BUSINESS ASSOCIATE AGREEMENT Organization name here!

This Agreement is entered into by and between (Health Care Provider) and Bu i!e A o"iate to set forth the terms and conditions under which protected health information (PHI), as defined by the Health Insurance Portability and Accountability Act of !!" (HIPAA) and #egulations enacted hereunder, created or recei$ed by (%usiness Associate) on behalf of (Health Care Provider) may be used or disclosed& This Agreement shall commence on (#ate) and the obligations herein shall continue in effect so long as Bu i!e A o"iate uses, discloses, creates or otherwise possesses any protected health information created or recei$ed on behalf of (Health Care Provider) and until all protected health information created or recei$ed by Bu i!e A o"iate on behalf of (Health Care Provider) is destroyed or returned to (Health Care Provider) pursuant to Paragraph ' herein& ) (Health Care Provider) and Bu i!e A o"iate hereby agree that Bu i!e A o"iate shall be permitted to use and(or disclose protected health information created or recei$ed on behalf of (Health Care Provider) for the following purposes) a) *ompleting and submitting health care claims to health plans, *learinghouses, and other third party payers& b) *ollection of fees for (Health Care Provider)& c) +stablishing and maintaining %usiness ,anagement Programs for (Health Care Provider)$ d) Introducing, maintaining, and programming +lectronic ,edical #ecord -ystems for (Health Care Provider)$ e) Introducing, maintaining, and programming compatible .ictation -ystems for (Health Care Provider)$ It is to be understood by all parties that the permitted uses and disclosures must by within the scope of and necessary to achie$e, the obligations and responsibilities of Bu i!e A o"iate in performing on behalf of, or pro$iding ser$ices to, the Health *are Pro$ider& /) Bu i!e A o"iate may use and disclose protected health information created or recei$ed by Bu i!e A o"iate on behalf of (Health Care Provider) if necessary for the proper management and administration of Bu i!e A o"iate or to carry out& legal responsibilities, pro$ided that any disclosure is) a) #e0uired by law, or b) Bu i!e A o"iate obtains reasonable assurances from the person to whom the protected health information is disclosed that (i) the protected health information will be held confidentially and used or further disclosed only as re0uired by law or for the purpose for which it was disclosed to the person1 and (ii) Bu i!e A o"iate will be notified of any instances of which the person is aware in which the confidentiality of the information is breached& 2) %usiness Associate hereby agrees to maintain the security and pri$acy of all protected health information in a manner consistent with *alifornia -tate and 3ederal laws and regulations, including the Health insurance Portability and Accountability Act of !!" (HIPAA) and regulations hereunder, and all other applicable law&

4) Bu i!e A o"iate further agrees not to use or disclose protected health information e5cept as e5pressly permitted by this Agreement, applicable law, or for the purpose of managing %usiness Associate own internal business processes consistent with Paragraph / herein& ') Bu i!e A o"iate shall not disclose protected health information to any member of its wor6force unless Bu i!e A o"iate has ad$ised such person (employee) of Bu i!e A o"iate pri$acy and security obligations and policies under this Agreement, including the conse0uences for $iolation of such obligations& %usiness Associate shall ta6e appropriate disciplinary action against any member of its wor6force who uses or discloses protected health information in $iolations of this Agreement and applicable law& ") Bu i!e A o"iate shall not disclose protected health information created or recei$ed by %usiness Associate on behalf of (Health Care Provider) to a person, including any agent or subcontractor of Bu i!e A o"iate but not including a member of Pri%e Cli!i"al S& te% $ I!"$' own wor6force, until such person agrees in writing to be bound by the pro$isions of the Agreement and applicable *alifornia -tate or 3ederal law&

7) Bu i!e A o"iate agrees to use appropriate safeguards to pre$ent use or disclosure of protected health information not permitted by this Agreement or applicable law& 8) Bu i!e A o"iate agrees to maintain a record of all disclosures of protected health information, including disclosures not made for the purposes of this Agreement& -uch record shall include the date of the disclosure, the name and, if 6nown, the address of the recipient of the protected health information, the name of the indi$idual who is the sub9ect of the protected health information, a brief description of the protected health information disclosed, and the purpose of the disclosure& Bu i!e A o"iate shall ma6e such record a$ailable to an indi$idual who is the sub9ect of such information or (Health Care Provider) within fi$e (') wor6ing days of a re0uest and shall include disclosures made on or after the date which is si5 (") years prior to the re0uest or April 4, /::2, whiche$er date is later&
!) Bu i!e A o"iate agrees to report to (Health Care Provider) any unauthori;ed use or disclosure of protected health information by %usiness Associate or its wor6force or subcontractors and the remedial action ta6en or proposed to be ta6en with respect to such use or disclosure& :) Bu i!e A o"iate agrees to ma6e its internal practices, boo6s, and records relating to the use and disclosure of protected health information recei$ed from (Health Care Provider) or created or recei$ed by Bu i!e A o"iate on behalf of (Health Care Provider), a$ailable to the -ecretary of the <nited -tates .epartment of Health and Human -er$ices, for purposes of determining the *o$ered +ntity=s compliance with HIPAA& ) >ithin thirty (2:) days of a written re0uest by (Health Care Provider), Bu i!e A o"iate shall allow a person who is the sub9ect of protected health information, such person=s legal representati$e, or (Health Care Provider) to ha$e access to and to copy

such person=s protected health information in the format re0uested by such person, legal representati$e, or practitioner unless it is not readily producible in such format, in which case it shall be produced in standard hard copy format& /) Bu i!e A o"iate agrees to amend, pursuant to a re0uest by (Health Care Provider), protected health information maintained and created or recei$ed by Bu i!e A o"iate, on behalf of the Practitioner& Bu i!e A o"iate further agrees to complete such amendment within thirty (2:) days of a written re0uest by (Health Care Provider)( and to ma6e such amendment as directed by (Health Care Provider)& 2) In the e$ent Bu i!e A o"iate fails to perform the obligations under this Agreement, (Health *are Pro$ider) may, at its option) a) #e0uire Bu i!e A o"iate to submit to a plan of compliance, including monitoring by (Health Care Provider) and reporting by %usiness Associate, as (Health Care Provider)( in its sole discretion, determines necessary to maintain compliance with this Agreement and applicable law& -uch plan shall be incorporated into this Agreement by amendment hereto) and b) #e0uire Bu i!e A o"iate to mitigate any loss occasioned by the unauthori;ed disclosure or use of protected health information& c) Immediately discontinue pro$iding protected health information to Bu i!e A o"iate with or without written notice to Bu i!e A o"iate 4) (Health Care Provider) may immediately terminate this Agreement and related agreements if (Health Care Provider) determines that Bu i!e A o"iate has breached a material term of this Agreement& Alternati$ely, (Health Care Provider) may choose to (i) pro$ide Bu i!e A o"iate with ten ( :) days written notice of the e5istence of an alleged material breach1 and (ii) afford Bu i!e A o"iate an opportunity to cure said alleged material breach to the satisfaction of (Health Care Provider) within ( :) days& Bu i!e A o"iate' failure to cure shall be grounds for immediate termination of this agreement& (Health Care Provider)' remedies under this Agreement are cumulati$e, and the e5ercise of any remedy shall not preclude the e5ercise of any other& ') <pon termination of this Agreement, Prime *linical -ystems shall return or destroy all protected health information recei$ed from (Health Care Provider), or created or recei$ed by Bu i!e A o"iate on behalf of (Health "are Provider) and that Bu i!e A o"iate maintains in any form, and shall retain no copies of such information& If the parties mutually agree that return or destruction of protected health information is not feasible, Bu i!e A o"iate shall continue to maintain the security and pri$acy of such protected health information in a manner consistent with the obligations of this Agreement and as re0uired by applicable law, and shall limit further use of the information to those purposes that ma6e the return or destruction of the information infeasible& The duties hereunder to maintain the security and pri$acy of protected health information shall sur$i$e the discontinuance of this Agreement& ") (Health Care Provider) may amend this Agreement by pro$iding ten ( :) days prior written notice to Bu i!e A o"iate in order to maintain compliance with *alifornia -tate or 3ederal law& -uch amendment shall be binding upon %usiness Associate at the end of the ten ( :) day period and shall not re0uire the consent of Bu i!e A o"iate

Bu i!e A o"iate may elect to discontinue the Agreement within the ten ( :) day period, but Bu i!e A o"iate duties hereunder to maintain the security and pri$acy of P#?T+*T+. H+A@TH IA3?#,ATI?A shall sur$i$e such discontinuance& (Health Care Provider) and Bu i!e A o"iate may otherwise amend this Agreement by mutual written agreement& 7) Bu i!e A o"iate shall, to the fullest e5tent permitted by law, protect, defend, indemnify and hold harmless (Health Care Provider) and his(her respecti$e employees, directors, and agents (Indemnities) from and against any and all losses, costs, claims, penalties, fines, demands, liabilities, legal actions, 9udgments, and e5penses of e$ery 6ind (including reasonable attorneys fees, including at trial and on appeal) asserted or imposed against any Indemnities arising out of the acts or omissions of Bu i!e A o"iate or any of Bu i!e A o"iate' employees, directors, or agents related to the performance or nonperformance of this Agreement& )))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) (Health Care Provider) ))))))))))))))))))))))))))))))) #ate

))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) )))))))))))))))))))))))))))))) Bu i!e A o"iate #ate