Business Associate Agreement

This Business Associate Agreement (“Business Associate Agreement”) is entered into by and between MSPBytes, Corp. d/b/a MSP360 (“Business Associate”) and the entity identified in the signing process (“Covered Entity”) and is effective as of the date specified in the executed agreement (“Effective Date”).

WHEREAS, Covered Entity and Business Associate are parties to a services agreement or other formal business relationship, the terms of which are incorporated herein by reference (“Underlying Agreement”) that may involve the receipt, creation, transmission, or maintenance of protected health information of Business Associate’s customers (“PHI”); and

WHEREAS, this Business Associate Agreement will apply solely to the extent that the services provided by Business Associate pursuant to the Underlying Agreement are subject to the Privacy and Security Regulations promulgated by the United States Department of Health and Human Services (“HHS”) at 45 CFR Parts 160, 162 and 164 that were issued pursuant to the Health Insurance Portability and Accountability Act of 1996, as amended, and the rules and regulations promulgated thereunder (“HIPAA”) and pursuant to the provisions of the Health Information Technology for Economic and Clinical Health Act of 2009, as amended, and the rules and regulations promulgated thereunder (“HITECH” and, together with HIPAA, the “Regulations”).

NOW, THEREFORE, for and in consideration of the mutual covenants and conditions herein, the consideration set forth in the Underlying Agreement, and other good and valuable consideration, receipt and adequacy of which are hereby acknowledged, the parties agree as follows:

1. Definitions.

Unless otherwise defined herein, capitalized terms shall have the same meaning as set forth in the Regulations.

2. Restrictions on Use of PHI.

Business Associate may use PHI only to perform the permitted and required uses and disclosures as provided by the Underlying Agreement and this Business Associate Agreement (collectively, the “Agreements”) or as required by law. Business Associate shall not use or disclose PHI received from Covered Entity in any manner that would constitute a violation of the Regulations if Covered Entity made the same use or disclosure, except that Business Associate: (a) may use or disclose such PHI to comply with Business Associate’s proper management and administration, and (b) may use or disclose such PHI for Business Associate’s legal responsibilities. Business Associate may disclose PHI for the purposes described in this Section 2 only if Business Associate obtains reasonable written assurances from the person or entity to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person or entity, and such person or entity notifies Business Associate of any instances of which it is aware in which the confidentiality of the PHI has been breached, or such disclosure is required by law. Without limiting the foregoing, Business Associate may not de-identify or aggregate PHI for any reason, except as otherwise provided in the Agreements and then solely on behalf of Covered Entity. Business Associate agrees to make its uses, disclosures and requests for protected health information consistent with Covered Entity’s minimum necessary policies and procedures.

3. Application of the Regulations to Business Associate.

Business Associate understands and acknowledges that to the extent that Business Associate is performing services under the Underlying Agreement that categorize Business Associate as a “business associate” under HIPAA, all applicable provisions of the Regulations apply directly to Business Associate and to each of its subcontractors and agents (and their subcontractors and agents) who receive or have access to the PHI and that Business Associate and each such subcontractor or agent will be subject to compliance with all applicable provisions of the Regulations, including without limitation, all applicable security and privacy laws, rules and regulations contained in or promulgated under the Regulations. Without limiting the foregoing, Business Associate shall ensure that any agent or subcontractor of Business Associate that creates, receives, maintains, or transmits PHI on behalf of Business Associate (“Subcontractor”) agrees in writing to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information (“Sub-BA Agreement”), except to the extent that any Subcontractor relationship is controlled by Covered Entity, in such case, Business Associate shall not be liable for the terms and conditions of a Sub-BA Agreement; each Sub-BA Agreement shall require the applicable Subcontractor to enter into a similar written agreement with each of its subcontractors and agents who receive, create, transmit or maintain PHI or otherwise have access to the PHI. If Covered Entity is itself a business associate (or subcontractor of a business associate) with respect to the PHI, Business Associate agrees that it shall comply with all provisions of the business associate agreement between Covered Entity and the applicable covered entity or business associate with respect to the PHI.

4. Safeguards for Protection and Security of PHI; Report of Unauthorized Use or Disclosure.

Business Associate agrees that it will implement reasonable and appropriate safeguards to prevent any use or disclosure of PHI in violation of the Agreements or the Regulations. Business Associate agrees that it will report to Covered Entity any unauthorized use or disclosure of PHI promptly (but in no event more than five (5) business days) after Business Associate becomes aware of any such violation. Business Associate’s notification to Covered Entity shall be in the content and form required by HITECH to the extent that such information is available to Business Associate. The parties acknowledge and agree that Business Associate will not be required to provide Covered Entity with notification regarding unsuccessful attempts by an unauthorized entity to access, use, disclose, modify or destroy PHI.

5. Cooperation by Business Associate.

In the event that an individual contacts Business Associate regarding access to, an amendment to, or an accounting of, PHI, Business Associate shall, promptly after receiving any such request for access, amendment or accounting, contact Covered Entity to request Covered Entity to directly make sure request or respond to such request.

6. HHS.

Business Associate agrees to make its internal practices, books and records relating to the use and disclosure of PHI received from or created or received by Business Associate on behalf of Covered Entity available to the Secretary of HHS for purposes of determining Covered Entity’s compliance with the Regulations.

7. Limitations on Use or Disclosure.

Covered Entity agrees to notify Business Associate promptly after becoming aware of any arrangements permitted or required of Covered Entity by the Regulations that may impact in any manner the use or disclosure of PHI by Business Associate under the Agreements, including: (a) restrictions on use or disclosure of PHI agreed to by Covered Entity upon request of an individual; and (b) changes in, or withdrawal of, an individual’s consent or authorization with respect to the disclosure of his/ her PHI, provided, however, that Covered Entity understands and agrees that Business Associate does not control or manage PHI and any such requests will be inapplicable to Business Associate.

8. Termination.

Business Associate agrees that any material violation of this Agreement or any material violation of that portion of the Underlying Agreement relating specifically to the permitted and required uses and disclosures of PHI by Business Associate shall constitute a material default under the Agreements. In the event of such material default, Covered Entity shall be entitled to immediately terminate this Agreement and the Underlying Agreement upon written notice to Business Associate. Upon termination of the Agreements, Business Associate shall promptly return or destroy all PHI or, if such return or destruction is not feasible, Business Associate agrees that the provisions of this Agreement shall continue to apply to such PHI, and further uses and disclosures of such PHI shall be restricted to only those purposes which make the return or destruction of the information infeasible.

9. HITECH.

Business Associate acknowledges and understands that HITECH (including the rules and regulations promulgated thereunder) imposes direct responsibility on Business Associate for its conduct as a business associate and in such capacity, that Business Associate is subject to direct liability for both civil and criminal penalties for its violations of the Regulations and may be subject to direct liability for both civil and criminal penalties for the violations of its Subcontractors.

10. Covered Entity Obligations.

a. Covered Entity will at all times comply with HIPAA in its role as a covered entity, including but not limited to implementing appropriate Administrative, Physical, and Technical safeguards to protect the confidentiality, integrity and availability of any PHI and only disclosing PHI to Business Associate to the minimum extent necessary for Business Associate to carry out its obligations pursuant to the Underlying Relationship.

b. Covered Entity understands and agrees that it selects and controls the endpoints for PHI transmitted and shared pursuant to the Underlying Relationship (“Endpoints”) and that Business Associate shall not be responsible for liability caused by an Endpoint to the extent that Business Associate’s negligent acts or omissions did not cause such liability.

c. Covered Entity agrees that Business Associate has no obligation to protect PHI under this Business Associate Agreement to the extent that Covered Entity creates, receives, maintains, or transmits such PHI outside of the ordinary services provided by Business Associate pursuant to the Underlying Relationship (including Covered Entity’s own or third party (including that of Endpoints) offline or on-premise storage tools or applications).

11. Miscellaneous.

The term of this Agreement shall co-terminus with the term of Underlying Agreement. The limitation on liability and exclusion of consequential damages provisions of the contractual terms of the Underlying Relationship shall apply to this Business Associate Agreement. All title to the PHI shall remain the sole property of Covered Entity. Any notice or other communication by either party to the other shall be in writing and shall be given in accordance with the notice provisions of the Underlying Agreement. If any portion of this Agreement is inconsistent with the terms of the Underlying Agreement, the terms of this Agreement shall prevail. This Agreement may be executed in two or more counterparts, each of which shall be deemed an original, but which together shall constitute one and the same instrument. Nothing express or implied in this Agreement is intended to confer, nor shall anything herein or therein confer, upon any person other than Covered Entity and Business Associate and their respective successors or assigns in interest, any rights, remedies, obligations, or liabilities whatsoever. The Agreements set forth the entire, final and exclusive agreement between the parties as to the subject matter hereof and thereof, and supersedes all prior and contemporaneous agreements, understandings, negotiations and discussions, whether oral or written, between the parties. Except as provided in the following sentence, any amendment or modification to this Agreement must be in writing and signed by both parties. Upon the occurrence of changes or amendments to the Regulations or other law that affect the legality of the Agreements or any provision in the Agreements, Covered Entity and Business Associate agree to modify the Agreements to the extent necessary to permit Covered Entity to comply with any changes in the Regulations. Any ambiguity in this Business Associate Agreement shall be interpreted to permit compliance with the Regulations.