0121_commissioners_agenda_full_2025

Home Browse Search

Agreement #ZO02306005 11.11. Third Parties. If Lessee engages a third -party provider ("Third Party Provider") to deliver products or services, including without limitation software, integrated into or receiving data from or accessing the ASP Services ("Third Party Products or Services"), Lessee represents, warrants and agrees that: (i) Lessee is solely responsible for any amounts owed to Third Parties Provider, (ii) Lessor shall have no liability, and makes no representation, with respect to such Third Party Products or Services; and (iii) the Third Party Provider shall not be an agent of Lessor. To the extent the ASP Services or Software contains software owned by a third party for which Lessor has a license agreement with a third party, the ASP Services and Software and all rights granted hereunder are expressly limited by and subject to any license agreements Lessor may have for such software. 11.12. Force Majeure. Neither party shall be liable for failure of performance hereunder arising out of causes beyond such party's reasonable control and without such party's fault or negligence, including, but not limited to, failure of its suppliers to timely deliver acceptable parts or services, any act or omission of Lessee that interferes with or impedes Lessor's performance hereunder, acts of God, acts of civil or military authority, fires, riots, wars, embargoes, Internet disruptions, hacker attacks, or communications failures (a "Force Majeure Event"). 11.13. Amendment; No Third -Party Beneficiaries; Survival. This ASP Agreement may not be amended or changed, or any provision hereof waived except in writing signed by both parties. Any different or additional terms in any purchase order, confirmation or similar form issued or otherwise provided by Lessee but not signed by an authorized representative of Lessor shall have no force or effect. There are no third -party beneficiaries of this ASP Agreement. Those provisions of this ASP Agreement that may be reasonably interpreted as surviving termination of this ASP Agreement or the survival of which is necessary for the interpretation or enforcement of this ASP Agreement shall continue in full force and effect in accordance with their terms notwithstanding the termination hereof including, but not limited to, Section 6 (Confidentiality), Section 7 (Indemnification), Section 8 (Limitation on Liability), Section 9 (Ownership), Section 10.3 (Effects of Termination) and Section 11 (General Provisions). This ASP Agreement may be executed in counterparts, each of which will be considered an original, but all of which together will constitute the same instrument. 12. HIPAA. This Section 12 applies if and to the extent that Lessor creates, receives, maintains or transmits, directly or indirectly, any protected health information of Lessee ("PHI") in the course of providing Software or Services to Lessee. Capitalized terms used but not defined in this Section 12 have the meanings assigned to them elsewhere in the ASP Agreement or, if not defined therein, as defined in the Health Insurance Portability and Accountability Act of 1996 (P.L. 104 191), 42 U.S.C. Section 1320d, et seq., and regulations promulgated thereunder, as amended from time to time (such statute and regulations collectively referred to as "HIPAA"). "Covered Entity" as used herein means Lessee. "Business Associate" as used herein means Lessor. The purpose of this Section 12 is to comply with 45 C.F.R. § 164.502(e) and § 164.504(e), governing PHI and business associates under HIPAA 12.1. Applicability. This Section 12 applies if and to the extent that Business Associate creates, receives, maintains or transmits, directly or indirectly, any PHI in the course of providing Software or Services to Covered Entity. 12.2. Compliance and Agents. Business Associate agrees that, to the extent it has access to PHI, Business Associate will fully comply with the requirements of this Section 12 with respect to such PHI. Business Associate will ensure that every agent, including a subcontractor, of Business Associate to whom it provides PHI received from, or created or received by Business Associate on behalf of, Covered Entity will comply with the same restrictions and conditions as set forth herein. 12.3. Use and Disclosure; Rights. Business Associate agrees that it shall not use or disclose PHI except as permitted under this ASP Agreement, and in compliance with each applicable requirement of 45 CFR Section 164.504(e). Business Associate may use or disclose the PHI received or created by it, (a) to perform its obligations under this ASP Agreement, (b) to perform functions, activities, or services for, or on behalf of, Covered Entity as specified in the Master Agreement, or (c) to provide data aggregation functions to Covered Entity as permitted by HIPAA. Further, Business Associate may use the PHI received by it in its capacity as Business Associate, if necessary, to properly manage and administer its business or to carry out its legal responsibilities. Business Associate may disclose the PHI received by it in its capacity as Business Associate to properly manage and administer its business or to carry out its legal responsibilities if. (a) the disclosure is required by law, or (b) the Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purpose for which it is disclosed to the person and the person notifies Business Associate of any instances of which it is aware that the confidentiality of the information has been breached. Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under HIPAA if done by Covered Entity. 12.4. Safeguards. Business Associate agrees to develop, document, use, and keep current appropriate procedural, physical, and electronic safeguards, as required in 45 C.F.R. §§164.308 - 164.312, sufficient to prevent any use or disclosure of electronic PHI other than as permitted or required by this ASP Agreement. 12.5. Minimum Necessary. Business Associate will limit any use, disclosure, or request for use or disclosure to the minimum amount necessary to accomplish the intended purpose of the use, disclosure, or request. 12.6. Report of Improper Use or Disclosure. Business Associate shall report to Covered Entity any information of which it becomes aware concerning any use or disclosure of PHI that is not permitted by this ASP Agreement and any security incident of which it becomes aware. Business Associate will, following the discovery of a breach of "unsecured protected health information," as defined in 45 C.F.R. § 164.402, notify Covered Entity of such breach within 15 days. The notice shall include the identification of each individual whose unsecured protected health information has been or is reasonably believed by Business Associate to have been, accessed, acquired, or disclosed during such breach. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of this ASP Agreement. 12.7. Individual Access. In accordance with an individual's right to access to his or her own PHI in a designated record set under 45 CFR § 164.524 and the individual's right to copy or amend such records under 45 CFR § 164.524 and § 164.526, Business Associate shall make available all PHI in a designated record set to Covered Entity to enable the Covered Entity to provide access to the individual to whom that information pertains or such individual's representative. 12.8. Amendment of and Access to PHI. Business Associate shall make available for amendment PHI in a designated record set and shall incorporate any amendments to PHI in a designated record set in accordance with 45 CFR §164.526 and in accordance with any process mutually agreed to by the parties. 12.9. Accounting. Business Associate agrees to document such disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to an individual's request for an accounting of disclosures of their PHI in accordance with 45 CFR § 164.528. Business Associate agrees to make available to Covered Entity the information needed to enable Covered Entity to provide the individual with an accounting of disclosures as set forth in 45 CFR § 164.528. 12.10. DHHS Access to Books, Records, and Other Information. Business Associate shall make available to the U.S. Department of Health and Human Services ("DHHS"), its internal practices, books, and records relating to the use and disclosure of PHI received from or created or received by Business Associate on behalf of, Covered Entity for purposes of determining the Covered Entity's compliance with HIPAA. 12.11. Individual Authorizations; Restrictions. Covered Entity will notify Business Associate of any limitation in its notice of privacy practices, any restriction to the use or disclosure of PHI that Covered Entity has agreed to with an individual and of any changes in or revocation of an authorization or other permission by an individual, to the extent that such limitation, restriction, change, or revocation may affect Business Associate's use or disclosure of PHI. 12.12. HITECH Act Compliance. Covered Entity and Business Associate agree to comply with the amendments to HIPAA included in the Health Information Technology for Economic and Clinical Health Act (the "HITECH Act"), including all privacy and security regulations issued under the HITECH Act that apply to Business Associate. V3.2 (02-23-2024)-FMV Page 13 of 17 Page179