ARBORMETRIX, INC. REGISTRY REPORTING AGREEMENT
DATA USE AND BUSINESS ASSOCIATE AGREEMENT
– IN COLLABORATION WITH
THE AMERICAN ACADEMY OF ALLERGY, ASTHMA & IMMUNOLOGY –
THIS REGISTRY REPORTING AGREEMENT (“Agreement’) and the DATA USE AND BUSINESS ASSOCIATE AGREEMENT attached as Exhibit A (the “DUA and BAA”) is made between ArborMetrix, Inc. (“ArborMetrix”), a Delaware corporation, and the entity or organization that registers electronically for ArborMetrix services under this Agreement (“Participant”). Participant’s clicking the “Accept” button or other on-line acceptance indicates Participant’s and ArborMetrix’ acknowledgement and agreement that this Agreement and DUA and BAA are legally binding and enforceable agreements between ArborMetrix and the Participant. This Agreement is effective as of the date of Participant’s acknowledgement of acceptance in accordance with the previous sentence.
WHEREAS, ArborMetrix will, in collaboration with the American Academy of Allergy, Asthma & Immunology (“AAAAI”), create and support a clinical data registry for the collection, analysis, and reporting of quality data; and
WHEREAS, the registry will facilitate the collection and submission of allergy, asthma, and immunology quality measures data to the Centers for Medicare and Medicaid Services (CMS) for one or more Quality Reporting Programs (as herein defined) for Participants who select that feature and submit appropriate data; and
NOW, THEREFORE, ArborMetrix and Participant agree as follows:
- Definitions. The following capitalized terms shall have the meanings set forth in this Section 1. Other capitalized terms shall have the meaning set forth in the sections defining such terms.a) “ArborMetrix Products” means the ArborMetrix Registry and all ArborMetrix software and services designed to allow ArborMetrix to collect and submit Quality Data to the registry on behalf of Participant and Participating Clinicians. The ArborMetrix Products shall include all ArborMetrix software, applications, web sites, support, legal and regulatory compliance updates, bug fixes and ongoing software maintenance, hosting, security, data maintenance and backup.b) “ArborMetrix Registry” means the clinical data registry established by ArborMetrix for AAAAI.c) “CMS” means the Centers for Medicare and Medicaid Services.d) “DUA and BAA” means the Data Use and Business Associate Agreement attached as Exhibit A.e) “Eligible Clinicians” means clinicians (MD/DO and DMD/DDS), physician assistants, nurse practitioners, clinical nurse specialists, certified registered nurse anesthetists and other persons or parties subsequently designated by CMS as eligible to participate in MIPS or another Quality Reporting Program.f) “PC Consent Form” means a Participating Clinician Consent Form for Quality Reporting in the form made available to Participant on-line during the registration process or otherwise provided to Participant in hard copy or electronic form.g) “Fees” means the fees payable for the use of the ArborMetrix Products and the ArborMetrix services as set forth in the form made available to Participant on-line during the registration process or otherwise provided to Participant in hard copy or electronic form.h) “Intellectual Property” means all intellectual property rights, including but not limited to all inventions, patents and patentable subject matter, copyrightable works, trade secrets and confidential information, trademarks, service marks, trade dress, logos, and trade names, improvements and derivative works, all goodwill associated therewith, and rights to protection of interests therein under the laws of all jurisdictions.i) “MIPS” means the Merit-Based Incentive Payment System established by CMS.j) “Participating Clinicians” means Eligible Clinicians and doctors, physicians, physician assistants, nurse practitioners, clinical nurse specialists, certified registered nurse anesthetists and other persons or parties whose Quality Data the Participant submits to ArborMetrix. k) “Reporting Year” means the calendar year or such other annual period as determined by CMS for participation and reporting under the applicable Quality Reporting Program. l) “QCDR” means a CMS approved Qualified Clinical Data Registry as defined by CMS. m) “Quality Reporting Program” means MIPS – Quality, Clinical Practice Improvement Activities (“CPIA”) and Advancing Care Information (“ACI”) or another applicable CMS Quality Reporting Program under which ArborMetrix will submit Quality Data to CMS pursuant to this Agreement. n) “Quality Data” means clinical quality related data and other data collected through the ArborMetrix Registry, including data for submission to CMS on behalf of Participant and Participating Clinicians in connection with a Quality Reporting Program.
- Subscription and Optional Quality Reporting Appointment.a) Participant hereby agrees to subscribe to the ArborMetrix Products and participate in the ArborMetrix Registry. ArborMetrix hereby grants to Participant a non-exclusive, non-transferable, non-assignable, license to access and use the ArborMetrix Products via the Internet for use in the activities under this Agreement and not for general public access or use. Participant agrees to limit access to the ArborMetrix Products to those Participating Clinicians, employees and consultants of Participant who have been issued a user identification and password to use the ArborMetrix Products.b) For Participant’s who elect to have ArborMetrix undertake CMS data submission and reporting Participant hereby grants ArborMetrix permission to submit Quality Data of Participant and Participating Clinicians in the ArborMetrix Registry to CMS for purposes of enabling each Participating Clinicians to quality for the payments or adjustments under the applicable CMS Quality Reporting Program. Participant and each Participating Clinician understands that such Quality Data will include quality measure results, the number of eligible instances applicable to the measure, the number of instances of quality services performed, and other information related to services the Participating Clinician has provided to all of the Participating Clinician’s patients with certain medical conditions. In submitting Quality Data to CMS, ArborMetrix will comply with all applicable laws and regulations relating to the applicable Quality Reporting Program. Participant and the Participating Clinicians acknowledge that one such requirements includes the public reporting of each Participating Clinician’s Quality Data in accordance with CMS guidelines.
- ArborMetrix Obligations. ArborMetrix shall:a) Provide Participant access to the ArborMetrix Products with available quality reporting options for each Reporting Year.b) Submit Participant and Participating Clinician Quality Data to CMS in accordance with CMS requirements and guidelines for the Quality Reporting Program(s) for which Participant is utilizing the services of ArborMetrix for data submission.
- Participant Obligations. Participant shall:a) Select a quality reporting option in the ArborMetrix Products for each Reporting Year under the Quality Reporting Program. Once a quality reporting option is selected for a Reporting Year, it may not be changed by Participant.b) Provide to ArborMetrix, a a PC Consent Form from each Participating Clinician whose Quality Data will be submitted by ArborMetrix to CMS consenting to such submission and agreeing to the terms of this Agreement; provide ArborMetrix a copy of each signed PC Consent form, and retain a copy of each signed PC Consent Form from a Participating Clinician in its records for a period of at least seven (7) years. Participant and each Participating Clinician agree that ArborMetrix may submit this Quality Measure Agreement and PC Consent Forms to CMS upon request to demonstrate compliance with CMS guidelines.c) Identify the number and name of Participant’s Participating Clinicians whose Quality Data will be submitted by ArborMetrix to CMS under this Agreement on the PC Consent Form and notify ArborMetrix of any additional Participating Clinicians who execute a PC Consent Form allowing ArborMetrix to submit Quality Data to CMS under this Agreement.d) Ensure that the Quality Data related to relevant measures is submitted in the form and by the dates specified by ArborMetrix to allow each of Participant’s Participating Clinicians to qualify for incentive payments or to avoid negative payment adjustments for the applicable Quality Reporting Program.e) Assume responsibility for the accuracy and content of the Quality Data used to determine whether the Participating Clinician meets the requirements for incentive payments or to avoid negative payment adjustments under the applicable Quality Reporting Program.f) Participant and each Participating Clinician agree, and Participant shall require each Participating Clinician, to review his or her measure results in the ArborMetrix Registry at least every 90 days or at the frequency recommended by CMS if greater, and provide timely feedback to ArborMetrix on the measures that will be reported to CMS on the Participating Clinician’s behalf.
- Additional Representations of Participant and Participating Clinicians. Participant and each Participating Clinician further agree as follows:a) Participant represents and warrants that it has the authority to enter into this Agreement and the DUA and BAA on behalf of the Participating Clinicians identified to ArborMetrix and to bind those Participating Clinicians to the terms of this Agreement and such Participating Clinicians have agreed to be bound. This holds true for any Participating Clinician whose Quality Data is submitted to and through ArborMetrix subsequent to the date of this Agreement.b) Participant and each Participating Clinician attest that all Quality Data being submitted to ArborMetrix on behalf of each Participating Clinician will be true and correct. Participant and the Participating Clinicians shall be solely responsible for the accuracy, quality, integrity and legality of the Quality Data and the manner the Participant or Participating Clinician acquired Quality Data and submitted the Quality Data to ArborMetrix pursuant to this Agreement.c) Participant and each Participating Clinician will comply in all respects with ArborMetrix data validation plan and requirements, which may include periodic audits by ArborMetrix or CMS, as required by CMS. Participant shall be responsible for all internal costs associated with any audit, including record retrieval, photocopying, mailing and other direct audit costs of Participant.d) Participant and each Participating Clinician acknowledges that failure to provide ArborMetrix with Quality Data within the time frame specified by ArborMetrix may result in ArborMetrix’s inability to submit Quality Data to CMS for the applicable Reporting Year and that Participant and Participating Clinicians will not be entitled to any refund for fees paid under this Agreement resulting from ArborMetrix inability to transfer Quality Data.e) Participant and each Participating Clinician agrees that ArborMetrix may make multiple submissions of Quality Data to CMS on their behalf related to each Quality Reporting Program for which ArborMetrix has agreed to submit Quality Data without the need for an additional Quality Reporting Participation Agreement or a separate PC Consent Form.f) Participant and each Participating Clinician acknowledges that the information submitted to ArborMetrix and on a PC Consent Form (including TIN, individual NPI number, phone number and email address) will be used by ArborMetrix for submitting Quality Data to CMS under the particular CMS reporting program option selected by Participant.g) Participant will immediately notify ArborMetrix of any changes in information related to this Agreement, including changes in Participating Clinicians or their contact information.h) Participant acknowledges that, subject to the DUA and BAA, ArborMetrix may share data received from Participant and Participating Clinicians in the form of a Limited Data Set (as defined in the DUA and BAA) with AAAAI for use by AAAAI for research purposes.
- Pricing and Payment.a) Participant shall pay the Fees for the use of the ArborMetrix Products in advance and prior to commencement of a Reporting Year. Fees for ArborMetrix Products are subject to adjustment for subsequent reporting years. ArborMetrix shall provide notice of Fees for subsequent reporting years at least ninety (90) days in advance of the commencement of such Reporting Year. Fees shall be paid for each Participating Clinician whose Quality Data is submitted to ArborMetrix. The initial name and number of Participating Clinicians for which Fees are payable are identified during electronic registration. Participant shall be responsible for the payment of fees for additional Participating Clinicians that execute a PC Consent form following execution of this Agreement. During the 4th quarter of the Reporting Period or within sixty (60) days after submission of Quality Data to CMS for the Reporting Period, ArborMetrix will reconcile the actual number of Participating Clinicians using ArborMetrix Products hereunder with the amount reported by Participant and Participant shall be liable for any shortfall in Fees payable.b) Unless another payment method is selected during electronic registration, all initial Fees are due thirty (30) days following execution of this Agreement. Fees for subsequent Reporting Years shall be invoiced in advance of the Reporting Year. Subsequent invoices are due and payable within thirty (30) days of Participant’s receipt of an invoice from ArborMetrix.c) All Fees are non-refundable unless the ArborMetrix Registry is not approved to submit Quality Data for the Quality Reporting Program to which such Fees relate, in which case such Fees shall be fully refundable.
- Term. The term of this Agreement (the “Term”) shall commence on the period commencing on the date of this Agreement and terminating ninety-five (95) days following the end of the last Reporting Year for which Fees have been paid. The Term shall automatically be extended for additional Reporting Years unless ArborMetrix or Participant have given written notice of termination at the later of (a) at least ninety (90) days prior to the start of the next Reporting Year or (b) sixty (60) days following any notice of Fee increase by ArborMetrix.
- Intellectual Property.a) Subject to the limited rights expressly granted hereunder, ArborMetrix reserves all rights, title and interest in and to the ArborMetrix Products and ArborMetrix Registry, including all related intellectual property rights.b) Participant and the Participating Clinicians shall not (i) permit any third party to access the ArborMetrix Products except as expressly permitted herein, (ii) create derivate works based on the ArborMetrix Products, (iii) copy, frame or mirror any part or content of the ArborMetrix Products, (iv) reverse engineer the ArborMetrix Products, or (v) access or disclose the ArborMetrix Products in order to (a) build a competitive product or service or assist in any way a competitor of ArborMetrix, or (b) copy any features, functions or graphics of the ArborMetrix Products.c) Participant and each Participating Clinician hereby grants a perpetual, unlimited license to ArborMetrix for the use, analysis, de-identification and aggregation of Quality Data to the full extent allowed by law. ArborMetrix shall not disclose any personal health information (PHI) except to the extent allowed by law, but may disclose and utilize de-identified, aggregated data (as defined in HIPAA) for its business purposes, including benchmarking.
- Warranty and Disclaimers.a) ArborMetrix warrants subject to CMS approval, it has the power and authority to provide Quality Data reporting services under this Agreement and to license the ArborMetrix Products to Participant and Participating Clinicians submitting Quality Data under this Agreement. EXCEPT FOR THE FOREGOING WARRANTY, THE SERVICES HEREUNDER AND THE ARBORMETRIX PRODUCTS ARE PROVIDED “AS IS” AND ARBORMETRIX DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. NO ORAL OR WRITTEN INFORMATION OR ADVICE GIVEN BY ARBORMETRIX, ITS AGENTS OR EMPLOYEES SHALL IN ANY WAY INCREASE THE SCOPE OF THIS WARRANTY.b) IN NO EVENT SHALL ARBORMETRIX’S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT, WHETHER IN CONTRACT, TORT OR UNDER ANY OTHER THEORY OF LIABILITY, EXCEED THE AMOUNT PAID BY PARTICIPANT DURING THE 12 MONTH DATE OF THE OCCURRENCE GIVING RISE TO THE CLAIM.c) IN NO EVENT SHALL ARBORMETRIX HAVE ANY LIABILITY FOR ANY LOST PROFITS OR REVENUES (INCLUDING ANY NEGATIVE ADJUSTMENTS IN CPS PAYMENTS), LOST DATA OR FOR ANY INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES HOWEVER CAUSED, WHETHER IN CONTRACT, WARRANTY, TORT, NEGLIGENCE, INDEMNITY OR UNDER ANY OTHER THEORY OF LIABILITY, AND WHETHER OR NOT USER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THE FOREGOING DISCLAIMER SHALL NOT APPLY TO THE EXTENT PROHIBITED BY APPLICABLE LAW.
- Confidential Information.a) Each Party may disclose non-public information to the other party that it considers proprietary and confidential. This information includes the ArborMetrix Products, Intellectual Property of a party, information and Quality Data exchanged under this Agreement and other non-public information pertaining to this Agreement, in written, oral and electronic form (collectively “Confidential Information”).b) Except for publicly available information, each party agrees to hold the other party’s Confidential Information in the strictest confidence and will only use and disclose such information as permitted under this Agreement, the DUA and BAA. Each party will use and appropriate safeguards to protect and maintain the confidentiality of Confidential Information.c) Participant and each Participating Clinician consents to ArborMetrix disclosure of Confidential Information to Participant’s and the Participating Clinician’s billing company, electronic medical record vendor, state society or other third party associated with Participant or Participating Clinician but only to the extent necessary to perform its obligations under this Agreement.d) Except for required or permitted disclosures to CMS, if a party is ordered by any court of law or administrative tribunal to disclose any Confidential Information, such party shall provide written notice of the forced disclosure as soon as practicable to the other party, but in any event, at least fifteen (15) days prior to the actual disclosure or court filing. Each Party agrees to use best efforts to protect the confidentiality of Confidential Information and additionally agree to allow the disclosing party to participate in the drafting and wording of any protective order or other document related to the disclosure.
- Indemnification. Participant and the Participating Clinicians agree to defend, indemnify and hold harmless ArborMetrix and its affiliates, shareholders, directors, officers and employees (collectively, the “Indemnitees”) from and against any and all direct or indirect claims, actions, liabilities, losses, fines, costs, demands, damages and expenses (including, without limitation, attorneys’ fees, experts’ fees and court costs) directly or indirectly arising out of Participant’s or the Participating Clinicians use of the ArborMetrix Registry or the ArborMetrix Products or services provided hereunder, or relating to Participant’s or an Participating Clinicians breach of this Agreement or violation of any CMS rules or requirements. The indemnity obligations shall survive expiration or termination of this Agreement.
- Agreement to Governing Law, Venue and Jurisdiction. This Agreement will be governed by the laws of the State of Michigan without regard to choice or conflicts of law rules, and the parties consent and submit to the exclusive jurisdiction of the applicable courts in Washtenaw County, Michigan.
- Waiver and Cumulative Remedies. No failure or delay by either party in exercising any right under this Agreement shall constitute a waiver of that right. Other than as expressly stated herein, the remedies provided herein are in addition to, and not exclusive of, any other remedies of a party at law or in equity.
- Severability. If any provision of this Agreement is held by a court of competent jurisdiction to be contrary to law, the provision shall be modified by the court and interpreted so as best to accomplish the objectives of the original provision to the fullest extent permitted by law, and the remaining provisions of this Agreement shall remain in effect.
- Assignment. Participant, ArborMetrix and the Participating Clinicians may not assign any of their rights or obligations hereunder, whether by operation of law or otherwise, without the prior written consent of the other Participant and ArborMetrix, which consent shall not be unreasonably withheld. Notwithstanding the foregoing, Participant, ArborMetrix and the Participating Clinicians may assign this Agreement in connection with a sale of their respective business or assets provided that notice is given to the other parties and the assignee agrees to be bound by all terms and conditions of this Agreement. Subject to the foregoing, this Agreement shall bind and inure to the benefit of the parties, their respective successors and permitted assigns.
- Entire Agreement. This Agreement, the PC Consent Form, and the DUA and BAA constitute the entire agreement between the parties and supersedes all prior and contemporaneous agreements, proposals or representations, written or oral, concerning its subject matter. No modification, amendment, or waiver of any provision of this Agreement shall be effective unless in writing and either signed or accepted electronically by ArborMetrix and User.
- Electronic Execution. This Agreement may be executed electronically by one or both of the parties (including by accepting this Agreement during registration through the ArborMetrix Registry) and such electronic execution shall be binding in all respects. Each party represents it has the authority to enter into this Agreement.
DATA USE AND BUSINESS ASSOCIATE AGREEMENT
THIS DATA USE AND BUSINESS ASSOCIATE AGREEMENT (“Agreement”) is made between ArborMetrix, Inc. (“ArborMetrix”), a Delaware corporation, and the entity or organization that registers electronically for ArborMetrix services under the Registry Reporting Agreement (the “Registry Reporting Agreement”) to which this Agreement is attached (“Participant”). Participant’s clicking the “Accept” button or other on-line acceptance indicates Participant’s and ArborMetrix’ acknowledgement and agreement that this DUA and BAA is legally binding and enforceable agreements between ArborMetrix and the Participant. This Agreement is effective as of the date of Participant’s acknowledgement of acceptance in accordance with the previous sentence.
WHEREAS, ArborMetrix and Participant are parties to that certain ArborMetrix, Inc. Registry Reporting Agreement to which this Agreement is attached setting forth the terms by which ArborMetrix, in collaboration with American Academy of Allergy, Asthma & Immunology (“AAAAI”), creates and supports a clinical data Registry (the “Registry”) for the collection, analysis, and reporting of quality data; and
WHEREAS, the Registry will facilitate the collection and submission of quality data measures of Participant and its Participating Clinicians (as defined in the Registry Reporting Agreement) to the Centers for Medicare and Medicaid Services (CMS) for certain Quality Reporting Programs (as defined in the Registry Reporting Agreement) for Participants who select that feature and submit appropriate data;
WHEREAS, the Registry Reporting Agreement may from time to time require the receipt, Use, and/or Disclosure of Protected Health Information (“PHI”);
WHEREAS, the Registry Reporting Agreement may from time to time require the Disclosure of PHI in the form of a Limited Data Set (“Limited Data Set Information”) for ArborMetrix to provide services to Participant related to its health care operations and for research purposes, including AAAAI research; and
WHEREAS, the Parties desire to amend the Registry Reporting Agreement so as to allocate responsibility for the Use and Disclosure of PHI, including Limited Data Set Information, and to comply with applicable requirements of the Health Insurance Portability and Accountability Act of 1996, Public Law 104‑191 (“HIPAA”) and the regulations promulgated thereunder by the United States Department of Health and Human Services (“HHS”) codified at 45 CFR Parts 160 and 164, (commonly known as the Privacy and Security Rules) as amended by the Privacy and Security provisions set forth in Section 13400 of the Health Information Technology for Economic and Clinical Health Act, Public law 111-5 (“HITECH Act:”), (collectively referred to herein as the “HIPAA Regulations”), as they pertain to Business Associates and Limited Data Sets;
NOW THEREFORE, in consideration of the mutual promises and conditions contained herein, and for other good and valuable consideration, the Parties agree to amend the Registry Reporting Agreement as follows:
- DEFINITIONS. Capitalized terms used, but not otherwise defined, in this Agreement will have the meaning ascribed to them in the HIPAA Regulations or the Registry Reporting Agreement, as applicable. Except as otherwise specified herein, the term “Agreement” refers to this Data Use and Business Associate Agreement. PHI will have the meaning ascribed to it in the HIPAA Regulations, but for the purposes of this Agreement will refer solely to PHI transmitted from or on behalf of Participant to ArborMetrix or a Subcontractor of ArborMetrix, or created by ArborMetrix or its Subcontractor on behalf of Participant. PHI will include PHI in electronic form (“Electronic PHI”) unless specifically stated otherwise. Limited Data Set Information will have the meaning ascribed to “Limited Data Sets” in the HIPAA Regulations, but for the purposes of this Agreement will refer solely to Limited Data Set Information transmitted from or on behalf of Participant to ArborMetrix or a Subcontractor of ArborMetrix, or created by ArborMetrix or its Subcontractor on behalf of Participant. “Subcontractor’’ shall have the meaning ascribed to it by the HIPAA Regulations, and shall include any agent or other person who acts on behalf of an entity, provided that ArborMetrix is not acting as an agent of Participant in its role as an independent contractor herein. Unless otherwise specified, the use of the term PHI will be interpreted to include Limited Data Set Information.
- EFFECT AND INTERPRETATION. The provisions of this Agreement shall apply with respect to the Use or Disclosure of any PHI by the Parties under the Registry Reporting Agreement. In the event of any conflict or inconsistency between the Registry Reporting Agreement and this Agreement concerning the Use or Disclosure of PHI, the terms of this Agreement will prevail unless the Parties mutually agree that the applicable terms of the Registry Reporting Agreement would be more protective of PHI. The provisions of this Agreement are intended in their totality to implement 45 CFR 164.504(e) and 45 CFR 164.314(a) as they concern Business Associate Contracts and 45 CFR 164.514(e) as it concerns Data Use Agreements. The provisions of the Registry Reporting Agreement will remain in full force and effect and are amended by this Agreement only to the extent necessary to effectuate the provisions set forth herein.
- GENERAL OBLIGATIONS OF ARBORMETRIX.3.1 Business Associate Contract Obligations. The obligations set out in this Section 3.1 apply with respect to ArborMetrix’ Use or Disclosure of PHI, other than Limited Data Set Information.a) ArborMetrix agrees not to Use or Disclose PHI other than as permitted or required by this Agreement or as Required by Law or to carry out its undertakings under the Registry Reporting Agreement.b) ArborMetrix agrees to use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to Electronic PHI, to prevent Use or Disclosure of PHI other than as provided for by this Agreement. Without limiting the generality of the foregoing, ArborMetrix further agrees to:(i) implement Administrative, Physical, and Technical Safeguards that reasonably and appropriately protect the Confidentiality, Integrity, and Availability of the Electronic PHI that it creates, receives, maintains, or transmits on behalf of Participant as required by 45 CFR 164.314(a);(ii) ensure that any Subcontractor, to whom it provides such PHI agrees to implement reasonable and appropriate safeguards to protect the PHI and comply with Subpart C of 45 CFR Part 164 with respect to Electronic PHI;(iii) report promptly to the Participant any Security Incident or Breach of Unsecured PHI of which ArborMetrix becomes aware; and(iv) report promptly to Participant any Use or Disclosure of PHI which is not authorized by this Agreement of which ArborMetrix becomes awarec) ArborMetrix agrees to ensure that any Subcontractor that creates, receives, maintains, or transmits PHI, on behalf of ArborMetrix, will agree in writing to comply with the same restrictions and conditions with respect to such information that apply through this Agreement to ArborMetrix. For the purposes of this Agreement, all PHI provided at ArborMetrix’s direction to a Subcontractor of ArborMetrix will be deemed to have been provided to ArborMetrix.d) If PHI provided to ArborMetrix, or to which ArborMetrix otherwise has access, constitutes a Designated Record Set, ArborMetrix agrees to provide Participant with timely access to such PHI, upon reasonable advance notice and during regular business hours, or, at Participant’s request, to provide an Individual with access to his or her PHI in order to meet the requirements under 45 CFR 164.524 concerning access of Individuals to PHI. In the event an Individual contacts ArborMetrix or its Subcontractor directly about gaining access to his or her PHI, ArborMetrix will not provide such access but rather will forward such request to Participant within three (3) business days of such contact.e) If PHI provided to ArborMetrix, or to which ArborMetrix otherwise has access, constitutes a Designated Record Set, ArborMetrix agrees to make timely amendment(s) to such PHI as Participant may direct or agree to pursuant to 45 CFR 164.526. In the event an Individual contacts ArborMetrix or its Subcontractor directly about making amendments to his or her PHI, ArborMetrix will not make such amendments, but rather will forward such request to Participant within three (3) business days. f) ArborMetrix agrees to make internal practices, books and records relating to the Use and Disclosure of PHI available to the Secretary of the United States Department of Health and Human Services, during regular business hours, for purposes of the Secretary’s determining compliance with the HIPAA Regulations. g) ArborMetrix agrees to document Disclosures of PHI and information related to such Disclosures as would be required for Participant to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR 164.528. In addition, ArborMetrix agrees to provide promptly to Participant or an Individual, upon Participant’s reasonable request, information collected in accordance with this Subsection 3.1(g) in order to permit Participant to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR 164.528. Notwithstanding the foregoing, this Subsection 3(h) will not apply with respect to Disclosures for which an accounting is not required by 45 CFR 164.528 as amended. h) ArborMetrix shall mitigate, to the extent practicable, any adverse effects from any improper Use and/or Disclosure of Protected Health Information by ArborMetrix that are known to ArborMetrix. 3.2 Data Use Agreement Obligations. The obligations set out in this Subsection 3.2 apply only with respect to ArborMetrix’s Use or Disclosure of Limited Data Set Information. a) ArborMetrix agrees to not Use or further Disclose Limited Data Set Information other than as permitted by Section 4.3 of this Agreement, Section 8(c) of the Registry Reporting Agreement or as otherwise Required by Law. b) ArborMetrix agrees to use appropriate safeguards to prevent Use or Disclosure of the Limited Data Set Information other than as permitted by Section 4(c) of this Agreement. Without limiting the generality of the foregoing, ArborMetrix further agrees to: (i) implement Administrative, Physical, and Technical Safeguards that reasonably and appropriately protect the Confidentiality, Integrity, and Availability of the electronic Limited Data Set Information that it creates, receives, maintains, or transmits on behalf of Participant as required by 45 CFR 164.314(a); (ii) ensure that any Subcontractor, to whom it provides such Limited Data Set Information agrees to implement reasonable and appropriate safeguards to protect such information; (iii) report within 5 business days to the Participant any Security Incident or Breach of Unsecured PHI of which ArborMetrix becomes aware. c) ArborMetrix will report within 5 business days to Participant any Use or Disclosure of the Limited Data Set Information not permitted by Section 4.3 of this Agreement of which ArborMetrix becomes aware. d) ArborMetrix will not attempt to identify the Individuals to whom the Limited Data Set Information pertains, or attempt to contact such Individuals, provided that this restriction will not be interpreted to prevent ArborMetrix from conducting such activities under the Business Associate Contract provisions of this Agreement. Under no circumstances will ArborMetrix attempt to contact Individuals except with Participant’s prior written consent. e) ArborMetrix agrees to require that any Subcontractor to whom it, directly or indirectly, provides Limited Data Set Information will agree in writing to comply with the same restrictions and conditions that apply through this Section 3.2 to ArborMetrix. f) ArborMetrix agrees to enter into a written agreement with each third party to which it Discloses Limited Data Set Information that includes the terms and provisions required by the HIPAA Regulations for such Disclosures.
- PERMITTED USES AND DISCLOSURES BY ARBORMETRIX.4.1 General Business Associate Contract Use and Disclosure Provisions. Except as otherwise limited in this Agreement, ArborMetrix may Use or Disclose PHI on behalf of, or in order to provide services to, Participant to the extent such Use or Disclosure is reasonably necessary to facilitate Participant’s participation in the ArborMetrix Registry, consistent with the Registry Reporting Agreement, provided that such Use or Disclosure of PHI would not violate the HIPAA Regulations if done by Participant. In providing these services, ArborMetrix will be acting as an independent contractor and not as an employee or agent of Participant. ArborMetrix shall have no authority, express or implied, to commit or obligate Participant in any manner whatsoever.4.2 Specific Business Associate Contract Use and Disclosure Provisions. The permitted Uses and Disclosures set out in this Subsection 4.2 apply only with respect to ArborMetrix’s Use or Disclosure of PHI other than Limited Data Set Information.a) Except as otherwise limited in this Agreement or the Registry Reporting Agreement, ArborMetrix may use PHI for the proper management and administration of ArborMetrix or to carry out the legal responsibilities of ArborMetrix.b) Except as otherwise limited in this Agreement or the Registry Reporting Agreement, ArborMetrix may Disclose PHI for its own proper management and administrative purposes, provided that the Disclosures are either Required By Law, or ArborMetrix otherwise obtains reasonable assurances from the person to whom it Discloses the PHI that such person will (i) protect the Confidentiality of the PHI; (ii) Use or further Disclose the PHI only as Required By Law or for the purpose for which it was Disclosed to the person; and (iii) promptly notify ArborMetrix of any instances of which the person is aware that the Confidentiality of the PHI has been breached.c) Except as otherwise limited in this Agreement or the Registry Reporting Agreement, ArborMetrix may Use and Disclose PHI to provide Data Aggregation services to Participant as permitted by 45 CFR 164.504(e)(2)(i)(B).d) ArborMetrix may de-identify any PHI, provided such de-identification conforms to the requirements of 45 CFR 164.514(b), including without limitation any documentation requirements. ArborMetrix may Use or Disclose such de-identified information at its discretion, as such de-identified information does not constitute PHI and is not subject to the terms of this Agreement; provided that such Use or Disclosure is consistent with the Registry Reporting Agreement.e) ArborMetrix may partially de-identify any PHI to create a Limited Data Set, provided such partial de-identification conforms to the Limited Data Set requirements of 45 CFR 164.514(e)(2).4.3 Uses and Disclosures Under Data Use Agreement Provisions. Notwithstanding Subsection 4.2 above, ArborMetrix may, consistent with this Agreement, Use or Disclose PHI that consists solely of Limited Data Set Information to a third party (including AAAAI) for Research, Public Health, or Health Care Operations in accordance with the provisions of the HIPAA Regulations concerning Limited Data Sets, provided that such Use or Disclosure is (i) limited to the minimum information necessary to facilitate Participant’s participation in the ArborMetrix Registry or for ArborMetrix’s Research purposes; (ii) is consistent with the Registry Reporting Agreement; and (iii) would not violate the HIPAA Regulations if done by Participant. The term Health Care Operations as used herein includes Data Aggregation.
- GENERAL OBLIGATIONS OF PARTICIPANT.5.1 Participant’s Notice of Privacy Practices, Permissions, and Restrictions.a) Participant represents and warrants that it has developed and makes available to all patients a Notice of Privacy Practices that complies with 45 CFR 164.520 and any other applicable provisions of the HIPAA Regulations. Participant will provide ArborMetrix with a copy of its Notice of Privacy Practices upon request.b) Participant will provide ArborMetrix with any changes in, or revocation of, the permission by an Individual to Use or Disclose PHI, if such changes affect ArborMetrix’s permitted or required Uses and Disclosures.c) Participant will ensure on a continuing basis that all Disclosures of PHI made to ArborMetrix are permissible under the HIPAA Regulations and are not subject to restrictions that would make the Disclosure of an Individual’s PHI to ArborMetrix impermissible. Participant will notify ArborMetrix of any specific or general restrictions on the Use or Disclosure of PHI submitted to ArborMetrix that Participant has agreed to in accordance with 45 CFR 164.522.d) Permissible Requests by Participant. Participant will not ask ArborMetrix to Use or Disclose PHI in any manner that would not be permissible under the HIPAA Regulations if undertaken by Participant, provided that Participant may, as otherwise permitted under this Agreement, request that ArborMetrix Use or Disclose PHI for the purposes of Data Aggregation or the management and administrative activities of ArborMetrix, as provided for in 45 CFR 164.504(e)(4).
- TERM AND TERMINATION.6.1 Term. This Agreement will commence as of the Effective Date and will remain in effect for a period that is coterminous with the Registry Reporting Agreement, unless (i) this Agreement is terminated sooner in accordance with either Subsection 6.2 or 6.3 of this Section; or (ii) the Registry Reporting Agreement is amended by written agreement of the Parties in a manner that the Parties mutually agree renders the provisions of this Agreement unnecessary.6.2 Termination for Material Breach. Either Party may terminate this Agreement based upon a material breach of this Agreement by the other Party, provided that the non-breaching Party gives the breaching Party thirty (30) days written notice and the opportunity to cure such breach, and the breach is not cured during the notice period. In the event such material breach is not cured, the non-breaching Party may terminate this Agreement immediately upon the expiration of the notice period. In the event it is not possible to cure such material breach, the non-breaching Party may terminate this Agreement immediately and without any notice.6.3 Termination Permitted Due to Change in Law. Either Party may terminate this Agreement as permitted in accordance with Section 8.2 of this Agreement upon a change in an applicable law that causes performance in compliance with this Agreement to violate the law.6.4 Effect of Termination.a) Except as provided in paragraph (b) of this Subsection and except with respect to Limited Data Set Information, upon termination of this Agreement for any reason, ArborMetrix will return or destroy all PHI received from Participant, or created or received by ArborMetrix on behalf of Participant. ArborMetrix will retain no copies of the PHI, except as provided in paragraph (ii) of this Subsection or to the extent that the PHI constitutes Limited Data Set Information.b) In the event that ArborMetrix reasonably determines that returning or destroying the PHI is infeasible due to inclusion of such PHI in a Database or for other reason, ArborMetrix will not return or destroy the PHI, may retain copies of the PHI to the extent it has been entered into a Database, and will promptly notify Participant of the circumstances that make return or destruction infeasible. Based on such determination, ArborMetrix will extend the protections of this Agreement to such PHI and limit any further Use or Disclosure of such PHI to those purposes that make the return or destruction infeasible, for so long as ArborMetrix maintains such PHI.c) The Parties acknowledge and agree that the provision of any PHI to ArborMetrix in accordance with the Registry Reporting Agreement is conditioned upon this Agreement being in full force and effect. Therefore, upon termination of this Agreement, the Parties agree that Participant will refrain from submitting PHI to ArborMetrix, and ArborMetrix will refrain from accepting PHI from Participant. In the event of a termination under either Subsection 6.2 of 6.3, either Party may also elect to terminate the Registry Reporting Agreement. In the event the Parties engage in negotiations undertaken in accordance with Subsection 8.2 of this Agreement, the Parties will suspend during such period of negotiation any provision of the Registry Reporting Agreement requiring or obligating either Party to Use or Disclose PHI in a manner that either Party reasonably believes would violate any applicable state or federal law or regulation, including without limitation the HIPAA Regulations.d) The obligations of this Subsection 6.4 will survive any expiration or termination of this Agreement.
- ACTS OF THE PARTIES.7.1 Each party to this Agreement agrees that it will be responsible for its own acts and omissions and the results thereof; and, shall not be responsible for the acts and omissions of the other party and the results thereof. Each party agrees that it will assume all risk and liability to itself, its agents, or its employees for any injury to persons or property resulting in any manner from conduct of its own operations and the operations of its agents or employees under this Agreement. Under no circumstances will either party be liable to the other for any indirect or consequential damages of any kind, including lost profits (whether or not the Parties have been advised of such loss or damage) arising in any way in connection with this Agreement.7.2 ArborMetrix shall main or cause to be maintained, a policy of commercial liability insurance with The Hartford or an insurance carrier with an A.M. Best rating of A- or better that insures its obligations regarding the protection of PHI hereunder. ArborMetrix liability under this Agreement shall in all cases be limited to the insurance and defense coverage provided under the insurance policies.
- MISCELLANEOUS.8.1 Regulatory References. A reference in this Agreement to a section in the HIPAA Regulations means the section as in effect or as amended from time to time and for which compliance is required.8.2 Amendment. This Agreement may not be amended except by the mutual written agreement of the Parties. Notwithstanding the foregoing, the Parties agree to work together in good faith to take such action as is necessary to make technical amendments to this Agreement from time to time if necessary for Participant and/or ArborMetrix to comply with the requirements of HIPAA, the HIPAA Regulations, or any applicable provisions of any other federal or state law, as such laws or regulations may be amended from time to time. However, should any state or federal law or regulation now existing or enacted after the Effective Date of this Agreement, including without limitation HIPAA or the HIPAA Regulations, be amended or interpreted by judicial decision or a regulatory body in such a manner that either Party reasonably determines renders any provision of this Agreement in violation of such law or regulation or adversely affects the Parties’ abilities to perform their obligations under this Agreement, the Parties agree to negotiate in good faith to amend this Agreement so as to comply with such law or regulation and to preserve the viability of this Agreement. If, after negotiating in good faith, the Parties are unable to reach agreement as to any necessary amendments, either Party may terminate this Agreement without penalty.8.3 Interpretation. Any ambiguity in this Agreement will be resolved in favor of a meaning that permits Participant and ArborMetrix to comply with the HIPAA Regulations. Where provisions of this Agreement are different from those mandated in the HIPAA Regulations, but are nonetheless permitted by the HIPAA Regulations, the provisions of this Agreement will control.8.4 Third Party Beneficiaries. ArborMetrix and Participant agree that Individuals whose PHI is Used or Disclosed to ArborMetrix or its Subcontractors under this Agreement are not third-party beneficiaries of this Agreement or the Registry Reporting Agreement.8.5 Waiver. No provision of this Agreement may be waived except by an agreement in writing signed by the waiving Party. A waiver of any term or provision shall not be construed as a waiver of any other term or provision.8.6 Correspondence. The Parties will send any reports or notices required under this Agreement to the addresses set forth in the notice provision of the Registry Reporting Agreement.8.7 Electronic Execution. This Agreement may be executed electronically by one or both of the parties (including by accepting this Agreement during registration through the ArborMetrix Registry) and such electronic execution shall be binding in all respects. Each party represents it has the authority to enter into this Agreement.