Business Associate Agreement

This Business Associate Agreement (the “Agreement”) is entered into between the organization identified in the signature block below (“Covered Entity”) and CyberDefenseDesk LLC d/b/a Valley CISO, an Arizona limited liability company (“Business Associate”), and is effective on the date it is signed below.

This Agreement supplements, and is incorporated into, the service agreement, work order, or statement of work between the parties (the “Underlying Agreement”). Valley CISO does not take administrative access to any system that may hold protected health information until this Agreement is signed and a scoped work order identifies the systems we may touch.

1. Definitions

Capitalized terms used but not defined here have the meaning given to them in the HIPAA Rules: 45 CFR Parts 160, 162 and 164, as amended, including by the HITECH Act and the Omnibus Rule.

• “Protected Health Information” or “PHI” means individually identifiable health information that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity, including electronic PHI (“ePHI”).
• “Security Incident”, “Breach”, “Unsecured PHI”, “Subcontractor”, “Required By Law”, and “Designated Record Set” have the meanings assigned in the HIPAA Rules.

2. Permitted uses and disclosures

• Business Associate may use and disclose PHI only to perform the services described in the Underlying Agreement, as Required By Law, or as otherwise permitted by this Agreement.
• Business Associate may use PHI for its proper management and administration and to carry out its legal responsibilities, and may disclose PHI for those purposes only where the disclosure is Required By Law or the recipient agrees in writing to protect the PHI and to notify Business Associate of any breach of its confidentiality.
• Business Associate will not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity.
• Business Associate will not sell PHI or use or disclose PHI for marketing or fundraising.
• Business Associate will limit uses, disclosures, and requests of PHI to the minimum necessary to accomplish the intended purpose.
• De-identified information created in accordance with 45 CFR 164.514(a)-(c) is not PHI and may be used for service improvement and aggregate benchmarking.

3. Safeguards

Business Associate will use appropriate administrative, physical, and technical safeguards, and will comply with Subpart C of 45 CFR Part 164 with respect to ePHI, to prevent use or disclosure of PHI other than as provided for by this Agreement. Safeguards include unique named accounts, multi-factor authentication for remote and administrative access, encryption of ePHI in transit and at rest on Business Associate-controlled systems, least-privilege access, session logging, and documented workforce security training.

4. Who may handle your data

Work is performed only by Valley CISO / CyberDefenseDesk LLC authorized workforce members: our staff in Gilbert, Arizona and our local technician serving Solvang, the Santa Ynez Valley, and Santa Barbara County, California. All of them are US-based. PHI is not stored, accessed, or processed outside the United States.

Every authorized workforce member is bound by written confidentiality obligations and by the access-control, logging, and security requirements of this Agreement. Access to PHI is limited to the minimum necessary to perform the scoped work.

We do not use offshore support or an outsourced help desk. If a Subcontractor is ever required, Business Associate will tell Covered Entity in advance and will not grant access until that Subcontractor has agreed in writing to restrictions and conditions at least as restrictive as those that apply to Business Associate under this Agreement, as required by 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2).

5. Reporting and breach notification

• Business Associate will report to Covered Entity any use or disclosure of PHI not permitted by this Agreement, and any Security Incident of which it becomes aware, without unreasonable delay and in no case later than ten (10) calendar days after discovery.
• Business Associate will report a Breach of Unsecured PHI without unreasonable delay and in no case later than ten (10) calendar days after discovery, and will provide the information required by 45 CFR 164.410 as it becomes available, including the identification of each individual whose PHI was or is reasonably believed to have been accessed, acquired, used, or disclosed.
• Unsuccessful Security Incidents that result in no unauthorized access, use, disclosure, modification, or destruction of PHI — such as routine port scans, blocked login attempts, and filtered malware — are reported in the aggregate in the regular service report rather than individually.
• Business Associate will mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure of PHI in violation of this Agreement.

6. Individual rights

• Access: within ten (10) business days of a written request, Business Associate will make available PHI in a Designated Record Set it maintains so Covered Entity can meet its obligations under 45 CFR 164.524.
• Amendment: Business Associate will make PHI available for amendment and incorporate amendments as directed by Covered Entity under 45 CFR 164.526.
• Accounting: Business Associate will maintain and make available the information required to provide an accounting of disclosures under 45 CFR 164.528.
• Business Associate will, to the extent it carries out one or more of Covered Entity's obligations under Subpart E of 45 CFR Part 164, comply with the requirements that apply to Covered Entity in performing those obligations.
• Requests for PHI received directly from an individual will be forwarded to Covered Entity; Business Associate does not respond on Covered Entity's behalf unless instructed in writing.

7. Access to books and records

Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining Covered Entity's compliance with the HIPAA Rules.

8. Obligations of Covered Entity

• Covered Entity will notify Business Associate of any limitation in its notice of privacy practices, of any changes in or revocation of an individual's permission to use or disclose PHI, and of any restriction agreed to under 45 CFR 164.522, to the extent any of these affect Business Associate's use or disclosure of PHI.
• Covered Entity will not ask Business Associate to use or disclose PHI in a way that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity.
• Covered Entity is responsible for approving security changes, paying for required licenses, and maintaining its own cyber liability insurance.

9. Term and termination

• This Agreement begins on the signature date and continues until all PHI is returned or destroyed, or protections are extended under the section below.
• Covered Entity may terminate the Underlying Agreement and this Agreement if Business Associate materially breaches this Agreement and fails to cure the breach within thirty (30) days of written notice.
• On termination, Business Associate will return or destroy all PHI it maintains and retain no copies, where feasible. Where return or destruction is not feasible, Business Associate will extend the protections of this Agreement to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as it retains the PHI.
• Sections covering safeguards, reporting, records access, and survival continue after termination.

10. Insurance, liability and general terms

• Business Associate maintains cyber liability and technology errors and omissions coverage; a certificate of insurance is available on request.
• This Agreement is governed by the laws of the State of Arizona, except where the HIPAA Rules control. Any ambiguity is resolved to permit compliance with the HIPAA Rules.
• If any term conflicts with the Underlying Agreement regarding PHI, this Agreement controls.
• This Agreement may be signed electronically and in counterparts; an electronic signature captured on this page has the same effect as a handwritten signature under the federal E-SIGN Act and the Arizona Electronic Transactions Act.
• Amendments must be in writing and signed by both parties, except that the parties agree to amend this Agreement as necessary to comply with changes in the HIPAA Rules.
• Nothing in this Agreement creates third-party beneficiary rights, and nothing here is a legal opinion that Covered Entity is “HIPAA compliant.”

11. Other regulated industries

Organizations outside healthcare — for example financial services under GLBA, or defense suppliers under CMMC — may require a different addendum instead of this Agreement. Raise it during the intro call and we will send the correct one.

Signature

CyberDefenseDesk LLC d/b/a Valley CISO countersigns every executed copy and returns it to the signer by email. Sign below; the executed version, its date, the signer, and the IP address are retained as the record of execution.