Attachment C — Business Associate Agreement
BUSINESS ASSOCIATE ADDENDUM
This Business Associate Addendum (“Addendum”) by and between MDx Medical Inc. dba Sapphire
Digital and City of Nashua (“Covered Entity”), is entered into for the purposes of complying with the
Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), Public Law 104-191, the Health
Information Technology for Economic and Clinical Health Act (the “HITECH Act”), Public Law 111-005,
and the regulations promulgated thereunder; 45 C.F.R. Parts 160 and Part 164, Subparts A, C, D and E
(Subpart E, together with the definitions in Subpart A is known as the “Standards for Privacy of Individually
Identifiable Health Information” (the “Privacy Rule’) and Subpart C, together with the definitions in
Subpart A, is known as the “Security Standards for the Protection of Electronic Protected Health
Information” (the “Security Rule”) Subpart D, together with the definitions in Subpart A is known as the
“Breach Notification Rule” (“Breach Notification Rule’) (the Privacy Rule, Breach Notification Rule and
the Security Rule are collectively called the “Privacy and Security Rules”) Sapphire Digital and Covered
Entity are each referred to herein as a “Party” and collectively referred to as the “Parties.”
WHEREAS, Covered Entity is a “Covered Entity” as that term is defined under HIPAA, which requires
Covered Entities and certain of their service providers to enter into business associate agreements;
WHEREAS, Sapphire Digital may create on behalf of, or receive from, the Covered Entity or the Covered
Entity’s other service providers protected health information (“PHI”); and
WHEREAS, upon creation or receipt of such PHI, Sapphire Digital would be a “Business Associate” in
relation to the Covered Entity, as that term is defined under HIPAA.
NOW, THEREFORE, in consideration of the premises and the mutual promises contained herein,
Covered Entity and Sapphire Digital hereby agree as follows:
1. Capitalized Terms. A!l capitalized terms herein not otherwise defined shall have the meaning ascribed to
such terms under HIPAA, the HITECH Act and the Privacy and Security Rules, as may be amended from
time to time.
2. Sapphire Digital’s Responsibilities with Respect to Use and Disclosure of PHI. Sapphire Digital hereby
agrees, with regard to its Use and/or Disclosure of the PHI, to do the following:
a. to Use and/or Disclose the PHI only: (i) in conjunction with the services it provides to Covered
Entity (“the Services”); (11) consistent with the manner in which Covered Entity is permitted to Use
and Disclose by 45 C.F.R. 164.502 (as amended from time to time) and/or 45 C.F.R. § 164.512;
(iii) for Sapphire Digital’s proper management and administration; (iv) to fulfill any present or
future legal responsibilities; (v) as otherwise permitted or required by this Addendum; or (vi) as
otherwise permitted or required by law.
b. to report to Covered Entity, in writing, any material Use and/or Disclosure of the PHI by Sapphire
Digital that is not permitted or required by this Addendum of which Sapphire Digital becomes
aware;
c. to use commercially reasonable efforts to maintain the security of the PHI and to prevent its Use
and/or Disclosures contrary to this Addendum;
10
