HIPAA and BAAs — Subcontractors

In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate will ensure that any Subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to restrictions and conditions at least as protective as those that apply to Business Associate under this Agreement, including compliance with the Security Rule for electronic PHI. The categories of subprocessor engaged in providing the Services, and what each processes, are published on the compliance page and updated before a new category is added. Exhibit A limits which Service features may touch PHI precisely so that this flow-down obligation is real rather than aspirational: features whose subprocessors do not hold an appropriate written commitment are excluded from PHI scope until they do.