ResMed Data Products Services Agreement
PLEASE READ THIS RESMED DATA PRODUCTS SERVICES
AGREEMENT ("AGREEMENT") CAREFULLY BEFORE USING RESMED SYSTEMS,
SERVICES OR ONLINE COMMUNICATION MODULES OR CARDS ("RESMED DATA PRODUCTS")
FOR CUSTOMERS. BY USING RESMED DATA PRODUCTS YOU AGREE TO BE BOUND BY THE TERMS
OF THIS AGREEMENT. IF YOU DO NOT AGREE TO THE TERMS OF THIS AGREEMENT, DO NOT
USE RESMED DATA PRODUCTS. IN THE EVENT YOU DO NOT AGREE TO THE TERMS OF THIS
AGREEMENT, PLEASE CONTACT RESMED CUSTOMER SERVICE AT 1 (800) 424-0737 (US) OR 1
(800) 658 189 (ANZ) TO DISCUSS THE RETURN AND/OR DISABLING OF YOUR RESMED DATA PRODUCTS.
ANY RESMED DATA PRODUCT RETURNS MUST BE SUBMITTED IN ACCORDANCE WITH RESMED'S
GENERAL TERMS AND CONDITIONS OF SALE AS NOTED ON THE BACK OF YOUR INVOICE.
RESTOCKING FEES MAY APPLY.
Definitions
In this
Agreement, the words "we", "us" or "our" mean ResMed Corp., its wholly-owned
subsidiaries, its affiliates and its successors or assigns (collectively,
"ResMed"). When we use the words "you" or "your" or "Customer" we mean the
customer ("Customer") who uses, accesses, purchases, or rents ResMed Data Products
in accordance with this Agreement and/or
a separate services agreement, including any person authorized by Customer to
access or receive the ResMed Data Products (each a "User"). "Services" includes
but is not limited to health related and other information, communication,
compliance, cloud-based data storage, retrieval, patient management system and
online support program provided to Customer by ResMed through one or more ResMed
Data Product websites. The Services may be modified from time to time to
include additional data services, beyond those Services offered today; those
additional services will be governed by this Agreement. "System" includes
ResMed flow generators, and any other hardware and software provided by ResMed
in connection with the Services. The "Effective Date" will be the date on which
you first agree to this Agreement.
Services
If you accept
this Agreement, then ResMed, in consideration of the Service fees paid by you, grants
a limited, non-exclusive, non-transferable, non-sublicenseable, revocable
license to Customer and its Users to access and use the ResMed Data Products websites
in accordance with the terms hereof.
Term
This Agreement
will commence on the Effective Date and will remain in effect until terminated by either party.
Fees and Payment
Customer agrees to pay for the applicable Service fee(s) for ResMed Data Products.
Patient Information
The ResMed
Data Products use algorithms and identifiers (e.g., serial numbers) to link
patient demographics to patient data. You are responsible for the accuracy and
consistency of all identifiers and patient demographic information (e.g.,
patient name, date of birth, etc.) whether entered by you or provided by
another User. The accuracy and consistency of this information will impact how
the System matches patients with patient data. You are responsible for all
clinical decisions based on patient data reported on the ResMed Data Products.
The ResMed Data Products are not intended to, and do not provide, medical
advice.
Patient data
are protected by laws and regulations governing the privacy and security of
health information. Applicable laws and regulations will depend on your local
jurisdiction. For United States Customers, we will provide ResMed Data Products
in compliance with the HIPAA Business Associate Addendum (attached hereto and
incorporated herein as Exhibit A).
Equipment and Software Requirements
You will
supply and maintain a personal computer with access to the Internet in order to
access the ResMed Data Products. Specifically, you agree (1) to utilize appropriate
browser software per ResMed’s minimum system requirements to access ResMed Data
Products; (2) supply and maintain a
modem, or similar equipment when applicable, to access the ResMed Data Products;
(3) to receive information by electronic transmission of a visual display of
text; (4) that 128-bit encryption is required for the use of the ResMed Data
Products; and (5) that our liability for viruses, worms, trojan horses, or
other similar harmful components that may enter your computer system by
downloading information, software, or other materials from using the ResMed
Data Products will be subject to the limitations set forth in the Limitation of Liability section below
and to the other provisions of this Agreement.
Access
Customer will
be required to select or will be assigned a First User Username and Password.
The First User may add, edit and inactivate additional User accounts, passwords
and access capabilities (collectively, "Access Codes"). Customer is responsible
for all User accounts and Access Codes added, edited or inactivated through the
use of the First User Username for those accounts. You acknowledge and agree
that Access Codes are required to access the ResMed Data Products. You agree to
keep all Access Codes confidential to prevent unauthorized access and to
prevent unauthorized use of the ResMed Data Products.
You also agree
to protect the security of Access Codes and other means of identification for
access to and use of the ResMed Data Products. We reserve the right to disable
your access to the Services and/or System, if we reasonably believe your Access
Codes have, or may have been, obtained in an illegal or unauthorized manner or
are being used, or may be used, by an unauthorized person(s).
By accessing
patient information through the Services, you represent and warrant that you
have obtained the right and authorization to do so from patients, either by (1)
receiving a written and signed authorization from the patient; (2) receiving
the System SD card containing patient information from or on behalf of the
patient; or (3) receiving the patient’s System serial number from the patient.
For those Services that require outbound
contacts by phone, texts or email, you represent and warrant to us that you
have obtained and will maintain all permissions, authorizations and opt-in
consents from each patient, including any
written, signed consents, as may be required under Federal, State or local laws
and regulations applicable to those outbound contact activities.
Customer and User Responsibility
Customer is
responsible for all of the equipment, cellular coverage, internet access and software
required for Users authorized by Customer to access and/or use the ResMed Data
Products. If Customer permits other persons or other entities to use the ResMed
Data Products, Customer is responsible for any Service fees incurred by such
third persons on behalf of Customer. ResMed reserves the right to terminate
your access to ResMed Data Products if not used for six (6) months.
You will
notify us immediately if you believe your account and/or your Access Code(s)
have been accessed, taken or used without your permission, or if there is a
suspected or actual violation of the security of the ResMed Data Products. In
addition, you will inform us immediately in writing of the need to deactivate
an Access Code due to potential or actual security concerns or for any other
reason.
You agree to
report to ResMed immediately the discovery of any type of discrepancy, anomaly
or error detected in information obtained from or delivered to ResMed Data
Products. You will also immediately report to ResMed the discovery of any virus
or corruption on the ResMed Data Products or on your own equipment used to
connect to or otherwise access the ResMed Data Products. You agree that it is
your responsibility to comply with all applicable laws and to ensure adequate
security of your equipment and related peripherals. As stated in the Access
section above, you are responsible for obtaining and maintaining all necessary opt-in
consents, permissions or authorizations required under Federal, State or local
laws and regulations in connection with the transmission, storage, retrieval,
access, use and/or disclosure of patient information through the ResMed Data
Products.
Representation and Warranty Regarding Home Use
You understand
that certain ResMed Data Products are intended solely for normal home use and
are not cleared by the U.S. Federal Food and Drug Administration in the United
States, or by the applicable regulatory authority in your local jurisdiction,
for use in acute healthcare settings or in other locations where the wireless
transmission of information may interfere with the operation of essential
equipment, such as life support, nuclear facilities, or aircraft navigation or
communication systems, in which interference could lead to death, personal
injury or severe physical or environmental damage. You represent and warrant
that neither you nor your Users or patients will use the ResMed Data Products in
such a location and that you will provide express instructions to your Users and
patients regarding the appropriate location for use.
You shall not
offer the ResMed Data Products outside the United States or Canada without
ResMed’s prior written consent.
ResMed Responsibility
We, or a third
party acting as our agent, are responsible for the operation and maintenance of
hardware and software necessary to deliver the ResMed Data Products. However,
neither we, nor our agent(s) will be liable:
If you have
not properly followed ResMed Data Product instructions on how to retrieve and
view data;
If your
internet access, equipment and/or the software were not working properly and
this problem was or should have been apparent to you when you attempted to
access the ResMed Data Products;
If circumstances beyond our or our agent's control prevent display of information
or the making of a data retrieval, despite precautions taken. Such
circumstances include but are not limited to computer failure,
telecommunication outages, postal strikes and other labor unrest, delays caused
by payees, fires, floods, and other natural disasters.
Maintenance
We may on a regular basis perform maintenance on our ResMed Data
Products, which may result in interrupted service or errors in the ResMed Data
Products. We also may need to change the scope of our Services from time to
time. We will attempt to provide prior notice of such interruptions and changes
but cannot guarantee that such notice will be provided.
Title and Archival of Data
Customer and/or its Users will have access to any data created by Customer and its Users
using the ResMed Data Products so long as Customer remains an active ResMed
customer. Specifically, if you discontinue purchases from ResMed, breach any of
your obligations to ResMed, or if any of your accounts are terminated for any
reason, then your access to ResMed Data Products may be modified, suspended,
reassigned, or terminated by ResMed at its sole and absolute discretion. To the
extent necessary, you grant ResMed permission to use such data for the purposes
of operating and supporting the ResMed Data Products and for the purposes of
de-identifying the data in accordance with applicable law. Furthermore, you
agree that ResMed may enable System tracking technology at its sole and
unilateral discretion, including, for example, for inventory control and/or
channel verification purposes. You agree that the ResMed Data Products are not
a permanent medical record archive or storage system. You acknowledge and agree
that it is your responsibility to download or otherwise retain any data created
in using the System and to store such data separately within your own records.
In addition, you are solely responsible for archiving the data or otherwise
complying with Customer and/or User's medical record policies and procedures.
ResMed does not provide any services related to archival of data. In the event
that ResMed does offer archiving functionality in the future, this Agreement
will be amended to address archival processes, payment, and responsibility.
Limited Warranty
ResMed warrants that, to ResMed's best knowledge, your use of the ResMed Data Products
will not infringe the intellectual property rights of any third party.
Warranty Disclaimer
ResMed does not and will not provide medical advice
or service to you or your patients. Content available through the ResMed Data
Products is solely for informational and educational purposes. Neither the
content nor the patient reports are to be used as a substitute for professional
judgment of healthcare providers in diagnosing and treating patients.
EXCEPT AS
PROVIDED IN THIS AGREEMENT, THE RESMED DATA PRODUCTS ARE PROVIDED "AS
IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING,
BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NON-INFRINGEMENT, AND THE ENTIRE RISK AS TO THE QUALITY
AND PERFORMANCE OF THE RESMED DATA PRODUCTS IS WITH YOU. SOME JURISDICTIONS
LIMIT OR DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, THEREFORE THE ABOVE
EXCLUSION OF IMPLIED WARRANTIES MAY NOT APPLY TO YOU.
ResMed does
not warrant that the functions contained in the ResMed Data Products will meet
your requirements or that its operation will be uninterrupted or error free or
compatible with the other software or hardware of your systems. RESMED'S SOLE
OBLIGATION OR LIABILITY UNDER THIS SECTION AND THE FOREGOING LIMITED WARRANTY
IS THE REPAIR OR REPLACEMENT OF THE APPLICABLE RESMED DATA PRODUCTS, OR AT
RESMED'S DISCRETION, REFUND OF SERVICE FEES PAID BY YOU FOR APPLICABLE RESMED
DATA PRODUCTS IN THE TWELVE MONTHS PRECEDING SUCH EVENT.
Limitation of Liability
IN NO EVENT
WILL RESMED BE LIABLE FOR ANY CONSEQUENTIAL, INCIDENTAL OR INDIRECT DAMAGES,
INCLUDING, WITHOUT LIMITATION, ANY LOSS OF DATA, LOSS OF PROFITS OR LOST
SAVINGS, ARISING OUT OF THIS AGREEMENT OR CONNECTED IN ANY WAY WITH THE USE,
MISUSE OR INABILITY TO USE THE RESMED DATA PRODUCTS, EVEN IF RESMED HAS BEEN
ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, OR FOR ANY CLAIM BY ANY THIRD
PARTY. SHOULD WE HAVE ANY LIABILITY TO YOU OR ANY THIRD PARTY FOR ANY DIRECT
LOSS, HARM OR DAMAGE, (EXCEPT FOR INSURED CLAIMS AND THE PARTIES' RESPECTIVE
EXPRESS INDEMNITY OBLIGATIONS), THE TOTAL LIABILITY OF RESMED FOR ALL DAMAGES,
LOSSES, AND CAUSES OF ACTION (WHETHER IN CONTRACT, TORT OR OTHERWISE ) WILL NOT
EXCEED THE LESSER OF THE AGGREGATE AMOUNT OF THE SERVICE FEES YOU HAVE PAID TO
US FOR THE APPLICABLE RESMED DATA PRODUCTS DURING THE TWELVE MONTHS IMMEDIATELY
PRECEDING THE DAY THE ACT OR OMISSION OCCURRED THAT GAVE RISE TO THE CLAIM OR
THREE THOUSAND (USD$3,000.00) UNITED STATES DOLLARS. YOU UNDERSTAND AND
ACKNOWLEDGE THAT ABSENT YOUR AGREEMENT TO THIS LIMITATION OF LIABILITY, WE
WOULD NOT PROVIDE YOU ACCESS TO THE RESMED DATA PRODUCTS. THE LIMITATIONS
PROVIDED IN THIS SECTION WILL APPLY EVEN IF ANY OTHER REMEDIES FAIL OF THEIR
ESSENTIAL PURPOSE.
Your exclusive
remedy in the event of the complete and unrecoverable failure of the ResMed
Data Products to operate or perform is limited to, at ResMed's discretion, the
reasonable cost of replacing the lost information, providing available back-up
information, or refunding the Service fees you have paid to ResMed for the
applicable ResMed Data Products during the twelve (12) months immediately
preceding the date of such failure.
Proprietary and Confidential Information
You acknowledge and agree that the ResMed Data Products are the proprietary
property of ResMed. You agree that the ResMed Data Products embody substantial
creative rights, confidential and proprietary information, copyrights,
trademarks and trade secrets, all of which will remain the exclusive property
of ResMed. You further agree that you and your employees, agents and
representatives will not copy, reproduce, modify, reverse engineer or decompile
any portion of the ResMed Data Products, and you and your employees, agents and
representatives will use the ResMed Data Products as provided in this
Agreement. Except as otherwise disclosed herein ResMed or licensed source owns
all rights, title, and interest in and to all copyright, trademark, service
mark, patent, trade secret or other intellectual property and proprietary
rights worldwide in and to the ResMed Data Products.
Indemnity
You, at your
own expense, will indemnify and hold harmless ResMed and its assignees, and their
directors, officers, employees, agents and representatives, and defend any and
all actions brought against same with respect to any claim, demand, cause of
action, debt or liability, including reasonable attorneys' fees, experts' fees,
and court costs, to the extent that it arises from or relates to the acts or
omissions of you, your Users, directors, officers, employees, agents, or
representatives, including but not limited to the use of the ResMed Data
Products or any patient data stored or transmitted using the ResMed Data
Products; or your failure or alleged failure to obtain any or all permissions,
authorizations and "opt-in" consents from each patient required under
applicable Federal, State or local laws and regulations.
Relationship of the Parties
Nothing in
this Agreement will be construed to constitute either party as the partner,
employee, or agent of the other, except that if ResMed contacts any patient
based on the consent you obtained from the patient, ResMed will be considered
your agent authorized to contact the patient within the scope of consent
provided by the patient. Neither party has any authority to bind the other in
any respect. Each party will remain an independent contractor, responsible only
for its own actions. Each party will conduct all of its business in its own
name and in such manner as such party may see fit, at its own expense.
Governing Law
The terms and
conditions of this Agreement will be governed by and construed in accordance with
the laws of the State of California, without regard or giving effect to its
conflict of laws principles.
Dispute Resolution
All controversies and claims arising under or relating to this Agreement are to be
resolved by arbitration under the Federal Arbitration Act in accordance with
the then-current rules of the American Health Lawyers Association, if you are a
United States Customer, or of the International Chamber of Commerce, if you are
a non-United States Customer, before one single independent arbitrator selected
in accordance with those rules. The arbitration is to be conducted in the
County of San Diego, California. The arbitrator is to apply California law,
without regard to its conflict of laws principles. All proceedings shall be
conducted in English. Each party shall submit to any court of competent
jurisdiction for purposes of enforcing any award, order or judgment. Any award,
order or judgment pursuant to the arbitration is final and may be entered and
enforced in any court of competent jurisdiction. Each party shall bear its own
costs, expenses and attorneys' fees (and all related costs and expenses)
incurred in connection with any proceeding arising from or related to any
transaction contemplated by this Agreement, and in connection with enforcing
any judgment or order thereby obtained. You and we further agree to waive any right to pursue a dispute by
asserting a disputed claim in a representative capacity, or participating in a
class action with respect to ResMed Data Products.
Notices
We may give
notices or other communications required under this Agreement by posting or
providing links on other communications through the sites providing access to ResMed
Data Products.
Assignment
We may assign
the rights and delegate the duties under this Agreement to a company affiliated
with us or to any other party. You may not assign the rights or obligations of
this Agreement without the prior written consent of ResMed.
Severability
It is the
desire and intent of the parties that the provisions of this Agreement shall be
enforced to the fullest extent permissible under the laws and public policies
applied in each jurisdiction in which enforcement is sought. Accordingly, if
any particular term or provision of this Agreement shall be adjudicated to be
invalid or unenforceable, this Agreement shall not be deemed null and void, but
such term or provision shall be deemed modified to the extent necessary to
render such term or provision enforceable, and the rights and obligations of
the parties shall be construed and enforced accordingly, preserving to the
fullest permissible extent the intent and agreements of the parties set forth
in this Agreement, such modification to apply only with respect to the
operation of this Agreement in that particular jurisdiction in which such
adjudication is made. If such term cannot be so modified, this Agreement shall
be deemed amended to delete therefrom the portion thus adjudicated to be
invalid or unenforceable, such deletion to apply only with respect to the operation
of this Agreement in that particular jurisdiction in which such adjudication is
made. In the event any provisions of this Agreement relating to the time
period, scope of activities or areas of restrictions shall be declared by a
court of competent jurisdiction to exceed the maximum time period, scope of
activities or area such court deems reasonable and enforceable, the time
period, scope of activities or areas of restrictions shall thereafter be deemed
the maximum which such court deems reasonable and enforceable. All provisions
not affected by any such invalidity shall remain in full force and effect to
the fullest extent possible consistent with the intent of the parties.
Miscellaneous
A waiver of
any term or provision of this Agreement at any time will not be deemed a waiver
of the term or provision in the future. This Agreement represents the full and
final agreement of the parties as to the subject matter and supersedes any
prior written or oral agreement. In the event of any conflict between this
Agreement and other agreements, the terms of this Agreement will control except
in the limited instance of a separately negotiated services agreement or business
associate agreement executed between Customer and ResMed. We reserve the right
to modify this Agreement at any time and to impose any additional terms or
conditions on your use of the ResMed Data Products. Such modifications
including any additional terms and conditions will be incorporated into this
Agreement and effective immediately. Your continued use of the ResMed Data
Products will be deemed acceptance of any such modification(s).
THIS ADDENDUM IS APPLICABLE TO UNITED STATES CUSTOMERS ONLY
Exhibit A
HIPAA BUSINESS ASSOCIATE ADDENDUM
Customer and
ResMed (defined above) have entered into a ResMed Data Services Agreement (the
"Agreement"), under which ResMed may create, receive, maintain, or transmit
protected health information ("PHI") of Customer’s patients. To the extent that
Customer is a "Covered Entity," and a ResMed entity is a "Business Associate,"
as those terms are defined under the Health Insurance Portability and
Accountability Act of 1996 ("HIPAA"), the HIPAA Omnibus Rule at 45 C.F.R. part
160 and 45 C.F.R. part 164 ("Omnibus Rule"), and the Health Information
Technology for Economic and Clinical Health Act of 2009 (the "HITECH Act") and
implementing regulations, then Customer and that ResMed entity agree as follows
with respect to access to PHI through use of one or more ResMed Data Products or
otherwise:
I. GENERAL PROVISIONS
Section 1. Effect. This HIPAA Business Associate
Addendum ("Addendum") defines, supplements, modifies and amends the Agreement
with respect to PHI. The terms and provisions of this Addendum will supersede
any other conflicting or inconsistent terms and provisions in the Agreement
with respect to PHI. Absent a different agreement, this Agreement shall govern
ResMed’s obligations with respect to PHI from Customer.
Section 2. Definitions. All capitalized terms used
herein without definition shall have the respective meanings assigned to such
terms in 45 C.F.R. Parts 160 and 164 (the "HIPAA Regulations").
Section 3. Amendment. ResMed and Customer agree to
amend this Addendum to the extent necessary to allow either ResMed or Customer
to comply with the HIPAA Regulations promulgated or to be promulgated by the
Secretary of the Department of Health and Human Services or other related
regulations or statutes.
II. OBLIGATIONS OF RESMED
Section 1. Use and Disclosure of Protected Health Information.
ResMed may use and disclose PHI only as required to satisfy
its obligations under the Agreement, as permitted by Customer, as directed by
the patient who is the subject of the PHI, or as Required by Law, but shall not
otherwise use or disclose any PHI. The parties contemplate that ResMed may
disclose PHI to subcontractors as part of the Services provided under the
Agreement. ResMed shall not, and shall ensure that its directors, officers,
employees, affiliates, subcontractors and agents do not, use or disclose PHI
received from Customer in any manner that would constitute a violation of 45
C.F.R. Parts 160 and 164, Subparts A and E (the "Privacy Standards") if used by
Customer. Except as otherwise limited in the Agreement or this Addendum, ResMed
may use PHI (i) for ResMed’s proper management and administration, (ii) to
carry out the legal responsibilities of ResMed, or (iii) to provide Data
Aggregation services relating to the Health Care Operations of Customer if
required under the Agreement. Except as otherwise limited in the Agreement or
this Addendum, ResMed may disclose PHI (i) for the proper management and
administration of ResMed, (ii) to carry out ResMed’s legal responsibilities if
(a) the disclosure is Required by Law, or (b) ResMed obtains reasonable
assurances from the person to whom the information is disclosed that it will
remain confidential and used or further disclosed only as Required by Law or
for the purpose for which it was disclosed to the person and the person
notifies ResMed of any instances of which it is aware in which the
confidentiality of the information has been breached. Further, ResMed may
de-identify any and all PHI in accordance with 45 C.F.R. § 164.514(b) and use
such de-identified data in any manner determined by ResMed. Notwithstanding any
other provision contained in this Addendum, Customer expressly authorizes
ResMed to (i) disclose PHI for the Treatment activities of a health care
provider; (ii) disclose PHI to another covered entity or health care provider
for the Payment activities of the entity that receives the PHI; and (iii)
disclose PHI to another covered entity for Health Care Operations activities of
the entity that receives the PHI, if each entity either has or had a
relationship with the Individual who is the subject of the PHI being disclosed,
the PHI pertains to such relationship, and the disclosure is for certain Health
Care Operations of the covered entity in accordance with 45 C.F.R. §
164.506(c)(4)(i).
Section 2. Safeguards Against Misuse of Information.
ResMed shall use appropriate safeguards to prevent the use or disclosure of PHI
other than pursuant to the terms and conditions of this Addendum and comply
with applicable provisions of 45 C.F.R. Part 164, Subpart C with respect to
electronic PHI that it creates, receives, maintains, or transmits on behalf of
Customer.
Section 3. Reporting of Disclosures of Protected
Health Information. ResMed will report to Customer any use or disclosure of
PHI or any Security Incident in violation of this Addendum of which it becomes
aware. Notwithstanding the foregoing, the parties acknowledge and agree that
this Section 3 constitutes notice by ResMed to Customer of the ongoing
existence and occurrence or attempts of Unsuccessful Security Incidents for
which no additional notice to Customer shall be required. Unsuccessful Security
Incidents means, without limitation, pings and other broadcast attacks on
ResMed’s firewall, port scans, unsuccessful log-on attempts, denial of service
attacks, and any combination of the above, so long as no such incident results
in unauthorized access, use or disclosure of Customer’s electronic PHI.
Section 4. Notification of Breach. ResMed shall,
within sixty (60) days following discovery of a Breach of Unsecured PHI, notify
Customer of such Breach. Such notice shall include the identity of each
Individual whose Unsecured PHI has been, or is reasonably believed to have
been, breached. ResMed’s obligation to report under Section 3 and this Section
4 is not and will not be construed as an acknowledgement by ResMed of any fault
or liability with respect to any use, disclosure, Security Incident or Breach.
Section 5. Agreements by Third Parties. ResMed
shall obtain and maintain a written agreement with each affiliate, agent or
subcontractor that creates, receives, maintains, or transmits Customer’s PHI on
behalf of ResMed. Under the agreement, such affiliate, agent or subcontractor
shall agree to the same restrictions and conditions that apply to ResMed
pursuant to this Addendum with respect to such PHI.
Section 6. Access to Information. If ResMed
maintains PHI in a Designated Record Set, as defined in 45 C.F.R. § 164.501,
then upon request of Customer, ResMed shall provide access to such PHI in a
Designated Record Set to the Individual in order for Customer to comply with
the requirements under 45 C.F.R. § 164.524. If ResMed receives a direct request
from an Individual for access to PHI, it will forward the request to Customer
to fulfill. If ResMed provides copies or summaries of PHI to an Individual it
may impose a reasonable, cost-based fee in accordance with 45 C.F.R. §
164.524(c)(4). Notwithstanding the foregoing, if the PHI that is the subject of
a request for access is maintained in one or more Designated Record Sets
electronically and if the Individual requests an electronic copy of such
information, ResMed shall provide access to the PHI in the electronic form and
format requested. Further, if an Individual’s request for access directs ResMed
to transmit the copy of PHI directly to another person designated by the Individual,
ResMed shall provide the copy to the person designated by the Individual. The
Individual’s request must be in writing, signed by the Individual, and clearly
identify the designated person.
Section 7. Availability of Protected Health Information for Amendment.
If ResMed maintains PHI in a Designated Record
Set, ResMed agrees to make available PHI for amendment and incorporate any
amendments to PHI in a Designated Record Set, in order for Customer to comply
with 45 C.F.R. § 164.526. If ResMed receives a direct request from an
Individual for amendment to PHI, it will forward the request to Customer to
fulfill.
Section 8. Accounting of Disclosures. Within
forty-five (45) days of notice by Customer to ResMed that it has received a
request for an accounting of disclosures of PHI, other than related to the
Treatment of a patient, the processing of Payments related to such Treatment,
or the Health Care Operations of a covered entity or its business associate and
not relating to disclosures made earlier than six (6) years prior to the date
on which the accounting was requested, ResMed shall make available such
information as is in ResMed’s possession and is required for Customer to make
the accounting required by 45 C.F.R. § 164.528. If ResMed receives a direct request
from an Individual for an accounting of disclosures of PHI, it will forward the
request to Customer to fulfill.
Section 9. Availability of Books and Records.
ResMed agrees to make its internal practices, books and records relating to the
use and disclosure of PHI received from, or created or received by ResMed on
behalf of, Customer available to the Secretary for purposes of determining
Customer’s compliance with the Privacy Standards.
Section 10. Remuneration in Exchange for PHI.
Except for the purposes set forth in the Agreement and as otherwise provided by
law, ResMed shall not directly or indirectly receive remuneration in exchange
for any PHI of an Individual unless Customer receives a valid HIPAA
authorization.
Section 11. Minimum Necessary. ResMed shall make
reasonable efforts to limit the use, disclosure, or request of PHI to the
minimum necessary to accomplish the intended purpose of the use, disclosure, or
request.
Section 12. Performance of Customer’s Obligations.
If ResMed agrees to carry out an obligation of Customer under 45 C.F.R. Part
164, Subpart E, ResMed shall comply with the requirements of 45 C.F.R. Part
164, Subpart E that apply to Customer in the performance of such obligations.
III. OBLIGATIONS OF CUSTOMER
Section 1. Minimum Necessary. Customer shall
disclose to ResMed only that PHI which Customer determines is reasonably
necessary to achieve the intended purpose of the disclosure.
Section 2. Changes in Policies and Procedures.
Customer shall notify ResMed prior to implementing any change in its privacy or
security policies and procedures, including its Notice of Privacy Practices,
which would affect ResMed’s obligations hereunder.
IV. TERM AND TERMINATION
Section 1. Term. This Addendum will become
effective on the Effective Date and, unless otherwise terminated as provided
herein, will have a term that will run concurrently with that of the last
expiration date or termination of the Agreement.
Section 2. Termination Upon Breach of Provisions
Applicable to Protected Health Information. Any other provision of the
Agreement notwithstanding, this Addendum and the Agreement may be terminated by
Customer upon thirty (30) days written notice to ResMed in the event that
ResMed breaches any material provision contained in this Addendum and such
breach is not cured within such thirty (30) day period.
Section 3. Effect of Termination. Upon termination
of the Agreement and this Addendum ResMed shall either return or destroy all
PHI received from Customer or created or received by ResMed on behalf of
Customer and which ResMed still maintains in any form. ResMed shall not retain
any copies of such PHI. Notwithstanding the foregoing, to the extent that it is
not feasible to return or destroy such PHI, the terms and provisions of this
Addendum shall survive termination and such PHI shall be used or disclosed
solely for such purpose or purposes which prevented the return or destruction
of such PHI.
1017838/1 2014-07 (Modified)
ResMed ReSupply Data Products Services Agreement Rev. January 2016