Business Associate Agreement

This Business Associate Agreement (this "BAA") is part of the agreement between HealthRide NEMT, LLC ("HealthRide," "we," or "us") and the organization that uses HealthRide's software and services ("Customer" or "you"). It is the "BAA" referred to in the HealthRide Terms & Conditions at healthride.app/terms (the "Terms"). It is provided to meet the requirements of the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act, and the regulations under both, including 45 C.F.R. Parts 160 and 164 (together, "HIPAA").

You accept this BAA by clicking "I agree" when you set up your HealthRide account, by signing an order form or a copy of this BAA, or by using the Services to create, receive, maintain, or transmit Protected Health Information. Accepting electronically has the same effect as signing. The person who accepts confirms that they are authorized to bind Customer.

Customer may be a covered entity under HIPAA, or a business associate of a covered entity (for example, a transportation company that serves a Medicaid transportation broker). Where Customer is a business associate, HealthRide acts as Customer's subcontractor, and references in this BAA to Customer's obligations apply to the extent Customer has those obligations as a business associate.

1. Definitions

Capitalized terms used but not defined in this BAA have the meanings given to them in HIPAA, including Breach, Designated Record Set, Health Care Operations, Individual, Required by Law, Security Incident, Subcontractor, and Unsecured Protected Health Information. In addition:

• "Protected Health Information" or "PHI" has the meaning given in 45 C.F.R. 160.103, limited to information that HealthRide creates, receives, maintains, or transmits for or on behalf of Customer through the Services.
• "Secretary" means the Secretary of the U.S. Department of Health and Human Services.
• "Services" means the HealthRide software and related services that HealthRide provides to Customer.
• "Service Agreement" means the Terms, any order form, and any other agreement under which HealthRide provides the Services to Customer.

2. How HealthRide May Use and Disclose PHI

2.1 Providing the Services

HealthRide may use and disclose PHI only as needed to provide the Services under the Service Agreement, as permitted by this BAA, or as Required by Law. HealthRide will not use or disclose PHI in a way that would violate Subpart E of 45 C.F.R. Part 164 if done by Customer, except as allowed in Sections 2.2 through 2.4.

2.2 Management and Administration

HealthRide may use PHI for its proper management and administration and to carry out its legal responsibilities. HealthRide may disclose PHI for these purposes if the disclosure is Required by Law, or if HealthRide obtains reasonable assurances from the recipient that it will hold the PHI confidentially, use or further disclose it only as Required by Law or for the purpose for which it was disclosed, and notify HealthRide of any instance it is aware of in which the confidentiality of the PHI has been breached.

2.3 Data Aggregation

HealthRide may use PHI to provide data aggregation services relating to the Health Care Operations of Customer, as permitted by 45 C.F.R. 164.504(e)(2)(i)(B).

2.4 De-identified Information

HealthRide may de-identify PHI in accordance with 45 C.F.R. 164.514(a) and (b). Information that has been de-identified is no longer PHI and is not subject to this BAA.

2.5 Minimum Necessary

HealthRide will limit its uses and disclosures of, and requests for, PHI to the minimum necessary to accomplish the intended purpose, as required by HIPAA.

2.6 Ownership

As between HealthRide and Customer, Customer owns the PHI.

2.7 Customer Obligations Carried Out by HealthRide

To the extent HealthRide carries out any of Customer's obligations under Subpart E of 45 C.F.R. Part 164, HealthRide will comply with the requirements of Subpart E that apply to Customer in performing that obligation.

3. Safeguards

HealthRide will use appropriate administrative, physical, and technical safeguards, consistent with the size and complexity of its operations, to prevent the use or disclosure of PHI other than as provided by this BAA. HealthRide will comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI.

4. Reporting

4.1 Breaches of Unsecured PHI

HealthRide will report to Customer any Breach of Unsecured PHI without unreasonable delay, and in no case later than ten (10) business days after discovery, as required by 45 C.F.R. 164.410. The report will include, to the extent available, the identification of each Individual whose Unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed, and the other information Customer needs to notify Individuals under 45 C.F.R. 164.404(c). HealthRide will supplement its report as more information becomes available.

4.2 Other Improper Uses or Disclosures

HealthRide will report to Customer any use or disclosure of PHI not provided for by this BAA that is not a Breach within ten (10) business days after becoming aware of it.

4.3 Security Incidents

HealthRide will report to Customer any successful Security Incident within ten (10) business days after becoming aware of it. The parties agree that this Section 4.3 is notice, and no further notice is required, of unsuccessful Security Incidents that happen in the normal course of operating an online service, such as pings and other broadcast attacks on firewalls, port scans, unsuccessful log-in attempts, and denial-of-service attacks, as long as they do not result in unauthorized access to, or use or disclosure of, PHI.

4.4 Response and Mitigation

HealthRide will respond to any Breach, Security Incident, or other use or disclosure of PHI in violation of this BAA, will mitigate any harmful effect known to HealthRide to the extent practicable, and will document the outcome. On request, HealthRide will give Customer documentation of any Breach of Unsecured PHI or successful Security Incident that affects Customer's PHI.

4.5 How Reports Are Made

Reports under this Section 4 will be sent as described in Section 10.6.

5. Subcontractors

In accordance with 45 C.F.R. 164.502(e)(1)(ii) and 164.308(b)(2), HealthRide will ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of HealthRide agrees in writing to the same restrictions, conditions, and requirements that apply to HealthRide under this BAA with respect to that PHI.

6. Individuals' Rights

6.1 Access

To the extent HealthRide maintains PHI in a Designated Record Set, HealthRide will make that PHI available to Customer within ten (10) business days after Customer's written request, so that Customer can meet its obligations under 45 C.F.R. 164.524, including in electronic form where the PHI is held electronically.

6.2 Amendment

To the extent HealthRide maintains PHI in a Designated Record Set, HealthRide will, within ten (10) business days after Customer's written request, make that PHI available for amendment and incorporate any amendments Customer directs under 45 C.F.R. 164.526.

6.3 Accounting of Disclosures

HealthRide will document the disclosures of PHI that Customer would need to account for under 45 C.F.R. 164.528. Within ten (10) business days after Customer's written request, HealthRide will give Customer the information it needs to provide an accounting: the date of each disclosure, the name and, if known, the address of the recipient, a brief description of the PHI disclosed, and the purpose of the disclosure.

6.4 Requests Made Directly to HealthRide

If an Individual asks HealthRide directly for access to, amendment of, or an accounting of disclosures of PHI, HealthRide will forward the request to Customer within five (5) business days. Customer decides whether to grant or deny any request and is responsible for responding to the Individual.

6.5 Self-Service

Customer can view, update, and export the rider information it keeps in the Services, and may use those features to respond to requests directly.

7. Access by the Secretary

HealthRide will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining compliance with HIPAA.

8. Customer Responsibilities

8.1 Notices and Restrictions

Customer will tell HealthRide about (a) any limitation in Customer's notice of privacy practices under 45 C.F.R. 164.520, (b) any change in, or revocation of, an Individual's permission to use or disclose PHI, and (c) any restriction on the use or disclosure of PHI that Customer has agreed to under 45 C.F.R. 164.522, in each case to the extent it may affect HealthRide's use or disclosure of PHI.

8.2 Permissible Requests

Customer will not ask HealthRide to use or disclose PHI in any way that would not be permitted under HIPAA if done by Customer, except as allowed in Sections 2.2 through 2.4.

8.3 What Customer Puts Into the Services

Customer will put into the Services only the PHI needed to arrange, provide, and bill for transportation. Customer is responsible for obtaining any consents, authorizations, and notices required for the PHI it enters and for the messages it chooses to send to riders through the Services.

8.4 Customer's Users and Settings

Customer decides who in its organization, and which drivers, facilities, payers, and other people it invites, can see PHI in the Services, and which features it turns on, such as rider text and email updates and trip tracking links. Customer is responsible for those choices and for promptly removing access for anyone who should no longer have it.

9. Term and Termination

9.1 Term

This BAA takes effect on the earlier of the date Customer accepts it and the date HealthRide first creates, receives, maintains, or transmits PHI for Customer. It ends when the Service Agreement ends and all PHI has been returned, destroyed, or protected as described in Section 9.3.

9.2 Termination for Breach

If either party knows of a material breach of this BAA by the other party, it will give the other party written notice and an opportunity to cure. If the breach is not cured within twenty (20) business days after the notice is received, the non-breaching party may terminate this BAA and the parts of the Service Agreement affected by the breach. If a cure is not possible, the non-breaching party may terminate them immediately.

9.3 Return or Destruction of PHI

When the Service Agreement ends, Customer may export its data during the period described in the Terms. After that period, HealthRide will destroy the PHI that it and its Subcontractors maintain for Customer and will keep no copies, except where HealthRide determines that return or destruction is not feasible, for example PHI held in backups until they are replaced on their normal schedule, or records HealthRide must keep by law. For any PHI it keeps, HealthRide will extend the protections of this BAA and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as it keeps the PHI.

9.4 Survival

Section 9.3 survives the end of this BAA.

10. General Terms

10.1 Changes in the Law

If HIPAA changes in a way that requires changes to this BAA, the parties will amend this BAA as needed to comply. HealthRide may make those changes by posting an updated version of this BAA and notifying Customer.

10.2 Interpretation

Any ambiguity in this BAA will be resolved to permit compliance with HIPAA. A reference to a regulation means that regulation as amended and in effect.

10.3 Conflicts

If this BAA conflicts with any other part of the Service Agreement with respect to PHI, this BAA controls.

10.4 Relationship to the Terms

This BAA is part of the Service Agreement. The limitations and exclusions of liability in the Terms apply to all claims arising out of or relating to this BAA.

10.5 No Third-Party Beneficiaries

Nothing in this BAA gives any rights or remedies to anyone other than HealthRide and Customer.

10.6 Notices

Notices and reports under this BAA will be sent by email: to HealthRide at support@healthride.app, and to Customer at the email address of its account owner in the Services, or at another address Customer gives HealthRide in writing.

10.7 Governing Law

This BAA is governed by HIPAA and, to the extent not preempted by HIPAA, by the law that governs the Terms.

10.8 Severability

If any provision of this BAA is held invalid or unenforceable, the rest of this BAA remains in full effect.

10.9 Signed Copies

Customer may ask HealthRide for a copy of this BAA to sign. A signed copy has the same terms as this page unless both parties sign a written change.