©2018 All Rights Reserved
These HIPAA Terms and Conditions (“HIPAA Terms and Conditions”) are Additional Terms and Conditions, as defined in the Master Services Agreement (“Agreement”) between you (“you” or “Customer”), and Vosita, and form part of the Agreement. These HIPAA Terms and Conditions set forth your and Vosita Peer 1’s individual responsibilities under: (i) the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191[H.R. 3103]) and its associated regulations, (ii) the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH Act); and (iii) the final rule (Omnibus Rule), and any amendments to each that may be made from time to time (collectively, “HIPAA”). These HIPAA Terms and Conditions shall only apply to you to the extent that Vosita's provision of Services means Vosita is determined to be a Business Associate, as defined in HIPAA.
1.1. Definitions in HIPAA: In these HIPAA Terms and Conditions, the following terms shall have the same meaning as the following terms in HIPAA: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.
1.2. Specific definitions: In these HIPAA Terms and Conditions, the following terms shall have the following meanings:
(a) “Business Associate” shall generally have the same meaning as the term “Business Associate” at 45 CFR 160.103, and in reference to these BAA Terms and Conditions, shall mean Vosita.
(b) “Covered Entity” shall generally have the same meaning as the term “covered entity” at 45 CFR 160.103, and in reference to the party to this agreement, shall mean you, or Customer.
1.3. Definitions in Agreement: Any defined terms used in these HIPAA Terms and Conditions that are not specifically defined herein shall have the defined meanings given to them in the Agreement.
2. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE
2.1. Business Associate may only use or disclose Protected Health Information as necessary to perform the Services set forth in the Agreement.
2.2. Business Associate may use or disclose Protected Health Information as Required By Law.
2.3. Business Associate may not use or disclose Protected Health Information in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity.
3. OBLIGATIONS OF BUSINESS ASSOCIATE
Vosita in its capacity as Business Associate agrees:
3.1. not to use or disclose Protected Health Information other than as permitted or required by the Agreement or as Required By Law;
3.2. to use appropriate safeguards, and to comply with Subpart C of 45 CFR Part 164 with respect to electronic Protected Health Information to prevent Use or Disclosure of Protected Health Information other than as provided for by the Agreement or as Required By Law;
3.3. to notify Covered Entity of any Use or Disclosure of Protected Health Information not provided for in the Agreement of which it becomes aware, including Breaches of Unsecured Protected Health Information as required at 45 CFR 164.410 and any Security Incident of which it becomes aware, as soon as possible after discovery of such violation;
3.4. to fully cooperate, coordinate with and assist Covered Entity in gathering the information necessary to notify affected individuals, if any;
3.5. in accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, to ensure that any Subcontractors that create, receive, maintain, or transmit Protected Health Information during the course of providing Services to Covered Entity on behalf of Business Associate to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information;
3.6. to make available Protected Health Information in a Designated Record Set to Covered Entity as necessary to satisfy its obligations under 45 CFR 164.524;
3.7. in the event Covered Entity or any requests access to Protected Health Information contained in a Designated Record Set directly from the Business Associate, to forward such request to Covered Entity in a timely manner allowing Covered Entity to respond to the Individual in accordance with 45 CFR 45 164.526;
3.8. to make any amendment(s) to Protected Health Information in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526;
3.9. to maintain and make available the information required to provide an accounting of Disclosures to the Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.528;
3.10. to the extent the Business Associate is to carry out one or more of Covered Entity’s obligation(s) under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such obligation(s); and
3.11. to make its internal practices, books, and records available to the Secretary of Health and Human Services for purposes of determining compliance with HIPAA.
4. COVERED ENTITY’S OBLIGATIONS
4.1. Covered Entity shall not request Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under HIPAA if done by the Covered Entity or that is not otherwise expressly permitted under the Agreement.
4.2. Covered Entity shall not request Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Covered Entity.
5. TERM AND TERMINATION
5.1. These HIPAA Terms and Conditions shall continue to be in force for the term of the Agreement to which they are incorporated by reference.
5.2. Upon termination of the Agreement for any reason, Business Associate shall destroy all Protected Health Information received from Covered Entity, or created, maintained, or received by Business Associate on behalf of Covered Entity that the Business Associate still maintains in any form. Business Associate shall retain no copies of the Protected Health Information.
5.3. The obligations of Covered Entity and Business Associate under these HIPAA Terms and Conditions shall survive the termination of this Agreement.
What personal information do we collect from the people that visit our website or app?
When registering on our site, as appropriate, you may be asked to enter your name, mailing address, phone number, date of birth, email address, or other details to help you with your experience.
When do we collect information?
We collect information from you when you enter or update information on our site.
How do we use your information?
We may use the information we collect from you when you register, respond to a survey or marketing communication, surf the website, or use certain other site features in the following ways:
How do we protect visitor information?
Our website is scanned on a regular basis for security holes and known vulnerabilities in order to make your visit to our site as safe as possible.
We use regular Malware Scanning.
Your personal information is contained behind secured networks and is only accessible by a limited number of persons who have special access rights to such systems, and are required to keep the information confidential. In addition, all sensitive/credit information you supply is encrypted via Secure Socket Layer (SSL) technology.
We implement a variety of security measures when a user places an order to maintain the safety of your personal information.
All transactions are processed through a gateway provider and are not stored or processed on our servers.
Do we use ‘cookies’?
You can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies. You do this through your browser (like Internet Explorer) settings. Each browser is a little different, so look at your browser’s Help menu to learn the correct way to modify your cookies.
If you disable cookies off, some features will be disabled It won’t affect the user’s experience that make your site experience more efficient and some of our services will not function properly.
We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information unless we provide users with advance notice. This does not include website hosting partners and other parties who assist us in operating our website, conducting our business, or serving our users, so long as those parties agree to keep this information confidential. We may also release information when it’s release is appropriate to comply with the law, enforce our site policies, or protect ours or others’ rights, property or safety.
However, non-personally identifiable visitor information may be provided to other parties for marketing, advertising, or other uses.
Occasionally, at our discretion, we may include or offer third-party products or services on our website. These third-party sites have separate and independent privacy policies. We therefore have no responsibility or liability for the content and activities of these linked sites. Nonetheless, we seek to protect the integrity of our site and welcome any feedback about these sites.
Google’s advertising requirements can be summed up by Google’s Advertising Principles. They are put in place to provide a positive experience for users. https://support.google.com/adwordspolicy/answer/1316548?hl=en
We use Google AdSense Advertising on our website.
We have implemented the following:
We along with third-party vendors, such as Google use first-party cookies (such as the Google Analytics cookies) and third-party cookies (such as the DoubleClick cookie) or other third-party identifiers together to compile data regarding user interactions with ad impressions and other ad service functions as they relate to our website.
Users can set preferences for how Google advertises to you using the Google Ad Settings page. Alternatively, you can opt out by visiting the Network Advertising initiative opt out page or permanently using the Google Analytics Opt Out Browser add on.
California Online Privacy Protection Act
According to CalOPPA we agree to the following:
Users can visit our site anonymously.
Users are able to change their personal information:
How does our site handle do not track signals?
We honor do not track signals and do not track, plant cookies, or use advertising when a Do Not Track (DNT) browser mechanism is in place.
Does our site allow third-party behavioral tracking?
It’s also important to note that we do not allow third-party behavioral tracking.
COPPA (Children Online Privacy Protection Act)
When it comes to the collection of personal information from children under 13, the Children’s Online Privacy Protection Act (COPPA) puts parents in control. The Federal Trade Commission, the nation’s consumer protection agency, enforces the COPPA Rule, which spells out what operators of websites and online services must do to protect children’s privacy and safety online.
We do not specifically market to children under 13.
Fair Information Practices
The Fair Information Practices Principles form the backbone of privacy law in the United States and the concepts they include have played a significant role in the development of data protection laws around the globe. Understanding the Fair Information Practice Principles and how they should be implemented is critical to comply with the various privacy laws that protect personal information.
In order to be in line with Fair Information Practices we will take the following responsive action, should a data breach occur:
We will notify the users via email
We will notify the users via in-site notification
We also agree to the Individual Redress Principle, which requires that individuals have a right to pursue legally enforceable rights against data collectors and processors who fail to adhere to the law. This principle requires not only that individuals have enforceable rights against data users, but also that individuals have recourse to courts or government agencies to investigate and/or prosecute non-compliance by data processors.
CAN SPAM Act
The CAN-SPAM Act is a law that sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have emails stopped from being sent to them, and spells out tough penalties for violations.
We collect your email address in order to:
To be in accordance with CANSPAM we agree to the following:
If at any time you would like to unsubscribe from receiving future emails, you can email us at
and we will promptly remove you from ALL correspondence.
Vosita Healthcare Inc.
1 Kalisa Way, Suite 101
Paramus NJ 07652
212-966-6110 - 201-903-7000