XVIAH HIPAA SUBCONTRACTOR BUSINESS ASSOCIATE AGREEMENT
Designer / External Service Provider Version
Effective Date: Date of Acceptance
This HIPAA Subcontractor Business Associate Agreement (“Subcontractor BAA”) is entered into between Xviah Co., Ltd, 35, Geumgok-daero 303beon-gil, Buk-gu, Busan, Republic of Korea, business registration number 181-88-03814 (“Xviah”), and the independent contractor, CAD designer, CAD design company, or other external service provider accepting this Agreement (“Designer/Subcontractor”). Xviah receives certain PHI from Xviahlink Inc. in support of viahlink.com and requires the Designer/Subcontractor to comply with the same applicable restrictions, conditions, and safeguards.
This Agreement applies where Subcontractor creates, receives, maintains, or transmits PHI in connection with services performed for Xviah in support of viahlink.com.
1. Purpose
Xviahlink provides digital dental CAD design and related services.
Subcontractor may receive access to dental case information that constitutes PHI.
This Agreement establishes Subcontractor’s contractual privacy and security obligations concerning such PHI.
2. HIPAA Compliance
Subcontractor shall comply with applicable requirements of HIPAA, the HITECH Act, and regulations at 45 C.F.R. Parts 160 and 164 to the extent applicable to Subcontractor.
Capitalized HIPAA terms have the meanings assigned under the HIPAA Rules.
3. Permitted Use of PHI
Subcontractor may use PHI only to perform authorized services for Xviah in support of viahlink.com.
Subcontractor shall not use PHI for personal purposes, marketing, advertising, unrelated commercial purposes, personal research, portfolio purposes, social media, or any purpose unrelated to the assigned case.
Subcontractor shall not sell PHI or disclose PHI to unauthorized persons.
Subcontractor shall not attempt to identify a patient beyond what is reasonably necessary for assigned work.
4. Minimum Necessary Access
Subcontractor shall access only information reasonably necessary to complete an assigned case.
Where viahlink.com provides a Case ID rather than a patient name, Subcontractor shall use the Case ID and shall not attempt to determine or obtain the patient’s identity.
5. Account and Security Requirements
Subcontractor shall maintain confidential Account credentials and shall not share credentials with unauthorized persons.
Subcontractor shall use only authorized systems and approved accounts to access viahlink.com cases.
Subcontractor shall use reasonable device security, authentication, secure networks, updated operating systems and security software, and other security measures required by Xviah or the authorized viahlink.com workflow.
Screens and workspaces containing case information shall be protected from unauthorized viewing.
6. Downloads and Local Storage
Subcontractor may download Case Files, including STL, PLY, OBJ, Exocad, 3Shape, and other dental CAD-related files, to a local computer when reasonably necessary to perform an assigned Case.
Any local computer used to access, download, store, or process case files or Protected Health Information (“PHI”) must be under the control of the subcontractor or its authorized personnel and must be protected by reasonable security measures, including password-protected user access, current operating system and security updates, and other safeguards appropriate to the sensitivity of the information.
Locally downloaded case files and PHI may be used solely for the purpose of completing the assigned viahlink.com Case and may not be used for any personal, commercial, training, portfolio, marketing, or other unauthorized purpose.
Subcontractor shall not transfer, copy, upload, or store case files or PHI on personal cloud storage services, unauthorized file-sharing services, personal email accounts, messaging applications, USB drives, removable media, or other systems not authorized by Xviah or the authorized viahlink.com workflow.
Access to locally stored case files and PHI must be limited to authorized personnel who require such access to perform the assigned case.
Subcontractor shall retain locally downloaded case files and PHI only for as long as reasonably necessary to complete the assigned case and any authorized revisions. Unless otherwise instructed by Xviah or the authorized viahlink.com workflow or required by applicable law, subcontractor shall securely delete all locally stored copies within thirty (30) days after the case is completed and accepted by the customer.
Subcontractor shall take reasonable steps to ensure that deleted case files and PHI are not intentionally retained in personal archives, desktop folders, download folders, recycle bins, backup folders, or other locations under the subcontractor’s control.
Subcontractor shall promptly notify Xviah if any device containing case files or PHI is lost, stolen, compromised, accessed by an unauthorized person, or otherwise involved in a suspected security incident.
7. Confidentiality
Subcontractor shall maintain the confidentiality of all PHI, case files, customer information, pricing, business information, and other non-public viahlink.com information.
These obligations survive termination.
8. Personnel
If subcontractor is a company with employees or multiple designers, it shall limit PHI access to personnel whose duties require access to perform authorized work.
Subcontractor shall ensure that such personnel are subject to appropriate confidentiality, privacy, and security requirements.
9. Further Subcontracting
Subcontractor shall not disclose PHI or case files to another freelance designer, company, dental laboratory, subcontractor, or third party without prior authorization from Xviah.
Where further subcontracting involving PHI is authorized, an appropriate written HIPAA agreement must be in place before PHI is provided.
10. No Portfolio, Social Media, or Training Use
Without express written authorization from Xviah and any other legally required authorization, subcontractor shall not use case files, screenshots, designs, dental scans, patient information, photographs, or customer information in portfolios, social media, websites, advertising, presentations, demonstrations, publications, or training materials.
11. Security Incident Reporting
Subcontractor shall notify Xviah without unreasonable delay if it discovers or reasonably suspects unauthorized access, unauthorized disclosure, account compromise, lost or stolen equipment containing PHI, unauthorized downloads, malware affecting PHI, or another material security incident.
Subcontractor shall cooperate with Xviah in investigating, mitigating, and responding to the incident.
12. Breach Notification
Subcontractor shall notify Xviah without unreasonable delay upon discovery of a breach or suspected breach involving unsecured PHI.
Subcontractor shall provide reasonably available information necessary for Xviah in support of viahlink.com to satisfy its contractual and regulatory obligations.
Subcontractor shall not delay initial notice merely because an investigation remains ongoing.
13. International Access
Subcontractor may perform authorized services from locations outside the United States, including the Republic of Korea and Vietnam, as permitted by Xviah or the authorized viahlink.com workflow.
Regardless of the country or physical location from which the services are performed, subcontractor shall remain fully subject to the privacy, confidentiality, security, and other obligations outlined in this Agreement.
Subcontractor shall access PHI and case files only through systems, devices, and methods authorized by Xviah or the authorized viahlink.com workflow and shall maintain appropriate safeguards to protect such information from unauthorized access, use, or disclosure
14. Return and Destruction
Upon completion of applicable services, termination of access, or request by Xviah or the authorized viahlink.com workflow, subcontractor shall return or securely destroy PHI where required and feasible.
Subcontractor shall not retain PHI or case files for personal archives, portfolios, future reference, independent training, or marketing.
15. Access Termination
Xviah may immediately suspend or terminate Subcontractor’s access if viahlink.com reasonably believes PHI is at risk, account credentials are compromised, Subcontractor has violated this agreement, or suspension is necessary to protect customers, patients, or the service.
16. HIPAA Cooperation
Subcontractor shall reasonably cooperate with Xviah concerning HIPAA access requests, amendments, accounting of disclosures, security investigations, breach investigations, regulatory inquiries, and other applicable compliance obligations.
17. Government Access
Subcontractor shall make applicable records relating to PHI available as required by applicable HIPAA Rules.
18. Termination
Xviah may terminate this Agreement or subcontractor’s PHI access for material violation of this agreement.
Following termination, subcontractor shall cease unauthorized access to PHI and return or securely destroy PHI as required and feasible.
19. Responsibility
Subcontractor is responsible, subject to applicable law and any underlying contractor or service agreement, for any unauthorized use or disclosure of PHI or case files resulting from subcontractor’s failure to comply with this agreement.
Subcontractor shall promptly cooperate with Xviah in investigating, mitigating, and responding to any such unauthorized use, disclosure, security incident, or breach.
20. No Ownership of PHI
Nothing in this agreement gives subcontractor ownership of patient information, PHI, case files, customer information, or other information accessed through the service.
Access is solely for performance of authorized services.
21. Electronic Acceptance
This Agreement may be accepted electronically.
Xviah may maintain the subcontractor name, company name, account identifier, agreement version, date and time of acceptance, and associated audit information.
22. Governing Law
To the extent not governed or preempted by federal law, this agreement shall be governed by the laws of the Republic of Korea.
23. Survival
Privacy, confidentiality, security, breach reporting, return or destruction, and other obligations that by their nature should survive termination shall remain effective after termination.
24. Contact
Xviah Co., Ltd
35, Geumgok-daero 303beon-gil, Buk-gu, Busan, Republic of Korea
Business Registration No.: 181-88-03814
HIPAA/Privacy Contact: Jinyong Yoo/CEO
Email: jinyongyoo@gmail.com