Carrot Fertility Inc 1/19/2023 - Laserfiche WebLink

15039916.1 Business Associate Agreement This Business Associate Agreement (“Agreement”) is entered into, effective as of February 1, 2023, by and between Carrot Fertility, Inc. (“Business Associate”) and City of Everett (the “Plan Sponsor”), on behalf of the City of Everett Health Reimbursement Arrangement (HRA) Plan (“the Plan”). The parties acknowledge and agree that the Plan Sponsor intends to treat certain services provided by the Business Associate pursuant to the parties’ separate services agreement (the “Customer Agreement”) as provided under a group health plan within the meaning of the Employee Retirement Income Security Act of 1974. The parties further acknowledge and agree that the Plan Sponsor intends to treat the Plan as a “covered entity” within the meaning of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health ("HITECH") Act, and implementing regulations, including the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164 (collectively, the “HIPAA Rules”). Accordingly, this Agreement is necessary in the event or to the extent that, in providing services to the Plan Sponsor pursuant to the Customer Agreement, the Business Associate creates, receives, uses or discloses Protected Health Information, including Electronic Protected Health Information, regarding any participant in the Plan. The Plan Sponsor and the Business Associate hereby agree as follows: 1. Definitions Capitalized terms used herein without definition shall have the respective meanings assigned to such terms under the HIPAA Rules. 2. Obligations and Activities of Business Associate Business Associate agrees to: (a) Not use or disclose Protected Health Information other than as permitted or required by the Agreement or as Required By Law; (b) Use appropriate safeguards and comply, where applicable, with subpart C of 45 CFR Part 164 with respect to Electronic Protected Health Information, to prevent use or disclosure of Protected Health Information other than as provided for by the Agreement; (c) Report to the Plan any Use or Disclosure of Protected Health Information not provided for by the Agreement of which it becomes aware, including any Breach of Unsecured Protected Health Information as required at 45 CFR 164.410, and any Security Incident of which it becomes aware as soon as reasonably possible, but in no case later than within ten (10) business days. Notice is hereby deemed provided, and no further notice will be provided, of unsuccessful attempts at such unauthorized access, use or disclosure, such as pings and other broadcast attacks on a firewall, denial of service attacks, port scans, unsuccessful login attempts, or interception of encrypted information where the key is not compromised, or any combination of the above, so long as no such incident results in unauthorized access to, or use or disclosure of, the Plan's electronic PHI; (d) In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any subcontractors that create, receive, maintain, or transmit Protected Health Information, DocuSign Envelope ID: D630F73D-D64F-4694-A24A-FC8220069016