1.1 Business Associate

PhysioPro ("Business Associate", "we", "us", or "our") is a person or entity that performs certain functions or activities on behalf of, or provides certain services to, a Covered Entity that involve the use or disclosure of Protected Health Information.

1.2 Covered Entity

You, the healthcare provider or organization ("Covered Entity", "you", or "your") that provides healthcare services and uses PhysioPro to manage patient information.

1.3 Protected Health Information (PHI)

Individually identifiable health information transmitted or maintained in any form or medium by Business Associate on behalf of Covered Entity, including patient names, medical records, exercise prescriptions, adherence data, and communication records.

1.4 HIPAA Rules

The Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.

2.1 Permitted Uses and Disclosures

Business Associate may use or disclose PHI only as permitted by this Agreement or as required by law. Business Associate will not use or disclose PHI in any manner that would violate the HIPAA Rules if done by Covered Entity.

2.2 Safeguards

Business Associate will implement appropriate administrative, physical, and technical safeguards to prevent use or disclosure of PHI other than as provided for by this Agreement. These safeguards include:

• End-to-end encryption for data in transit (TLS 1.3)
• AES-256 encryption for data at rest
• HttpOnly secure cookies for authentication
• Role-based access control (RBAC)
• Automated backup systems with encryption
• Regular security audits and vulnerability assessments
• Employee training on HIPAA compliance
• Secure deletion protocols for PHI

2.3 Reporting

Business Associate will report to Covered Entity any use or disclosure of PHI not provided for by this Agreement, including any Security Incident or Breach of Unsecured PHI, within 24 hours of discovery.

2.4 Subcontractors

Business Associate will ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree to the same restrictions and conditions that apply to Business Associate with respect to such PHI.

2.5 Access to PHI

Business Associate will provide access to PHI in a Designated Record Set to Covered Entity or to an individual as directed by Covered Entity, within 15 days of such request.

2.6 Amendment of PHI

Business Associate will make any amendments to PHI in a Designated Record Set as directed by Covered Entity within 15 days of such request.

2.7 Accounting of Disclosures

Business Associate will document and make available to Covered Entity information required to provide an accounting of disclosures of PHI as required by 45 CFR § 164.528.

2.8 Minimum Necessary

Business Associate will make reasonable efforts to limit use, disclosure, or requests for PHI to the minimum necessary to accomplish the intended purpose.

3.1 Permitted Disclosures

Covered Entity will not request Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Covered Entity.

3.2 Notice of Privacy Practices

Covered Entity will notify Business Associate of any limitation in its Notice of Privacy Practices that affects Business Associate's use or disclosure of PHI.

3.3 Patient Restrictions

Covered Entity will notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to pursuant to 45 CFR § 164.522.

3.4 Authorization

Covered Entity represents that it has obtained all necessary authorizations, consents, and permissions from patients for the use of PHI within PhysioPro.

4.1 Term

This Agreement shall commence on the date you first use PhysioPro and shall continue until terminated as provided herein.

4.2 Termination for Breach

Either party may terminate this Agreement if the other party breaches a material term and fails to cure the breach within 30 days of written notice. Covered Entity may terminate immediately if cure is not possible.

4.3 Effect of Termination

Upon termination, Business Associate will:

• Return or destroy all PHI received from or created on behalf of Covered Entity
• Provide confirmation of deletion within 30 days
• Retain no copies of PHI except as required by law
• Continue to protect PHI in accordance with this Agreement for as long as retained

4.4 Data Portability

Upon request prior to termination, Business Associate will provide Covered Entity with a complete export of all PHI in a structured, commonly used format (JSON, CSV, or PDF) within 30 days.

5.1 Administrative Safeguards

• Security Management Process: Risk assessments, sanctions, and information system activity reviews
• Workforce Security: Authorization procedures, supervision, and termination procedures
• Security Awareness Training: Protection from malicious software, login monitoring, password management
• Contingency Plan: Data backup, disaster recovery, and emergency mode operations

5.2 Physical Safeguards

• Facility Access Controls: Cloud infrastructure with SOC 2 Type II compliance
• Workstation Security: Device management and secure access protocols
• Data Center Security: AWS/Azure certified HIPAA-compliant data centers

5.3 Technical Safeguards

• Access Control: Unique user identification, emergency access, automatic logoff, encryption
• Audit Controls: Activity logging and monitoring for security events
• Integrity Controls: Mechanisms to authenticate PHI has not been altered or destroyed
• Transmission Security: Encryption for data in transit, integrity controls

6.1 Discovery and Notification

Business Associate will notify Covered Entity within 24 hours of discovery of any Breach of Unsecured PHI. Notification will include:

• Identification of each individual affected
• A brief description of the breach, including date and date of discovery
• Description of types of PHI involved
• Steps individuals should take to protect themselves
• Steps Business Associate is taking to investigate, mitigate, and prevent recurrence

6.2 Investigation

Business Associate will conduct a prompt investigation of any suspected breach and cooperate fully with Covered Entity in all breach response activities.

6.3 Mitigation

Business Associate will take all reasonable steps to mitigate any harmful effects of the breach and prevent future breaches.