top of page

TheraWe Connect Operating and Service Agreement

This Service Agreement and Health Insurance Portability and Accountability Act (“HIPAA”) Business Associate Agreement Attachment ("Agreement"), on signature date, effective immediately upon signing, is entered into by and between TheraWe Connect, LLC (“TheraWe”) and the signing organization (the “Business Associate” and “Participating Organization”), together referred to as “the Parties.” This Agreement is incorporated and part of the Service Agreement, dated upon signature, between the Parties.

 

Service Agreement
TheraWe is a software platform that is intended to facilitate deeper communication between therapists and parents to increase the quality of home therapy reinforcement. The Business Associate will start using the software platform at a mutually agreeable time between the Business Associate and TheraWe Connect. The Business Associate can choose to stop using the software platform at any time with 60-day notice. The Business Associate and participating parents will continue to have access to videos stored to private parent account(s) even if the Business Associate elects to stop using the software platform.


TheraWe is responsible for the following items:
- Providing a video communication platform for facilitating training and communication
between therapy providers and parents;
- Maintaining data privacy following HIPAA compliance standards (see Attachment 1);
- Assisting with initial platform setup and therapist/parent account creation;
- Developing new features and enhancements and notifying the therapy organization of software updates;
- Providing basic training materials for both the Participating Organization and parent participants as well as responding to customer service questions;

The Participating Organization is responsible for the following items:
- Providing an initial list of therapists who will use the software platform and coordinating the training and engagement of those therapists with TheraWe prior to initial usage;
- Facilitating continued participation and engagement with new parents who wish to use
the TheraWe platform; and
- Participating in scheduled meetings, convenient for the organization, to review usage data
and improvement opportunities.


Any further details, agreements, or provisions outside the contents of this Service Agreement
must be mutually agreed upon before implementation, and said details, agreements, or provisions
must be incorporated into this Service Agreement by a written amendment or addendum, duly
signed by TheraWe and the Business Associate.


ATTACHMENT 1: BUSINESS ASSOCIATE AGREEMENT

 

  1. Definitions. Unless otherwise defined in this Agreement, any and all capitalized terms in this Agreement shall have the definitions set forth in the HIPAA Security and Privacy Rule. In the event of an inconsistency between this Agreement and the mandatory provisions of the HIPAA Security and Privacy Rule, the HIPAA Security and Privacy Rule will control. Where provisions of this Agreement are different than those stipulated in the HIPAA Security and Privacy Rule, but are nonetheless permitted by the HIPAA Security and Privacy Rule, the provisions of this Agreement will control.

 

  1. Term. This Agreement shall remain in full force and effect for the duration of the Service Agreement, or upon an earlier date upon dual and mutual agreement by the Parties. This Agreement applies to all of the services, supplies, and/or contractual responsibilities of the Business Associate pursuant to the Service Agreement. If the Participating Organization and TheraWe already have a Business Associate Agreement, the terms of that agreement will take precedence over the agreement of TheraWe Connect.


 

  1. General. The Business Associate acknowledges and agrees that all Protected Health Information (“PHI”) that is created or received by TheraWe and disclosed or made available in any form by TheraWe or its other entities on its behalf to the Business Associate or is created or received by the Business Associate on TheraWe’s behalf will be subject to this Agreement.

 

Except as otherwise specified herein, the Business Associate may make any and all uses and disclosures of PHI necessary for the Business Associate to perform its obligations for or on behalf of TheraWe pursuant to the Service Agreement and as permitted or required by this Agreement or HIPAA’s Privacy regulations. Information that has been de-identified in accordance with the requirements of 45 C.F.R. §§ 164.514 and 164.502(d)(2) is not subject to the provisions of this Agreement. TheraWe may disclose PHI to the Business Associate to create information that is not Individually Identifiable Health Information, whether or not the de-identified information is to be used by TheraWe.

 

  1. HIPAA Assurances. The Business Associate agrees to abide by HIPAA and any associated regulations, and otherwise agrees to:

    1. Recognize that the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”) and the regulations thereunder (including 45 C.F.R. §§ 164.308, 164.310, 164.312, and 164.316), apply to the Business Associate;

    2. Not use or further disclose any PHI received or maintained by the Business Associate, except as permitted by law as follows;

      • if necessary for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate, provided as to any such disclosure, the following requirements are met:

        • the disclosure is required by law; or

        • the Business Associate obtains reasonable assurances from the person or entity to whom the information is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person or entity, and said person or entity notifies the Business Associate of any instances of which it is aware the confidentiality of the information has been breached;

      • for any data aggregation services, if to be provided by the Business Associate for the health care operations of TheraWe pursuant to any other agreements between the Parties evidencing their business relationship. Data aggregation services means the combining of PHI by the Business Associate with the PHI received by the Business Associate occurring in its capacity of doing business with another Covered Entity, to permit data analyses that relate to the health care operations of TheraWe and the other Covered Entity;

    3. Implement and use appropriate safeguards to prevent the use or disclosure of PHI, including the implementation of administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of any Electronic Protected Health Information (“ePHI”) that the Business Associate acquires, creates, maintains, or transmits on behalf of TheraWe as required by the HIPAA Security and Privacy Rule;

    4. Comply with each applicable requirement of 45 C.F.R. Part 162 if the Business Associate conducts Standard Transactions for or on behalf of TheraWe;

    5. Promptly report any use or disclosure of PHI which is not in compliance with the terms of this Agreement of which the Business Associate becomes aware. The Business Associate must report to TheraWe any Security Incident of which it becomes aware. Security Incident means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system. The Business Associate has a duty to diligently mitigate any known harmful effect resulting from the use or disclosure of PHI by the Business Associate in violation of HIPAA and this Agreement. The Business Associate agrees to notify TheraWe of any use or disclosure of PHI, in violation of HIPAA, within one (1) business day of discovery;

    6. Assure that any vendors, subcontractors, or agents to whom the Business Associate provides PHI received from, created with, or maintained for TheraWe, agrees to the same restrictions and conditions that apply to the Business Associates with respect to any PHI;

    7. Be responsible for the unauthorized use or disclosure of PHI (in any format) by its vendors, subcontractors, or agents who receive or are exposed to PHI that was received, created, maintained, or transmitted by the Business Associate in relation to this Agreement;

    8. Make its internal practices, books, and records relating to the use or disclosure of PHI received from, created with, or maintained for TheraWe available to the Secretary of the Department of Health and Human Services for purposes of determining TheraWe’s compliance with 45 C.F.R. § 164 Subpart E.

    9. Permit any individual whose PHI is maintained by the Business Associate in a Designated Record Set (“DRS”) to have access to inspect and obtain a copy of the PHI about the individual in accordance with 45 C.F.R. § 164.524. If the Business Associate maintains PHI electronically, the Business Associate agrees to make such PHI electronically available to the applicable individual;

    10. In accordance with 45 C.F.R. § 164.526, the Business Associate will make available to an individual for amendment PHI about that individual in a DRS and will incorporate any amendments to such PHI.

    11. Account and make available the accounting of disclosures made by the Business Associate of any individual’s PHI in accordance with 45 C.F.R. § 164.528;

    12. Comply with any requests for restrictions on certain disclosures of PHI pursuant to 45 C.F.R. § 164.522 to which TheraWe has agreed and of which the Business Associate is notified by TheraWe. The Business Associate agrees to make available PHI to the extent and in the manner required by 45 C.F.R. § 164.524.

 

  1. Disposition of PHI. Upon the termination of this Agreement, or any similar documentation to dissolve the business relationship of the Parties, or upon request by TheraWe, whichever occurs first, if feasible, the Business Associate will return or destroy all PHI (in any form) received, created, maintained, or transmitted under this Agreement. Notwithstanding the foregoing, if the Parties agree that the return or destruction of PHI received, created, maintained, or transmitted by the Business Associate on behalf of TheraWe is not feasible, the terms and provisions of this Agreement shall survive termination or expiration, and the provisions of this Agreement will continue to apply to such PHI. The Business Associate will extend the protections provided by this Agreement to such PHI and limit further uses or disclosures to those purposes that make the return or destruction of PHI unfeasible.

 

  1. Termination. Without limiting the rights of the parties under the Service Agreement, if TheraWe determines that the Business Associate violated a material term of this Agreement, TheraWe may, at its option, immediately terminate the Service Agreement. Alternatively, TheraWe may give written notice to the Business Associate in the event of a breach and give the Business Associate five (5) business days to cure such breach. TheraWe shall also have the option to immediately stop all further disclosures of PHI to the Business Associate if TheraWe determines that the Business Associate breached its obligations under this Agreement. If the Business Associate fails to cure such breach or provide adequate written assurances to TheraWe that a material breach does not exist within the specific time permitted by TheraWe, TheraWe may immediately terminate the Service Agreement.

 

  1. No Third Party Beneficiaries. The parties agree that the terms of this Agreement shall apply only to themselves and are not for the benefit of any third party beneficiaries.

 

  1. Amendment. If any new state or federal law, rule, regulation, or policy, or any judicial or administrative decision, affecting the use or disclosure of PHI is enacted or issued, the Parties agree that this Agreement may be amended in a timely manner and as necessary, in TheraWe’s reasonable discretion, to fully comply with such law, rule, regulation, policy, or decision. All such amendments shall be made in writing, either as an addendum to this Agreement or an new agreement to supersede this Agreement, and must be signed by the Parties. If the Parties are not able to agree on the terms of such an amendment, either party may terminate the Service Agreement after providing the other party a written notice of termination five (5) business days in advance.

 

  1. Indemnification and Insurance. The Business Associate shall indemnify, defend, and hold harmless TheraWe and its directors, officers, subcontractors, employees, affiliates, agents, and representatives from and against any and all third party liabilities, costs, claims, suits, actions, proceedings, demands, losses, and liabilities of any kind (including court costs or reasonable attorneys’ fees) brought by a third party, arising from or relating to the acts or omissions of the Business Associate or any of its directors, officers, subcontractors, employees, affiliates, agents, or representatives in connection with the Business Associate’s performance under this Agreement or the Service Agreement, without regard to any limitation or exclusion of damages provision otherwise set forth in the Service Agreement. This indemnification section shall survive the termination of this Agreement.

 

The Business Associate must obtain and maintain during the term of this Agreement liability insurance covering claims based on a violation of the HIPAA Security or Privacy Rule, or any applicable law or regulation concerning the privacy of PHI, and claims based on its obligations pursuant to this section.

 

  1. Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits TheraWe to comply with the then most current version of HIPAA and the HIPAA privacy regulations.

 

  1. Severability. If any provision herein conflicts with any law, rule, regulation, policy, or judicial or administrative decision, the contravening provision(s) shall be struck from the Agreement and have no effect on the remaining provisions or the Agreement as a whole, leaving the remainder of the Agreement to have its intended force and applicability upon the Parties.

 

  1. Governance. This Agreement will be governed by and construed in accordance with the same internal rules and procedures that govern the Service Agreement.

 

  1. Survival. This Agreement will survive the termination or expiration of the Service Agreement and remain in full force and effect for so long as the Business Associate, or any of its vendors, subcontractors, or agents remain in possession of any PHI that (i) TheraWe discloses to the Business Associate or (ii) the Business Associate receives, creates, maintains, or transmits on TheraWe’s behalf, and this Agreement will terminate immediately thereafter once the Business Associate has disposed of the pertinent PHI per this Agreement.

bottom of page