Data Processing & Business Associate Agreement

This Data Processing & Business Associate Agreement ("Agreement") forms part of the agreement between OmniCare ("Business Associate" and "Service Provider") and the healthcare provider or organization using OmniCare ("Covered Entity" and "Business") where OmniCare creates, receives, maintains or transmits protected health information (PHI) or personal information on the Covered Entity's behalf.

1. Permitted uses and disclosures

OmniCare uses and discloses PHI only to provide the services the Covered Entity has enabled (bookings, records, orders, lab workflow, emergency coordination), as permitted by this Agreement or required by law (45 CFR 164.504(e)). OmniCare does not sell or share personal information, and does not use it for cross-context behavioral advertising (Cal. Civ. Code 1798.140).

2. Minimum necessary

OmniCare limits uses, disclosures and requests of PHI to the minimum necessary to accomplish the intended purpose.

3. Confidentiality

Everyone authorized to access PHI is bound by confidentiality and trained on privacy and security. Access follows least privilege and is recorded in a tamper-evident audit trail.

4. Safeguards

OmniCare maintains administrative, physical and technical safeguards consistent with the HIPAA Security Rule: encryption in transit and at rest (AES-256-GCM field-level encryption), MFA for staff, role-based access with patient consent checks, and audit logging of every access to health data.

5. Subcontractors

OmniCare uses only the subcontractors listed on the Sub-processors page, each bound by a written Business Associate Agreement with the same restrictions, and informs the Covered Entity of changes in advance.

6. Individual rights

OmniCare helps the Covered Entity respond to requests to access, amend and receive an accounting of disclosures of PHI under HIPAA, and to requests to know, correct, delete and limit the use of personal information under California law, through the Privacy Center and the request queue.

7. Breach notification

OmniCare reports any security incident or breach of unsecured PHI to the Covered Entity without unreasonable delay — and in any case within 5 business days of discovery — with the information the Covered Entity needs to notify affected individuals, HHS and, where required, the California Department of Public Health.

8. Return or destruction

At the end of the agreement OmniCare returns or destroys all PHI, except records the law requires to be kept, which remain protected until their retention period ends.

9. Compliance records

OmniCare makes its internal practices, books and records relating to PHI available to the Covered Entity and to the Secretary of HHS for determining compliance.