Business Associate Agreement

DRAFT: for review by counsel before first use

CONDITIONAL AGREEMENT. This Business Associate Agreement ("BAA") becomes effective only if and when an engagement requires Consultant to create, receive, maintain, or transmit Protected Health Information ("PHI") on behalf of Client. Model Ortho's engagements are designed to operate on operational, de-identified, and aggregate data without PHI, and the Parties' standard data approach is set out in the separate Data Handling Plan. This BAA is executed in advance so that, should PHI ever become necessary for a specific engagement, the obligations attach immediately with no delay.

This BAA is entered into by and between:

__________ (the "Covered Entity"), and

Freedom in Honesty LLC, doing business as Model Ortho (the "Business Associate").

Effective Date: ________

The Parties agree as follows:

1. Definitions

Capitalized terms have the meaning given in the HIPAA Rules (45 C.F.R. Parts 160 and 164), including "Protected Health Information," "PHI," "Use," "Disclosure," "Individual," "Required by Law," and "Security Incident."

2. Permitted Uses and Disclosures of PHI

2.1 Business Associate may use or disclose PHI only to perform its obligations for Covered Entity as described in the applicable Statement of Work, and only as permitted by this BAA and applicable law.

2.2 Business Associate may use PHI for its own management and administration, and to carry out its legal responsibilities, as permitted by the HIPAA Rules.

3. Safeguards

Business Associate will use appropriate administrative, physical, and technical safeguards to prevent use or disclosure of PHI other than as permitted by this BAA, consistent with the HIPAA Security Rule.

4. Reporting

4.1 Business Associate will report to Covered Entity any use or disclosure of PHI not permitted by this BAA, any Security Incident, and any breach of Unsecured PHI, without unreasonable delay and in no event later than the time required by applicable law.

4.2 Business Associate will report to Covered Entity any successful security incident of which it becomes aware, and will reasonably cooperate in Covered Entity's breach notification and risk-assessment obligations.

5. Subcontractors

Business Associate will ensure that any subcontractor or agent that receives, creates, maintains, or transmits PHI on behalf of Business Associate agrees in writing to the same restrictions, conditions, and requirements that apply to Business Associate under this BAA with respect to PHI.

6. Individual Rights

6.1 Business Associate will make available PHI in a Designated Record Set to Covered Entity (or to an Individual or the Individual's designee, as directed by Covered Entity) to enable Covered Entity to meet its access obligations.

6.2 Business Associate will make PHI available for amendment and will provide an accounting of disclosures as required to enable Covered Entity to meet its obligations under the HIPAA Privacy Rule.

6.3 Business Associate will honor any restrictions on use or disclosure to which Covered Entity has agreed, to the extent the HIPAA Rules require.

7. Books and Records

Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining Covered Entity's compliance with the HIPAA Rules.

8. Minimum Necessary

Business Associate will use, disclose, and request only the minimum necessary PHI to accomplish the intended purpose of the use, disclosure, or request.

9. Termination

9.1 This BAA terminates when all PHI is returned or destroyed, or upon termination of the underlying Agreement, whichever is later.

9.2 Upon termination, Business Associate will return or destroy all PHI in its possession, if feasible. If return or destruction is not feasible, Business Associate will extend the protections of this BAA to the retained PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as the PHI is retained.

9.3 If Covered Entity determines that Business Associate has breached a material term of this BAA, Covered Entity may terminate the underlying Agreement on written notice.

10. Mitigation

Business Associate will reasonably mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure of PHI in violation of this BAA.

11. Interpretation

Any ambiguity in this BAA will be interpreted to permit compliance with the HIPAA Rules.

IN WITNESS WHEREOF, the Parties have executed this BAA as of the Effective Date.

Freedom in Honesty LLC (Model Ortho)

By: ____ Name: Anita K. Brown Title: Principal Date: __

Covered Entity

By: ______ Name: _____ Title: ____ Date: _______