HIPAA Business Associate Agreement

1. Parties and purpose

This Business Associate Agreement (BAA) is between Cue ABA LLC (Business Associate, Cue) and the clinic that accepts it (Covered Entity). It applies when the Covered Entity is a covered entity under HIPAA, or a business associate of one, in which case Cue is its subcontractor and "Covered Entity" means that business associate.

Cue provides the Service under the Cue Terms of Service (the Terms). In doing so it creates, receives, maintains or transmits protected health information on the Covered Entity's behalf. This BAA sets out how Cue protects it, as required by the Health Insurance Portability and Accountability Act of 1996, the HITECH Act, and their implementing regulations at 45 CFR Parts 160 and 164 (together, HIPAA).

The BAA takes effect when the Covered Entity accepts it and is part of the Terms. If the BAA and the Terms conflict on PHI, the BAA governs.

2. Definitions

Capitalized terms used but not defined here have the meanings given in HIPAA, including Breach, Data Aggregation, Designated Record Set, Health Care Operations, Individual, Minimum Necessary, Required by Law, Secretary, Security Incident, Subcontractor and Unsecured Protected Health Information. PHI means protected health information, including electronic PHI, that Cue creates, receives, maintains or transmits for or from the Covered Entity.

3. Permitted uses and disclosures

Cue may use and disclose PHI only:

• to provide the Service under the Terms, and as the Covered Entity or its Authorized Users direct through the Service;
• as Required by Law;
• for Cue's proper management and administration or to carry out its legal responsibilities. Disclosures for these purposes are allowed only if Required by Law, or if Cue obtains reasonable written assurance that the recipient will keep the PHI confidential, use or further disclose it only as Required by Law or for the purpose for which it was disclosed, and notify Cue of any breach of confidentiality it becomes aware of;
• to provide Data Aggregation services relating to the Covered Entity's Health Care Operations, when the Covered Entity asks for them;
• to de-identify PHI in accordance with 45 CFR 164.514(a)–(c). De-identified information is no longer PHI and may be used as the Terms allow.

Cue will not use or disclose PHI in a way that would violate Subpart E of 45 CFR Part 164 if done by the Covered Entity, except as allowed above for management, administration and Data Aggregation. Cue will follow the Minimum Necessary standard. Cue will not sell PHI, use it for marketing, or use it to train artificial intelligence models.

4. Safeguards

Cue will use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 CFR Part 164 (the Security Rule) for electronic PHI, to prevent use or disclosure of PHI other than as this BAA allows. These include encryption of PHI in transit and at rest, unique user identification, role-based access, isolation of each clinic's data, audit logging, workforce training, risk analysis, and tested backup and recovery.

5. Reporting incidents and breaches

• Cue will report to the Covered Entity any use or disclosure of PHI not allowed by this BAA, and any Security Incident, of which it becomes aware.
• Cue will notify the Covered Entity of a Breach of Unsecured PHI without unreasonable delay, and in any case within 10 business days after discovering it, as provided in 45 CFR 164.410. The notice will include, to the extent known, the Individuals affected, what happened, the PHI involved, what Cue is doing to investigate and mitigate it, and a contact person. Cue will supplement the notice as more information becomes available and will cooperate with the Covered Entity's notifications to Individuals, the Secretary and the media.
• Cue will mitigate, to the extent practicable, any harmful effect of a use or disclosure of PHI in violation of this BAA that is known to Cue.
• This section is notice of the ongoing existence of unsuccessful Security Incidents, such as pings, port scans, blocked log-in attempts and denial-of-service attempts that do not result in unauthorized access, use or disclosure of PHI. No further notice of them is required.
• Reports go to the Covered Entity's account owner. The Covered Entity can reach Cue's security team at security@cueaba.com.

6. Subcontractors

Cue will ensure, in accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), that any Subcontractor that creates, receives, maintains or transmits PHI on Cue's behalf agrees in writing to the same restrictions, conditions and requirements that apply to Cue under this BAA. The current list is at app.cueaba.com/legal/subprocessors.

7. Individuals' rights

• Access: within 15 business days of a request, Cue will make PHI in a Designated Record Set available to the Covered Entity so it can meet 45 CFR 164.524, including in electronic form. Much of this can be done directly through the Service's export tools.
• Amendment: within 15 business days of a request, Cue will make amendments to PHI in a Designated Record Set that the Covered Entity directs under 45 CFR 164.526, or enable the Covered Entity to make them in the Service.
• Accounting: Cue will document disclosures of PHI and, within 15 business days of a request, give the Covered Entity the information it needs to provide an accounting under 45 CFR 164.528.
• If an Individual asks Cue directly for any of these, Cue will forward the request to the Covered Entity within 10 business days and will not respond itself unless the Covered Entity directs it to.
• To the extent Cue carries out an obligation of the Covered Entity under Subpart E of 45 CFR Part 164, Cue will comply with the requirements of Subpart E that apply to the Covered Entity in carrying out that obligation.

8. Access by the Secretary

Cue will make its internal practices, books and records relating to PHI available to the Secretary of Health and Human Services for determining compliance with HIPAA, and will tell the Covered Entity about any such request unless the law prohibits it.

9. Covered Entity's obligations

• Notify Cue of any limitation in its notice of privacy practices, any change in or revocation of an Individual's permission, and any restriction on use or disclosure it has agreed to, to the extent it affects Cue's use or disclosure of PHI.
• Not ask Cue to use or disclose PHI in a way that HIPAA would not allow the Covered Entity to.
• Configure the Service appropriately: manage Authorized Users, assign roles, and only share PHI with families, payers and other recipients that are permitted to receive it.

10. Term and termination

This BAA lasts as long as Cue holds PHI for the Covered Entity. If either party materially breaches it, the other may give written notice and an opportunity to cure. If the breach is not cured within 30 days, the non-breaching party may terminate the BAA and the affected parts of the Terms.

When the Terms end, Cue will make PHI available for export for 60 days, and will then return or destroy all PHI it still holds, including PHI held by its Subcontractors, and keep no copies. If returning or destroying some PHI is not feasible, for example in backups that are rotated on a fixed schedule or where the law requires retention, Cue will extend this BAA's protections to it and limit further use and disclosure to the purposes that make return or destruction infeasible, for as long as Cue keeps it.

11. General

• Amendment: the parties will amend this BAA as needed to comply with changes in HIPAA. Cue may publish an updated version for that purpose with notice to the account owner.
• Interpretation: any ambiguity will be resolved to permit compliance with HIPAA. References to a regulation mean that regulation as amended.
• No third-party beneficiaries: nothing in this BAA gives rights to anyone other than the parties.
• Liability for breaches of this BAA is subject to the limitation of liability in the Terms.
• Survival: Cue's obligations regarding PHI it keeps after termination survive termination.
• Notices under this BAA go to legal@cueaba.com for Cue, and to the account owner's email address for the Covered Entity.