1.1 Capitalized terms used but not defined in this Agreement have the meanings given to them under HIPAA, including 45 C.F.R. Parts 160 and 164, as amended from time to time.

1.2 “Protected Health Information” or “PHI” means individually identifiable health information created, received, maintained or transmitted by Business Associate on behalf of Covered Entity, in any form or medium, including paper manifests, labels and chain-of-custody documents, and electronic tracking records. “Electronic PHI” or “ePHI” means PHI transmitted by or maintained in electronic media.

1.3 “Services” means the courier, transport and related services described in Exhibit A, together with any related services performed under a separate services agreement between the Parties.

1.4 “Security Incident,” “Breach,” “Unsecured PHI,” “Minimum Necessary,” “Individual,” “Secretary” and “Workforce” have the meanings given under the HIPAA Privacy Rule, Security Rule and Breach Notification Rule, respectively.

1.5 “Services Agreement” means the master services agreement, statement of work, rate schedule or other written arrangement under which Business Associate performs the Services, if any.

2.1 Business Associate may use or disclose PHI only to perform the Services for Covered Entity, as expressly permitted by this Agreement, as required by law, or as otherwise permitted under HIPAA. Business Associate shall not use or disclose PHI for its own business purposes, including marketing, sale, or the creation of de-identified information, except as permitted by HIPAA and authorized in writing by Covered Entity.

2.2 Business Associate shall not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except as permitted for Business Associate’s proper management and administration or to carry out its legal responsibilities, and only if the recipient agrees to the conditions of 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.504(e)(2)(ii)(B).

2.3 Business Associate shall use, disclose and request only the Minimum Necessary PHI to accomplish the intended purpose, and shall limit Workforce access to PHI to those persons who need it to perform the Services.

2.4 Business Associate may use PHI to report violations of law to appropriate federal and state authorities, consistent with 45 C.F.R. § 164.502(j)(1), and to respond to a subpoena or court order after notifying Covered Entity to the extent legally permitted.

2.5 Business Associate shall not open, inspect, read or duplicate the contents of sealed specimen containers, packaging, devices or records entrusted to it, and shall not access clinical systems of Covered Entity, except as strictly necessary to perform the Services or as required by law. Tracking data generated by Business Associate shall be limited to the information necessary to record custody and delivery.

2.6 Business Associate may disclose PHI as required by the Secretary to investigate or determine compliance with HIPAA, and as necessary for Business Associate to defend itself in a legal or administrative action brought by Covered Entity or an Individual.

3.1 Safeguards. Business Associate shall implement and maintain administrative, physical and technical safeguards reasonably designed to protect the confidentiality, integrity and availability of PHI, including those required by the HIPAA Security Rule at 45 C.F.R. Part 164, Subpart C, and by CMIA. These safeguards include, at a minimum: background screening and confidentiality agreements for all drivers and staff; HIPAA and OSHA bloodborne-pathogen training at hire and annually; unique user identification and role-based access for any electronic system; encryption of ePHI in transit and at rest where reasonably available; sealed, tamper-evident transport containers; documented chain-of-custody at every hand-off; locked vehicles and secure storage of PHI awaiting delivery; and secure destruction of paper and electronic media.

3.2 Reporting of Improper Use or Disclosure. Business Associate shall report to Covered Entity in writing any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, without unreasonable delay and in no event later than five (5) business days after discovery.

3.3 Security Incidents. Business Associate shall report to Covered Entity any Security Incident involving ePHI of which it becomes aware, without unreasonable delay and in no event later than five (5) business days after discovery, and shall reasonably cooperate in the investigation and mitigation of the incident. The Parties acknowledge that this section constitutes notice of the ongoing occurrence of unsuccessful Security Incidents, such as pings and port scans, and that repeated notice of such unsuccessful incidents is not required.

3.4 Breach Notification. Business Associate shall notify Covered Entity of any Breach of Unsecured PHI without unreasonable delay and in no event later than five (5) business days after discovery, and shall provide, to the extent known: the identification of each Individual whose Unsecured PHI was involved; a description of what happened, including the date of the Breach and the date of discovery; the types of PHI involved; the identity of any unauthorized person who used or received the PHI; the steps taken to mitigate the Breach and to protect against further Breaches; and contact information for affected Individuals. Business Associate shall not notify Individuals, the media or the Secretary on Covered Entity’s behalf without Covered Entity’s prior written consent, except where a shorter period is required by law.

3.5 Mitigation. Business Associate shall mitigate, to the extent practicable, any harmful effect known to it resulting from a use or disclosure of PHI in violation of this Agreement.

3.6 Subcontractors. Business Associate shall not disclose PHI to any subcontractor or agent that creates, receives, maintains or transmits PHI on its behalf unless that subcontractor agrees in writing to restrictions and conditions at least as protective as those in this Agreement, including compliance with HIPAA. Business Associate remains responsible for its subcontractors’ acts and omissions and shall furnish a current list of subcontractors that handle PHI upon Covered Entity’s request.

3.7 Access to PHI. Business Associate shall make PHI available to Covered Entity, or as directed to an Individual, within fifteen (15) days of request and in the time and manner required by 45 C.F.R. § 164.524, including in the form and format requested if readily producible.

3.8 Amendment. Business Associate shall make PHI available for amendment and shall incorporate any amendment directed by Covered Entity within ten (10) business days of written notice, consistent with 45 C.F.R. § 164.526, and shall notify its subcontractors of any amendment.

3.9 Accounting of Disclosures. Business Associate shall maintain documentation of disclosures of PHI and information related to those disclosures as required for Covered Entity to respond to a request for an accounting under 45 C.F.R. § 164.528, shall retain that documentation for six (6) years from the date of the disclosure, and shall provide an accounting within fifteen (15) days of Covered Entity’s request.

3.10 Internal Practices and Records. Business Associate shall make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining compliance with HIPAA, and shall make such information available to Covered Entity upon reasonable request.

3.11 Return or Destruction of PHI. Upon termination of this Agreement or of the Services, Business Associate shall return or destroy all PHI received from or created on behalf of Covered Entity, including PHI in the possession of its subcontractors, within thirty (30) days. If return or destruction is infeasible, Business Associate shall notify Covered Entity in writing, extend the protections of this Agreement to the retained PHI, and limit further use or disclosure to the purposes that make return or destruction infeasible. Business Associate shall certify in writing that destruction has been completed upon Covered Entity’s request.

3.12 Workforce and Access Controls. Business Associate shall ensure that members of its Workforce who handle PHI are bound by written confidentiality obligations, trained on HIPAA and CMIA, subject to sanctions for non-compliance, and that access to PHI is terminated promptly upon separation or reassignment.

3.13 Compliance with Law. Business Associate shall comply with HIPAA, CMIA, applicable OSHA bloodborne-pathogen standards, and California and federal law governing the transport of specimens, pharmaceuticals, controlled substances and medical devices.

4.1 Covered Entity shall notify Business Associate of any limitation in its Notice of Privacy Practices or any restriction on the use or disclosure of PHI that may affect Business Associate’s permitted uses and disclosures.

4.2 Covered Entity shall provide PHI to Business Associate in a secure manner, properly packaged, sealed and labeled, and shall limit the PHI placed on manifests, labels and dispatch requests to the Minimum Necessary.

4.3 Covered Entity represents that it has obtained any authorization or provided any notice required for the disclosure of PHI to Business Associate for the Services, and that it is authorized to disclose the PHI it furnishes.

4.4 Covered Entity shall use reasonable efforts to notify Business Associate of any known Individual affected by a Breach and shall provide accurate contact information reasonably necessary for notification.

4.5 Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permitted if the use or disclosure were made by Covered Entity.

5.1 Term. This Agreement begins on the Effective Date and continues until the later of the termination of the Services Agreement or the completion of the Services, unless earlier terminated as provided below.

5.2 Termination for Cause. Either Party may terminate this Agreement upon written notice if the other Party materially breaches this Agreement and fails to cure the breach within thirty (30) days of written notice; provided that the cure period is ten (10) days where the breach poses an immediate threat to the security or confidentiality of PHI, and no cure period applies where cure is not possible.

5.3 Regulatory Termination. Covered Entity may terminate this Agreement if Covered Entity determines that Business Associate has violated a material term of this Agreement, as contemplated by 45 C.F.R. § 164.504(e)(2)(iii).

5.4 Effect of Termination. Upon termination, Business Associate shall comply with Section 3.11. The rights and obligations of the Parties that by their nature survive termination — including confidentiality, breach reporting, record retention, indemnification and limitation provisions — shall survive.

6.1 Amendment. The Parties agree to amend this Agreement from time to time as necessary for compliance with HIPAA, CMIA or other applicable law. If an amendment would materially affect Business Associate’s obligations, the Parties shall negotiate the amendment in good faith.

6.2 Interpretation. This Agreement shall be interpreted consistently with HIPAA and CMIA. In the event of a conflict between this Agreement and HIPAA, HIPAA controls. References to statutes and regulations include any successor provisions.

6.3 No Third-Party Beneficiaries. Nothing in this Agreement confers rights on any third party, except the Secretary and Individuals to the extent expressly provided under HIPAA.

6.4 Governing Law and Venue. This Agreement is governed by the laws of the State of California, including CMIA, without regard to conflict-of-laws principles. The exclusive venue for any action arising out of this Agreement is the state or federal courts located in Los Angeles County, California.

6.5 Independent Contractor. Business Associate is an independent contractor. Nothing in this Agreement creates an employment, agency, partnership or joint venture relationship between the Parties.

6.6 Insurance. Business Associate shall maintain commercial general liability, commercial automobile, cargo and cyber liability insurance in amounts customary for medical courier operations in California, and shall furnish certificates of insurance upon Covered Entity’s reasonable request.

6.7 Notices. Notices under this Agreement shall be in writing and delivered by hand, certified mail, or electronic mail with confirmation of receipt, to the addresses set forth in the signature blocks below, or to such other address as a Party designates in writing. Notice to Business Associate shall be directed to support@goldenhourcourier.com with a copy to dispatch@goldenhourcourier.com.

6.8 Entire Agreement; Counterparts. This Agreement, together with its Exhibits, is the entire agreement of the Parties with respect to its subject matter and supersedes prior agreements on that subject. It may be executed in counterparts, including by electronic signature under the federal E-SIGN Act and California’s Uniform Electronic Transactions Act, each of which is deemed an original.

6.9 No Waiver; Severability. No failure to enforce a provision waives that provision. If any provision is held invalid or unenforceable, the remaining provisions remain in full force, and the invalid provision is modified to the minimum extent necessary to make it enforceable.

6.10 Cooperation. Each Party shall reasonably cooperate with the other in responding to requests from Individuals or the Secretary, and in any investigation, audit or compliance review relating to PHI handled under this Agreement.

By signing below, each Party acknowledges that it has read and understands this Agreement and agrees to be bound by its terms. This Agreement is not effective until signed by both Parties.