notice by Covered Entity to Business Associate that it has received a request for an accounting of disclosures of PHI, Business Associate shall make available to Covered Entity, or the individual (if requested by Covered Entity), the information required to be maintained pursuant to this Section 7. In the event the request for an accounting is delivered directly to Business Associate, Business Associate shall within ten (10) days forward such request to Covered Entity.
Accountings. At Covered Entity’s or HHS’ request, Business Associate shall make its internal practices, books and records relating to the use and disclosure of PHI available to HHS for purposes of determining compliance with the HIPAA Regulations.
Permitted Uses and Disclosures. Business Associate is not authorized to use or disclose PHI in a manner that would violate the HIPAA Regulations if done by Covered Entity, provided that Business Associate may:
use the PHI for its proper management and administration and to carry out its legal responsibilities.
disclose PHI for its proper management and administration and to carry out its legal responsibilities, provided that disclosures do not violate the HIPAA Regulations.
use and disclose PHI to report violations of law to appropriate Federal and State authorities.
aggregate the PHI in its possession with the Protected Health Information of other covered entities that Business Associate has in its possession through its capacity as a business associate to other covered entities, provided that such aggregation conforms to the requirements of the HIPAA Regulations.
use PHI to create de-identified information, and use such de-identified information for its own purposes, provided that the de-identification and use thereof conforms to the requirements of the HIPAA Regulations.
HIPAA Transaction Standards. If Business Associate conducts standard transactions (as defined in the HIPAA Regulations) for or on behalf of Covered Entity, Business Associate will comply and will require by written contract each agent or contractor (including any subcontractor) involved with the conduct of such standard transactions to comply, with each applicable requirement of the HIPAA Regulations. Business Associate will not enter into, or permit its agents or contractors (including subcontractors) to enter into, any trading partner agreement in connection with the conduct of standard transactions for or on behalf of Covered Entity that: (i) changes the definition, data condition, or use of a data element or segment in a standard transaction; (ii) adds any data elements or segments to the maximum defined data set; (iii) uses any code or data element that is marked “not used” in the standard transaction’s implementation specification or is not in the standard transaction’s implementation specification; or (iv) changes the meaning or intent of the standard transaction’s implementation specification. Business Associate agrees to participate in any test modification conducted by Covered Entity in accordance with the HIPAA Regulations.
Term and Termination. This Agreement shall remain in effect until the Service Agreement is terminated or expires. Either party may terminate this Agreement and the Service Agreement effective immediately if it determines that the other party has breached a material provision of this Agreement and failed to cure such breach within thirty (30) days of being notified by the other party of the breach. If the non-breaching party determines that cure is not possible, such party may terminate this Agreement and the Service Agreement effective immediately upon written notice to other party.
Limitation of Liability. Business Associate’s obligations under this Agreement shall be subject to any limitations of liability set forth in the Service Agreement.
Effect of Termination. Upon termination of this Agreement, Business Associate agrees to either return or destroy, at no cost to Covered Entity, all PHI that Business Associate still maintains in any form. Notwithstanding the foregoing, to the extent that it is not feasible to return or destroy such PHI, the terms and provisions of this Agreement shall survive termination of this Agreement, and Business Associate shall only use or disclose such PHI solely for such purpose or purposes which prevented the return or destruction of such PHI.
Miscellaneous. Business Associate’s liability under this Agreement shall be subject to any limitations of liability set forth in any master service or end user agreement entered into between the parties in connection with Covered Entity’s purchase of goods and/or services from Business Associate. Nothing in this Agreement shall be construed to create any rights or remedies in any third parties or any agency relationship between the parties. To the extent Business Associate is acting as a business associate under the HIPAA Regulations, Business Associate shall be subject to the penalty provisions specified in HITECH. Upon the effective date of any final regulation or amendment to final regulations promulgated by HHS with respect to PHI, this Agreement will be deemed to be automatically amended such that the obligations imposed on the parties remain in compliance with such regulations. The terms and conditions of this Agreement shall override and control any conflicting term or condition of any agreement between the parties with respect to the Services Agreement.