Terms of Use and Sale

THIS DOCUMENT CONTAINS VERY IMPORTANT INFORMATION REGARDING YOUR RIGHTS AND OBLIGATIONS, AS WELL AS CONDITIONS, LIMITATIONS, AND EXCLUSIONS THAT MIGHT APPLY TO YOU. PLEASE READ IT CAREFULLY. 

These Rupa Terms of Use and Sale (these “Terms”) apply to use of (and the purchase and sale of products and services through) the Rupa website and any associated mobile applications (the “Site”). The Site is made available by Rupa, Inc. (referred to as “Rupa”, “us”, “we”, or “our” as the context may require). You should also carefully review our Privacy Policy before placing an order for products or services through this Site (see Section 19).

THESE TERMS REQUIRE THE USE OF ARBITRATION ON AN INDIVIDUAL BASIS TO RESOLVE DISPUTES, RATHER THAN JURY TRIALS OR CLASS ACTIONS. 

By using the Site, by clicking to accept or agree to these Terms when this option is made available to you, or by placing an order for products or services through the Site, you accept and agree to be bound and abide by these Terms. 

YOU MAY NOT USE THIS SITE OR ORDER OR OBTAIN PRODUCTS OR SERVICES FROM THIS SITE IF YOU (A) DO NOT AGREE TO THESE TERMS, (B) ARE NOT THE OLDER OF (i) AT LEAST 18 YEARS OF AGE OR (ii) LEGAL AGE TO FORM A BINDING CONTRACT WITH RUPA, OR (C) ARE PROHIBITED FROM ACCESSING OR USING THIS SITE OR ANY OF THIS SITE’S CONTENTS, GOODS OR SERVICES BY APPLICABLE LAW. HEALTHCARE PRACTIONERS USING THE SITE ON BEHALF OF PATIENTS ARE SUBJECT TO ADDITIONAL REQUIREMENTS AS PROVIDED IN THESE TERMS.

1. Changes to These Terms. These Terms are subject to change by us at any time and without prior notice, in our sole discretion. Any changes to these Terms will be in effect as of the “Last Modified” date referenced on the Site. You should review these Terms prior to purchasing any product or services that are available through this Site. Your continued use of this Site after the “Last Modified” date will constitute your acceptance of, and agreement to, such changes.
2. NO MEDICAL ADVICE. Through the Site, we offer an online service to help healthcare practitioners order specialty lab-work more efficiently for their patients. We are not doctors, we do not act or operate as a healthcare practice, nor do we provide medical care. We do not partner with or hire practitioners: they simply use our software to order products.
3. Accessing the Site and Account Security. We reserve the right to withdraw or amend the Site, and any service or products we provide through the Site, in our sole discretion without notice. We will not be liable if for any reason all or any part of the Site is unavailable at any time or for any period. From time to time, we may restrict access to some parts of the Site, or the entire Site, to users, including registered users. To access the Site or some of the resources it offers, you may be asked to provide certain registration details or other information. All the information you provide on the Site must be correct, current, and complete. You agree that all information you provide to register with or use this Site is governed by our Privacy Policy , and you consent to all actions we take with respect to your information consistent with our Privacy Policy.
   1. If you choose, or are provided with, a user name, password, or any other piece of information as part of our security procedures, you must treat such information as confidential, and you must not disclose it to any other person or entity. You also acknowledge that your account is personal to you and agree not to provide any other person with access to this Site or portions of it using your user name, password, or other security information. You agree to notify us immediately of any unauthorized access to or use of your user name or password or any other breach of security. You also agree to ensure that you exit from your account at the end of each session. You should use particular caution when accessing your account from a public or shared computer so that others are not able to view or record your password or other personal information.
   2. We have the right to disable any user name, password, or other identifier, whether chosen by you or provided by us, at any time in our sole discretion for any or no reason, including if, in our opinion, you have violated any provision of these Terms.

* * * Sections 4-7 apply to healthcare practitioners using the Site to place orders for patients. * * *

1. Practitioner Terms – Compliance, Ethics & Credentialing.  
   1. Most jurisdictions require that health professionals making recommendations to patients on health-related matters have an appropriate license to offer those recommendations. Regulating entities with jurisdiction over health professionals may also require that certain ethical standards be followed. You may also be required to make certain disclosures to patients or be limited in your ability to charge patients more than the manufacturer’s suggested retail price (MSRP) for products, including products you order from the Site. You agree to act in accordance with all licensing and ethical standards applicable to you as a health professional. 
   2. You – and not Rupa – are solely responsible for all of your compliance obligations. We do not offer any advice about potentially applicable laws or compliance with them. We also do not express any opinions about whether the products are appropriate for your patients. 
   3. To use the Site to place product or service orders for patients, you must have – and you represent that you do have – appropriate authorization or license from government authorities or regulatory agencies applicable to you and your practice of medicine (or another healthcare profession). By placing any order through the Site, you certify that you are licensed to practice and order lab testing in your state. To confirm this, we may ask you for various information needed to verify your identity and qualifications to provide healthcare services (or order lab testing). This may include requirements for you to provide us with your National Provider Identifier (NPI), a copy of your driver’s license, documents confirming your education and training, licenses, or specialty certificates, etc.
2. Practitioner Terms – Signatures. On placing your first order for a patient, you will be required to provide Rupa with an e-signature. Rupa will then use this e-signature to generate requisitions for orders placed under your account, have lab companies bill Rupa for orders placed under your account, register you under Rupa’s account with our partner labs, and receive your patients’ results for your review. By providing Rupa with your e-signature, you consent to these uses of your signature by Rupa for all orders placed under your account. You may withdraw your consent at any time by providing notice to Rupa at hello@rupahealth.com, and that withdrawal will become effective within five business days. But, if you withdraw your consent, your account will be deactivated and you will no longer be permitted to place orders through the Site.
3. Practitioner Terms – Fees for Products & Statements About Products. 
   1. For products and services that you obtain via the Site, you may not charge patients more than is permitted under the laws applicable to you and your practice or where the patient resides.
   2. You shall not make any representations, warranties, guarantees, indemnities, commitments, or other similar claims actually, apparently, or ostensibly on behalf of Rupa, any lab or product manufacturer or distributor that are inconsistent with these Terms.
   3. You shall not make any claims regarding the use of Rupa’s products which do not explicitly appear on the label of products or the product listing on the Site.
   4. You are exclusively responsible for, and Rupa and its lab, supplier and distributor partners, disclaim any and all liability for, any statements that you may make regarding the products to patients, including any claims that a product diagnoses or treats specific diseases or conditions that do not explicitly appear on the product label.
4. Practitioner Terms – Business Associate Terms.  If you are a practitioner that is a Covered Entity under HIPAA (or you are an employee or other workforce member of a physician practice or other entity that is a Covered Entity), then (a) the Business Associate Terms attached to these Terms (“BA Terms”) apply to you, and (b) you Practice hereby agree to the BA Terms, which are incorporated by reference. 

* * * The remaining sections of these Terms apply to all Site users, whether patients or practitioners. * * *

1. Intellectual Property Rights. 
   1. The Site and its entire contents, features, and functionality (including but not limited to all information, software, text, displays, images, video, and audio, and the design, selection, and arrangement thereof) are owned by Rupa, its licensors, or other providers of such material and are protected by United States and international copyright, trademark, patent, trade secret, and other intellectual property or proprietary rights laws. These Terms permit you to use the Site for your use only. 
   2. The Rupa and Rupa Health names and all related names, logos, product and service names, designs, and slogans are trademarks of Rupa or its affiliates or licensors. You must not use such marks without first obtaining Rupa’s written permission. All other names, logos, product and service names, designs, and slogans on this Site are the trademarks of their respective owners.
2. Prohibited Uses. You may use the Site only for lawful purposes and in accordance with these Terms. You agree not to use the Site:

• In any way that violates any applicable federal, state, local, or international law or regulation (including, without limitation, any laws regarding the export of data or software to and from the US or other countries). 
• For the purpose of exploiting, harming, or attempting to exploit or harm minors in any way by exposing them to inappropriate content, asking for personally identifiable information, or otherwise.
• To send, knowingly receive, upload, download, use, or re-use any material that is offensive, harmful, infringing, obscene, defamatory, abusive, deceptive, untrue, misrepresentative, or illegal.
• To transmit, or procure the sending of, any advertising or promotional material.
• To impersonate or attempt to impersonate Rupa, a Rupa employee, another user, or any other person or entity.
• To engage in any other conduct that restricts or inhibits anyone’s use or enjoyment of the Site, or which, as determined by us, may harm Rupa or users of the Site, or expose them to liability.

Additionally, you agree not to:

• Use the Site in any manner that could disable, overburden, damage, or impair the Site or interfere with any other party’s use of the Site.
• Use any robot, spider, or other automatic device, process, or means to access the Site for any purpose, including monitoring or copying any of the material on the Site.
• Use any manual process to monitor or copy any of the material on the Site, or for any other purpose not expressly authorized in these Terms, without our prior written consent.
• Use any device, software, or routine that interferes with the proper working of the Site.
• Introduce any viruses, Trojan horses, worms, logic bombs, or other material that is malicious or technologically harmful.
• Attempt to gain unauthorized access to, interfere with, damage, or disrupt any parts of the Site, the server on which the Site is stored, or any server, computer, or database connected to the Site. 
• Attack the Site via a denial-of-service attack or a distributed denial-of-service attack.
• Otherwise attempt to interfere with the proper working of the Site.

1. Order Acceptance and Cancellation. You agree that your order is an offer for you as a practitioner (or an invitation to your patient) to buy, under these Terms, all products and services listed in your order. All orders must be accepted by the applicable patient (if that patient is paying for the products through Rupa) and Rupa, or we will not be obligated to sell the products or services to the practitioner or the patient, as applicable. We may choose not to accept orders at our sole discretion, even after we send a confirmation email with your order number and details of the items you have ordered. 
2. Product Descriptions. Product descriptions are provided by the labs or manufacturers of the various tests available for sale through the Site. We work with the manufacturers to confirm that the test descriptions are accurate, but we cannot guarantee that they are accurate, complete or up-to-date. Including a product description on the Site does not mean that product is or will be available at any given time.
3. Prices and Payment Terms. 
   1. All prices, discounts, and promotions posted on this Site are subject to change without notice. The price charged for a product or service will be the price in effect at the time the order is placed and will be set out in your order confirmation email. Price increases will only apply to orders placed after such changes. Posted prices include taxes, but may not include charges for shipping and handling. All such charges will be added to your merchandise total, and where shipping is separately charged, it will be itemized in your shopping cart and in your order confirmation email. We strive to display accurate price information, however we may, on occasion, make inadvertent typographical errors, inaccuracies or omissions related to pricing and availability. We reserve the right to correct any errors, inaccuracies, or omissions at any time and to cancel any orders arising from such occurrences.
   2. We may offer from time to time promotions on the Site that may affect pricing and that are governed by terms and conditions separate from these Terms. If there is a conflict between the terms for a promotion and these Terms, the promotion terms will govern. 
   3. Terms of payment are within our sole discretion and, unless otherwise agreed by us in writing, payment must be received by us before our acceptance of an order. We accept credit and debit cards for all purchases and HSA and FSA payment methods for eligible purchases. You may also apply for an extended payment plan. You represent and warrant that (i) the credit card or other payment information you supply to us is true, correct and complete, (ii) you are duly authorized to use such credit card or payment method for the purchase, (iii) charges incurred by you will be honored by your credit card company, and (iv) you will pay charges incurred by you at the posted prices, including shipping and handling charges and all applicable taxes, if any, regardless of the amount quoted on the Site at the time of your order. 
4. Shipments; Delivery; Title and Risk of Loss. 
   1. We will arrange for shipment of the products to you. Typically, products are drop-shipped from our partner labs directly to the patient. Please check the individual product page for specific delivery options. You will pay all shipping and handling charges specified during the ordering process. Shipping and handling charges are reimbursement for the costs we incur in the processing, handling, packing, shipping, and delivery of your order. 
   2. Title and risk of loss pass to you upon transfer of the products to the carrier. Shipping and delivery dates are estimates only and cannot be guaranteed. We are not liable for any delays in shipments.
5. Phlebotomy Services. Rupa may offer a list of blood draw centers in the patient’s area, or mobile phlebotomists who can come directly to the patient; however, these phlebotomists are not Rupa’s employees and Rupa is not responsible for the services provided by, or acts or omissions of, the phlebotomists or blood draw centers. The patient’s relationship is directly with the phlebotomist, and any issues with the phlebotomist’s service should be addressed directly with the phlebotomist. 
6. Returns and Refunds. Please see our Return Policy for details on product returns. 
7. Manufacturer’s Warranty and Disclaimers. We do not manufacture or control any of the products or services offered on our Site. The availability of products or services through our Site does not indicate an affiliation with or endorsement of any product, service or manufacturer. Accordingly, we do not provide any warranties with respect to the products or services offered on our Site. However, the products and services offered on our Site may be covered by the lab’s or manufacturer’s warranty as detailed in the product’s description on our Site and included with the product. To obtain warranty service for defective products, please follow the instructions included in the manufacturer’s warranty. 

ALL PRODUCTS AND SERVICES OFFERED ON THIS SITE ARE PROVIDED “AS IS” WITHOUT ANY WARRANTY WHATSOEVER, INCLUDING, WITHOUT LIMITATION, ANY (A) WARRANTY OF MERCHANTABILITY; (B) WARRANTY OF FITNESS FOR A PARTICULAR PURPOSE; OR (C) WARRANTY AGAINST INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OF A THIRD PARTY; WHETHER EXPRESS OR IMPLIED BY LAW, COURSE OF DEALING, COURSE OF PERFORMANCE, USAGE OF TRADE, OR OTHERWISE. 

SOME JURISDICTIONS LIMIT OR DO NOT ALLOW THE DISCLAIMER OF IMPLIED OR OTHER WARRANTIES SO THE ABOVE DISCLAIMER MAY NOT APPLY TO YOU. 

YOU AFFIRM THAT RUPA SHALL NOT BE LIABLE, UNDER ANY CIRCUMSTANCES, FOR ANY BREACH OF WARRANTY CLAIMS OR FOR ANY DAMAGES ARISING OUT OF THE LAB’S OR MANUFACTURER’S FAILURE TO HONOR ANY WARRANTY OBLIGATIONS IT MAY HAVE TO YOU.

1. Limitation of Liability. IN NO EVENT SHALL WE BE LIABLE TO YOU OR ANY THIRD PARTY FOR CONSEQUENTIAL, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE OR ENHANCED DAMAGES, LOST PROFITS OR REVENUES, ARISING OUT OF, OR RELATING TO, OR IN CONNECTION WITH YOUR USE OF THE SITE OR ANY BREACH OF THESE TERMS, REGARDLESS OF (A) WHETHER SUCH DAMAGES WERE FORESEEABLE, (B) WHETHER OR NOT WE WERE ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND (C) THE LEGAL OR EQUITABLE THEORY (CONTRACT, TORT OR OTHERWISE) UPON WHICH THE CLAIM IS BASED.

OUR SOLE AND ENTIRE MAXIMUM LIABILITY, FOR ANY REASON, AND YOUR SOLE AND EXCLUSIVE REMEDY FOR ANY CAUSE WHATSOEVER, SHALL BE LIMITED TO THE ACTUAL AMOUNT PAID BY YOU FOR THE PRODUCTS AND SERVICES YOU HAVE ORDERED THROUGH OUR SITE. 

The limitation of liability set forth above shall only apply to the extent permitted by law.

1. Goods Not for Resale or Export. You represent and warrant that you are buying products or services from the Site for your or your patient’s own personal or household use only, and not for further resale or export. You further represent and warrant that all purchases are intended for final delivery to locations within the United States, but excluding New Jersey, New York, and Rhode Island. 
2. Privacy. Our Privacy Policy governs the processing of all personal data collected from you in connection with your use of the Site.
3. Force Majeure. We will not be liable or responsible to you, nor be deemed to have defaulted or breached these Terms, for any failure or delay in our performance under these Terms when and to the extent such failure or delay is caused by or results from acts or circumstances beyond our reasonable control, including, without limitation, acts of God, flood, fire, earthquake, explosion, governmental actions, war, invasion or hostilities (whether war is declared or not), terrorist threats or acts, riot or other civil unrest, national emergency, revolution, insurrection, epidemic, pandemic, lockouts, strikes or other labor disputes (whether or not relating to our workforce), or restraints or delays affecting carriers or inability or delay in obtaining supplies of adequate or suitable materials, materials or telecommunication breakdown or power outage.
4. Governing Law and Jurisdiction. This Site is operated from the US. All matters arising out of or relating to these Terms are governed by and construed in accordance with the internal laws of the State of California without giving effect to any choice or conflict of law provision or rule (whether of the State of California or any other jurisdiction) that would cause the application of the laws of any jurisdiction other than those of the State of California.
5. Dispute Resolution and Binding Arbitration.
   1. YOU AND RUPA ARE AGREEING TO GIVE UP ANY RIGHTS TO LITIGATE CLAIMS IN A COURT OR BEFORE A JURY, OR TO PARTICIPATE IN A CLASS ACTION OR REPRESENTATIVE ACTION WITH RESPECT TO A CLAIM. OTHER RIGHTS THAT YOU WOULD HAVE IF YOU WENT TO COURT MAY ALSO BE UNAVAILABLE OR MAY BE LIMITED IN ARBITRATION.

ANY CLAIM, DISPUTE OR CONTROVERSY (WHETHER IN CONTRACT, TORT OR OTHERWISE, WHETHER PRE-EXISTING, PRESENT OR FUTURE, AND INCLUDING STATUTORY, CONSUMER PROTECTION, COMMON LAW, INTENTIONAL TORT, INJUNCTIVE AND EQUITABLE CLAIMS) BETWEEN YOU AND US ARISING FROM OR RELATING IN ANY WAY TO YOUR PURCHASE OF PRODUCTS OR SERVICES THROUGH THE SITE, WILL BE RESOLVED EXCLUSIVELY AND FINALLY BY BINDING ARBITRATION.

1. The arbitration will be administered by the American Arbitration Association (“AAA”) in accordance with the Consumer Arbitration Rules (the “AAA Rules”) then in effect, except as modified by this Section. (The AAA Rules are available at www.adr.org/arb_med or by calling the AAA at 1-800-778-7879.) The Federal Arbitration Act will govern the interpretation and enforcement of this Section.

The arbitrator will have exclusive authority to resolve any dispute relating to arbitrability and/or enforceability of this arbitration provision, including any unconscionability challenge or any other challenge that the arbitration provision or the agreement is void, voidable, or otherwise invalid. The arbitrator will be empowered to grant whatever relief would be available in court under law or in equity. Any award of the arbitrator(s) will be final and binding on each of the parties, and may be entered as a judgment in any court of competent jurisdiction.

If you prevail on any claim that affords the prevailing party attorneys’ fees, the arbitrator may award reasonable fees to you under the standards for fee shifting provided by law. 

1. You may elect to pursue your claim in small-claims court rather than arbitration if you provide us with written notice of your intention do so within 60 days of your purchase. The arbitration or small-claims court proceeding will be limited solely to your individual dispute or controversy.
2. You and Rupa agree to an arbitration on an individual basis. In any dispute, NEITHER YOU NOR RUPA WILL BE ENTITLED TO JOIN OR CONSOLIDATE CLAIMS BY OR AGAINST OTHER CUSTOMERS IN COURT OR IN ARBITRATION OR OTHERWISE PARTICIPATE IN ANY CLAIM AS A CLASS REPRESENTATIVE, CLASS MEMBER OR IN A PRIVATE ATTORNEY GENERAL CAPACITY. The arbitral tribunal may not consolidate more than one person’s claims, and may not otherwise preside over any form of a representative or class proceeding. The arbitral tribunal has no power to consider the enforceability of this class arbitration waiver and any challenge to the class arbitration waiver may only be raised in a court of competent jurisdiction.

If any provision of this arbitration agreement is found unenforceable, the unenforceable provision will be severed and the remaining arbitration terms will be enforced.

1. Assignment. You will not assign any of your rights or delegate any of your obligations under these Terms without our prior written consent. Any purported assignment or delegation in violation of this Section is null and void. No assignment or delegation relieves you of any of your obligations under these Terms.
2. No Waivers. The failure by us to enforce any right or provision of these Terms will not constitute a waiver of future enforcement of that right or provision. The waiver of any right or provision will be effective only if in writing and signed by a duly authorized representative of Rupa.
3. No Third-Party Beneficiaries. These Terms do not and are not intended to confer any rights or remedies upon any person other than you.
4. Notices.
   1. To You. We may provide any notice to you under these Terms by: (i) sending a message to the email address you provide or (ii) by posting to the Site. Notices sent by email will be effective when we send the email and notices we provide by posting will be effective upon posting. It is your responsibility to keep your email address current.
   2. To Us. To give us notice under these Terms, you must contact us as follows: (i) by email to legal@rupahealth.com; or (ii) by personal delivery, overnight courier, or registered or certified mail to Rupa, Inc., 177 Townsend St Unit 528, San Francisco, CA 94107. We may update the email address or address for notices to us by posting a notice on the Site. Notices provided by personal delivery will be effective immediately. Notices provided by email or overnight courier will be effective one business day after they are sent. Notices provided by registered or certified mail will be effective three business days after they are sent.
5. Severability. If any provision of these Terms is invalid, illegal, void or unenforceable, then that provision will be deemed severed from these Terms and will not affect the validity or enforceability of the remaining provisions of these Terms.
6. Entire Agreement. Our order confirmation and these Terms will be deemed the final and integrated agreement between you and us on the matters contained in these Terms.

* * * * *

Business Associate Terms for Practitioners

1. General Provisions
   1. Applicability of these Business Associate Terms. If you are a practitioner that is a Covered Entity or you are an employee or other workforce member of a physician practice or other entity that is a Covered Entity (“Your Covered Entity”) under the Administrative Simplification section of the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act and their implementing regulations as amended from time to time (collectively, “HIPAA”), then these Business Associate Terms for Practitioners (these “BA Terms”) are part of the Terms between you and Rupa. These BA Terms apply when Rupa creates, receives, maintains, transmits, uses or discloses Protected Health Information on behalf of Your Covered Entity (“PHI”) as a Business Associate. 
   2. Authority. If you are a workforce member of Your Covered Entity, then you represent and warrant that you are authorized by Your Covered Entity to enter into these BA Terms. 
   3. Effect. To the extent that Rupa receives PHI in order to perform activities as a Business Associate, the terms and provisions of these BA Terms shall supersede any conflicting or inconsistent terms and provisions in the Terms to the extent of such conflict or inconsistency.
   4. Defined Terms. Capitalized terms used in these BA Terms without definition shall have the respective meanings assigned to such terms by HIPAA.

Obligations of Rupa 

1. Use and Disclosure of PHI. Rupa may use and disclose PHI as permitted or required under the Terms, including these BA Terms, or as Required by Law, but shall not otherwise use or disclose any PHI. Rupa shall not use or disclose PHI received from Your Covered Entity in any manner that would constitute a violation of HIPAA if so used or disclosed by Your Covered Entity (except as set forth in Sections 2.1(a), (b) and (c) below). To the extent Rupa carries out any of Your Covered Entity’s obligations under the HIPAA privacy standards, Rupa shall comply with the requirements of the HIPAA privacy standards that apply to Your Covered Entity in the performance of such obligations. Without limiting the generality of the foregoing, Rupa is permitted to use or disclose PHI as set forth below:
   1. Rupa may use PHI internally for Rupa’s proper management and administration or to carry out Rupa’s legal responsibilities; 
   2. Rupa may disclose PHI to a third party for Rupa’s proper management and administration, provided that the disclosure is Required by Law or Rupa obtains reasonable assurances from the third party to whom the PHI is to be disclosed that the third party will (1) protect the confidentiality of the PHI, (2) only use or further disclose the PHI as Required by Law or for the purpose for which the PHI was disclosed to the third party and (3) notify Your Covered Entity of any instances of which the third party is aware in which the confidentiality of the PHI has been breached;
   3. Rupa may use PHI to provide Data Aggregation services relating to the Health Care Operations of Your Covered Entity if required or permitted under the Terms; 
   4. Rupa may use PHI to create de-identified health information in accordance with the HIPAA de-identification requirements. Rupa may disclose de-identified health information for any purpose permitted by law;
   5. Rupa may use and disclose PHI to request an authorization, consent or other form of permission from an Individual and may use and disclose PHI in accordance with any such permission obtained from an Individual; and
   6. Rupa may use and disclose PHI (including, without limitation, a Limited Data Set) for Research as permitted by HIPAA and other applicable law.
2. Safeguards. Rupa shall use appropriate safeguards to prevent the use or disclosure of PHI other than as permitted or required by these BA Terms. In addition, Rupa shall implement Administrative Safeguards, Physical Safeguards and Technical Safeguards that reasonably and appropriately protect the Confidentiality, Integrity and Availability of PHI transmitted or maintained in Electronic Media (“EPHI”) that it creates, receives, maintains or transmits on behalf of Your Covered Entity. Rupa shall comply with the HIPAA Security Rule with respect to EPHI.
3. Minimum Necessary Standard. To the extent required by the “minimum necessary” requirements of HIPAA, Rupa shall only request, use and disclose the minimum amount of PHI necessary to accomplish the purpose of the request, use or disclosure. 
4. Mitigation. Rupa shall take reasonable steps to mitigate, to the extent practicable, any harmful effect (that is known to Rupa) of a use or disclosure of PHI by Rupa in violation of these BA Terms.
5. Trading Partner Agreement. Rupa shall not take any of the following actions: (a) change the definition, Data Condition, or use of a Data Element or Segment in a Standard, except where necessary to implement state or federal law, or to protect against fraud and abuse, (b) add any Data Elements or Segments to the maximum defined Data Set, (c) use any code or Data Elements that are either marked “not used” in the Standard’s Implementation Specification or are not in the Standard’s Implementation Specification(s), or (d) change the meaning or intent of the Standard’s Implementation Specification(s). 
6. Subcontractors. Rupa shall enter into a written agreement meeting the requirements of 45 C.F.R. §§ 164.504(e) and 164.314(a)(2) with each Subcontractor that creates, receives, maintains or transmits PHI on behalf of Rupa. Rupa shall ensure that the written agreement with each Subcontractor obligates the Subcontractor to comply with restrictions and conditions that are at least as restrictive as the restrictions and conditions that apply to Rupa under these BA Terms.
7. Reporting Requirements. 
   1. If Rupa becomes aware of a use or disclosure of PHI in violation of these BA Terms by Rupa or a third party to which Rupa disclosed PHI, Rupa shall report the use or disclosure to Your Covered Entity without unreasonable delay. 
   2. Rupa shall report any Security Incident involving EPHI of which it becomes aware in the following manner: (1) any actual, successful Security Incident will be reported to Your Covered Entity in writing without unreasonable delay and in no case later than 60 days after discovery of the Security Incident, and (2) all attempted, unsuccessful Security Incidents (e.g., unsuccessful log-in attempts) are hereby deemed reported to Your Covered Entity. 
   3. Rupa shall, following the discovery of a Breach of Unsecured PHI, notify Your Covered Entity of the Breach in accordance with 45 C.F.R. § 164.410 without unreasonable delay and in no case later than 60 days after discovery of the Breach. 
8. Access to PHI. Within 15 business days of a written request by Your Covered Entity for access to PHI about an Individual contained in any Designated Record Set of Your Covered Entity maintained by Rupa, if any, Rupa shall make available to Your Covered Entity such PHI for so long as Rupa maintains such information in the Designated Record Set. If Rupa receives a request for access to PHI directly from an Individual, Rupa shall forward such request to Your Covered Entity within ten business days. Your Covered Entity shall have the sole responsibility to make decisions regarding whether to approve a request for access to PHI.
9. Availability of PHI for Amendment. Within 15 business days of receipt of a written request from Your Covered Entity for the amendment of an Individual’s PHI contained in any Designated Record Set of Your Covered Entity maintained by Rupa, if any, Rupa shall provide such information to Your Covered Entity for amendment and incorporate any such amendments in the PHI (for so long as Rupa maintains such information in the Designated Record Set) as required by 45 C.F.R. § 164.526. If Rupa receives a request for amendment to PHI directly from an Individual, Rupa shall forward such request to Your Covered Entity within ten business days. Your Covered Entity shall have the sole responsibility to make decisions regarding whether to approve a request for an amendment to PHI. 
10. Accounting of Disclosures. Within 30 business days of written notice by Your Covered Entity to Rupa that it has received a request for an accounting of disclosures of PHI (other than disclosures to which an exception to the accounting requirement applies), Rupa shall make available to Your Covered Entity such information as is in Rupa’s possession and is required for Your Covered Entity to make the accounting required by 45 C.F.R. § 164.528. If Rupa receives a request for an accounting directly from an Individual, Rupa shall forward such request to Your Covered Entity within ten business days. Your Covered Entity shall have the sole responsibility to provide an accounting of disclosures to the Individual.
11. Availability of Books and Records. Following reasonable advance written notice, Rupa shall make Rupa’s internal practices, books and records relating to the use and disclosure of PHI received from, or created or received by Rupa on behalf of, Your Covered Entity available to the Secretary for purposes of determining Your Covered Entity’s compliance with HIPAA.