Business Associate Agreement

The MedTality app assesses and matches healthcare workers. It is not built to hold patients' health information, and most employers never need to share any with us.

Virtual Staff is different. A scheduler, receptionist or patient support worker we place with a practice may work with that practice's patient records. Where MedTality is the party that engages that worker, it acts as the practice's business associate under HIPAA, and this agreement applies. We sign it with the practice before the worker is given any access.

An organization that hires a candidate directly, as its own employee, does not need this agreement for that hire: the worker becomes part of its own workforce. An organization whose compliance program requires a business associate agreement for another MedTality service can ask us for one.

This Business Associate Agreement (the "Agreement") is between MedTality ("MedTality") and the healthcare provider or organization named in the order form or staffing agreement that references it (the "Practice").

The Practice is a covered entity, or a business associate of one, under the Health Insurance Portability and Accountability Act of 1996, as amended by the HITECH Act, and their implementing regulations (together, "HIPAA"). MedTality provides the Practice with Virtual Staff services under that order form or staffing agreement (the "Services Agreement"). In doing so, MedTality's Placed Workers may create, receive, maintain or transmit protected health information on the Practice's behalf.

This Agreement sets out how MedTality may use and disclose that information and how it must protect it, as required by 45 C.F.R. §§ 164.308, 164.314, 164.410 and 164.504(e).

Capitalized terms used but not defined in this Agreement have the meanings given to them in HIPAA, including Breach, Designated Record Set, Disclosure, Individual, Minimum Necessary, Required by Law, Secretary, Security Incident, Unsecured Protected Health Information and Use. In addition:

• “PHI” means protected health information, as defined in 45 C.F.R. § 160.103, that MedTality or a Placed Worker creates, receives, maintains or transmits on behalf of the Practice. It includes electronic PHI.
• “Placed Worker” means a person MedTality employs or engages and places with the Practice to perform the Services, whether as MedTality's employee or as its contractor.
• “Practice Systems” means the record, scheduling, phone, messaging and other systems the Practice controls and gives a Placed Worker access to.
• “Platform” means the MedTality website and apps, which MedTality uses to match, place and manage Placed Workers, and which are not used to hold PHI.
• “Services” means the Virtual Staff services MedTality provides to the Practice under the Services Agreement.
• “Subcontractor” means a person or company to whom MedTality delegates a function involving PHI, including a Placed Worker who is MedTality's contractor rather than its employee.
• “Business day” means a day other than a Saturday, Sunday or US federal holiday.

The parties agree that PHI stays in the Practice Systems. In particular:

• Placed Workers reach PHI only through accounts the Practice issues to them in the Practice Systems, and work with it only there.
• Placed Workers do not copy, download, print, photograph or forward PHI outside the Practice Systems, and do not store it on any device, except as the Practice's written policies allow.
• Neither party puts PHI into the Platform, including in messages, timesheets, documents or support requests.

If PHI reaches the Platform despite this, MedTality will protect it under this Agreement, delete it once it is found, and treat its arrival as a use or disclosure to report under Section 8 where this Agreement requires.

To provide the Services

MedTality and its Placed Workers may use and disclose PHI as necessary to perform the Services for the Practice, following the Practice's instructions and policies, provided that the use or disclosure would not violate HIPAA if done by the Practice itself.

Management and administration

MedTality may use PHI for its own proper management and administration and to carry out its legal responsibilities. It may disclose PHI for those purposes only if the disclosure is Required by Law, or if MedTality first obtains reasonable written assurances from the recipient that it will hold the PHI confidentially, use or further disclose it only as Required by Law or for the purpose for which it was disclosed, and notify MedTality of any instance in which the confidentiality of the PHI has been breached.

Required by law

MedTality may use or disclose PHI as Required by Law. Unless the law prohibits it, MedTality will notify the Practice before making such a disclosure, so the Practice can seek a protective order or other remedy.

Minimum necessary

MedTality will limit every use, disclosure and request for PHI to the minimum necessary to accomplish its intended purpose, in accordance with 45 C.F.R. § 164.502(b) and the Practice's reasonable minimum necessary policies that it shares with MedTality.

MedTality will not use or disclose PHI other than as this Agreement permits or as Required by Law. It will not:

• Sell PHI, or receive any payment, direct or indirect, in exchange for PHI.
• Use or disclose PHI for marketing or fundraising.
• Use PHI, or information de-identified from it, to train or improve artificial intelligence models, or to build, test or score any MedTality assessment.
• Use PHI to assess, rate or market a Placed Worker or any other candidate.
• Use or disclose PHI in any manner that would violate Subpart E of 45 C.F.R. Part 164 if done by the Practice, except as Section 5 permits for MedTality's management and administration.

Where MedTality carries out one of the Practice's obligations under Subpart E of 45 C.F.R. Part 164, it will comply with the requirements of that Subpart that apply to the Practice in carrying out that obligation.

MedTality will use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI, to prevent any use or disclosure of PHI other than as this Agreement provides.

Our program

• Maintain written security and privacy policies, a designated security official and privacy official, and a risk analysis of the Services that is reviewed at least once a year and after any major change.
• Apply a sanctions policy to any Placed Worker or member of its workforce who breaks this Agreement or those policies.
• Maintain an incident response plan, and review it at least once a year.

Placed Workers

Before a Placed Worker is given access to PHI, and for as long as they have it, MedTality will:

• Verify their identity, and verify the credentials their role requires.
• Bind them in writing to keep PHI confidential, to follow this Agreement and the Practice's policies, and to report any suspected Breach or Security Incident to MedTality at once, an obligation that continues after their placement ends.
• Train them on HIPAA privacy and security before their first day with access, and every year after.
• Require them to work only on a device protected by a password or biometric lock, with current security updates, full-disk encryption and screen lock, and from a private place where PHI on screen or in calls cannot be seen or heard by others, together with any further requirements the Practice sets in writing.
• Require them to use only their own accounts in the Practice Systems, never to share them, and to use multi-factor authentication wherever the Practice Systems offer it.

Reports under this section are sent to the Practice's designated privacy contact, or to the contact named in its order form if no privacy contact has been named.

Breaches of unsecured PHI

MedTality will notify the Practice of any Breach of Unsecured Protected Health Information without unreasonable delay, and in no case later than ten business days after discovering it. A Breach is treated as discovered on the first day it is known to MedTality, or would have been known by exercising reasonable diligence, as set out in 45 C.F.R. § 164.410(a)(2).

The notice will include, to the extent then known, the identity of each Individual whose PHI was or is reasonably believed to have been involved, a description of what happened, the dates of the Breach and of its discovery, the types of PHI involved, the steps MedTality is taking to investigate, mitigate harm and prevent a recurrence, and any other information the Practice needs to notify Individuals, the Secretary and, where required, the media under 45 C.F.R. §§ 164.404 to 164.408. MedTality will supplement the notice as more information becomes available.

Other unpermitted uses and disclosures

MedTality will report to the Practice any use or disclosure of PHI not provided for by this Agreement within ten business days of becoming aware of it, whether or not it amounts to a Breach.

Security incidents

MedTality will report to the Practice any successful Security Incident involving electronic PHI within ten business days of becoming aware of it. If MedTality believes a Placed Worker's account in the Practice Systems may be compromised, it will tell the Practice within one business day, so the Practice can suspend the account. The parties agree that this section serves as notice, with no further report required, of unsuccessful Security Incidents, such as pings, port scans, denied sign-in attempts and blocked phishing attempts, that do not result in unauthorized access to, or use, disclosure, modification or destruction of, PHI.

Mitigation and cooperation

MedTality will mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure of PHI in violation of this Agreement. It will cooperate with the Practice's investigation, including by making Placed Workers available to answer questions, and keep the Practice informed as its own investigation proceeds. MedTality will not notify affected Individuals, regulators or the media of a Breach on the Practice's behalf unless the Practice asks it to in writing.

Notification costs

Where a Breach is caused by MedTality, a Placed Worker or a Subcontractor, MedTality will reimburse the Practice for the reasonable costs of the notifications that HIPAA or other applicable law requires the Practice to give, and of any credit monitoring that law or regulators require it to offer.

In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), MedTality will ensure that every Subcontractor, including every Placed Worker engaged as a contractor, first agrees in writing to the same restrictions, conditions and requirements that apply to MedTality under this Agreement. MedTality remains responsible to the Practice for the acts and omissions of its Placed Workers and Subcontractors with respect to PHI.

The companies that run the Platform, listed on our subprocessors page, are not intended to receive PHI, because PHI stays in the Practice Systems. MedTality will not route PHI through any of them unless that company has first agreed in writing to the terms this section requires.

If MedTality learns of a pattern of activity or practice of a Placed Worker or Subcontractor that is a material breach of its agreement with MedTality, MedTality will take reasonable steps to cure the breach or end the violation, and if those steps fail, will end that person's access to PHI and ask the Practice to remove their accounts.

Placed Workers may live and work outside the United States, in the countries the order form names. They reach PHI only through the Practice Systems, under this Agreement, wherever they are. PHI is not stored outside the Practice Systems, so it stays wherever the Practice keeps it.

The Practice is responsible for confirming, before access begins, that access to PHI from those countries is allowed by its contracts, including any contract with a health plan or government program that limits offshore access, and by any state law that applies to it. MedTality will give the Practice the information about each Placed Worker's location that it needs to do so, and tell the Practice before a Placed Worker works from a different country.

Access and amendment

PHI stays in the Practice Systems, so MedTality does not expect to maintain a Designated Record Set. To the extent it does, it will make PHI available to the Practice, and make any amendment the Practice directs, within ten business days of the Practice's request, so the Practice can meet its obligations under 45 C.F.R. §§ 164.524 and 164.526.

Accounting of disclosures

MedTality will document disclosures of PHI by it and its Placed Workers as needed for the Practice to respond to a request for an accounting of disclosures under 45 C.F.R. § 164.528, and will provide that information to the Practice within ten business days of its request.

Restrictions and confidential communications

MedTality will comply, and require its Placed Workers to comply, with any restriction on the use or disclosure of PHI, or request for confidential communications, that the Practice has agreed to under 45 C.F.R. § 164.522 and tells MedTality about, to the extent it affects their use or disclosure of PHI.

Requests made to MedTality

If an Individual makes any of these requests directly to MedTality or a Placed Worker, MedTality will forward it to the Practice within five business days and will not respond to the Individual itself unless the Practice directs it to.

The Practice will:

• Issue each Placed Worker their own accounts in the Practice Systems, with only the access their role requires, and remove that access promptly when MedTality tells it a placement has ended or should be suspended, and in any case on the last day of the placement.
• Keep the Practice Systems secure, including their audit logs, and share with MedTality the policies it expects Placed Workers to follow.
• Tell MedTality of any limitation in its Notice of Privacy Practices, and of any change in or revocation of an Individual's permission, to the extent it may affect how Placed Workers use or disclose PHI.
• Not ask MedTality or a Placed Worker to use or disclose PHI in any manner that would not be permitted under HIPAA if done by the Practice, or to put PHI into the Platform.
• Confirm that offshore access is allowed, as Section 10 describes.

MedTality will make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary for the purpose of determining compliance with HIPAA. Unless the law prohibits it, MedTality will tell the Practice of any such request and give it a copy of anything it provides.

Once a year, and following any Breach, MedTality will on request give the Practice a completed security questionnaire, a summary of its most recent risk analysis, and records showing that each Placed Worker with access to the Practice's PHI has signed the agreements and completed the training Section 7 requires.

Term

This Agreement takes effect on the earlier of the date the Practice signs an order form or staffing agreement that references it and the date a Placed Worker is first given access to PHI. It continues for as long as the Services Agreement is in effect, and after that until all PHI has been returned or destroyed as set out below.

Termination for breach

If either party determines that the other has materially breached this Agreement, it will give the other written notice describing the breach. If the breach is not cured within 30 days of that notice, the non-breaching party may end this Agreement and the affected parts of the Services Agreement. Where cure is not possible, it may end them immediately. The Practice may also suspend any Placed Worker's access to PHI at any time.

Return or destruction of PHI

When this Agreement ends, and whenever a Placed Worker's placement ends, MedTality will ensure that the Placed Worker returns or destroys any PHI they hold outside the Practice Systems, and keeps no copies. Within 30 days after this Agreement ends, MedTality will return to the Practice or destroy all PHI it and its Placed Workers and Subcontractors still hold, retain no copies, and certify the return or destruction in writing.

Where returning or destroying any PHI is infeasible, MedTality will tell the Practice why, extend the protections of this Agreement to that PHI, and limit its further use and disclosure to the purposes that make return or destruction infeasible, for as long as it is held.

Survival

MedTality's obligations under this section, and under the sections on restrictions, safeguards and reporting for as long as it or any Placed Worker holds any PHI, survive the end of this Agreement.

Precedence

This Agreement forms part of the Services Agreement. If they conflict on any matter relating to PHI, this Agreement controls.

Changes in law

The parties will amend this Agreement as necessary for either of them to comply with any change in HIPAA. Any reference to a section of HIPAA means that section as in effect or as amended, and any ambiguity in this Agreement will be resolved in favor of a meaning that permits both parties to comply with HIPAA.

Amendments to this text

MedTality may publish updated versions of this Agreement on this page. An update applies to an existing Practice only if the Practice accepts it in writing, or if it is required by a change in law and MedTality gives the Practice at least 30 days' notice. No other amendment is effective unless it is in writing and signed by both parties.

Assignment

The Practice may assign this Agreement to a successor of its practice. MedTality may assign this Agreement, with notice to the Practice, to an affiliate or to a successor to the MedTality business that takes on all of MedTality's obligations under it. Otherwise, neither party may assign this Agreement without the other's written consent.

Other terms

• No third-party beneficiaries. Nothing in this Agreement gives any person other than the Practice and MedTality, and their permitted successors and assigns, any rights, remedies, obligations or liabilities.
• Independent parties. MedTality is an independent contractor and not an agent of the Practice for purposes of federal common law under HIPAA.
• Governing law. This Agreement is governed by HIPAA and, to the extent not preempted by it, by the law that governs the Services Agreement.
• Notices. Notices are sent to the contacts each party names in the order form or staffing agreement.

The Practice accepts this Agreement by signing an order form or staffing agreement that references it. We send it with every Virtual Staff order form, and both are signed before a Placed Worker is given any access to PHI. Each party receives a countersigned copy.

A group, management services organization or health system may sign one Agreement that covers each of its affiliated practices named in its order form. Each such practice is then a Practice under this Agreement.

If your organization has its own template, we are glad to review it in place of this one. To ask for a copy to sign, or to send us yours, reach us through Support or the contact in your order form.