RIDER 111

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (“Agreement”), effective as of [insert the Month and Day], 20__ (“Effective Date”), is entered into by and between [insert Complete Name of Business Associate], a [identify Business Associate’s legal status, such as an Indiana corporation, or a limited partnership, etc.] with an address at [insert Business Associate’s Complete Address] (the “Business Associate”) and The University of Texas M. D. Anderson Cancer Center, an institution of higher education and an institution within The University of Texas System, with an address at 1515 Holcombe Boulevard, Houston, Texas 77030 (the “Covered Entity”) (each a “Party” and collectively the “Parties”).

The Parties may contemplate entering into one or more agreements (the “Services Agreement”) pursuant to which Business Associate is providing certain [insert the kind(s) of services provided by the Business Associate] (“Services”) to the Covered Entity that require the disclosure and use of Protected Health Information (“PHI”). Unless the Services Agreement specifies otherwise, Business Associate is an independent contractor with respect to the performance of all Services, and neither Business Associate nor anyone employed by Business Associate will be deemed for any purpose to be the employee, agent, servant, or representative of the Covered Entity. Both Parties are committed to complying with the Privacy Rule and the Security Rule promulgated pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as well as the Health Information Technology for Economic and Clinical Health (“HITECH”) Act and associated regulations.

This Agreement sets forth the terms and conditions pursuant to which PHI that is provided by, or created or received by, the Business Associate from or on behalf of the Covered Entity, will be handled between the Business Associate and the Covered Entity and with third parties during the term of each Services Agreement and after its termination. All capitalized terms in this Agreement have the meanings ascribed to them in Section 1 below, unless otherwise noted or the context clearly requires otherwise. The Parties agree as follows:

Definitions

Administrative Safeguards. “Administrative Safeguards” has the same meaning as the term “administrative safeguards” in 45 C.F.R. § 164.304, as such provision is currently drafted and as it is subsequently updated, amended, or revised.

Breach. “Breach” has the same meaning as the term “breach” in 45 C.F.R. § 164.402, as such provision is currently drafted and as it is subsequently updated, amended, or revised.

Breach of System Security. “Breach of System Security” means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of Sensitive Personal Information maintained by a person, including data that is encrypted if the person accessing the data has the key required to decrypt the data.

Designated Record Set. “Designated Record Set” has the same meaning as the term “designated record set” in 45 C.F.R. § 164.501, as such provision is currently drafted and as it is subsequently updated, amended, or revised.

Electronic Protected Health Information. “Electronic Protected Health Information” has the same meaning as the term “electronic protected health information” in 45 C.F.R. § 160.103 (as such provision is currently drafted and as it is subsequently updated, amended, or revised maintained, and/or transmitted), but limited to the information created, received, maintained, and/or transmitted by Business Associate from or on behalf of Covered Entity.

Health Care Operations. “Health Care Operations” has the same meaning as the term “health care operations” in 45 C.F.R. § 164.501, as such provision is currently drafted and as it is subsequently updated, amended, or revised.

HITECH Act. “HITECH Act” means the Health Information and Technology for Economic and Clinical Health Act, as codified at 42 U.S.C. § 1790, which was adopted as part of the American Recovery and Reinvestment Act of 2009 on February 17, 2009.

Individual. “Individual” has the same meaning as the term “individual” in 45 C.F.R. § 160.103, as such provision is currently drafted and as it is subsequently updated, amended, or revised, and will include a person who qualifies as a personal representative in accordance with 45 C.F.R. § 164.502(g).

Physical Safeguards. “Physical Safeguards” has the same meaning as the term “physical safeguards” in 45 C.F.R. § 164.304, as such provision is currently drafted and as it is subsequently updated, amended, or revised.

Privacy Officer. “Privacy Officer” has the same meaning as the term “privacy officer” in 45 C.F.R. § 164.530(a)(1), as such provision is currently drafted and as it is subsequently updated, amended, or revised.

Privacy Rule. “Privacy Rule” means the Standards for Privacy of Individually Identifiable Health Information at 45 C.F.R. Part 160 and Part 164, Subparts A and E.

Protected Health Information. “Protected Health Information” or “PHI” has the same meaning as the term “protected health information” in 45 C.F.R. § 160.103 (as such provision is currently drafted and as it is subsequently updated, amended, or revised maintained, and/or transmitted), but limited to the information created, received, maintained, and/or transmitted by Business Associate from or on behalf of Covered Entity.

Required by Law. “Required by Law” has the same meaning as the term “required by law” in 45 C.F.R. § 164.103, as such provision is currently drafted and as it is subsequently updated, amended, or revised.

Secretary. “Secretary” means the Secretary of the Department of Health and Human Services or his/her designee.

Security Incident. “Security Incident” has the same meaning as the term “security incident” in 45 C.F.R. § 164.304, as such provision is currently drafted and as it is subsequently updated, amended, or revised.

Security Rule. “Security Rule” means the Security Standards for the Protection of Electronic Protected Health Information at 45 C.F.R. Parts 160, 162, and 164, Subpart C.

Sensitive Personal Information. “Sensitive Personal Information” means: (1) an individual’s first name or first initial and last name in combination with any one or more of the following items, if the name and the items are not encrypted: (a) social security number; (b) driver’s license number or government-issued identification number; (c) account number or credit or debit card number in combination with any required security code, access code, or password that would permit access to an individual’s financial account; or (2) information that identifies an individual and relates to: (a) the physical or mental health or condition of the individual; (b) the provision of health care to the individual; or (c) payment for the provision of health care to the individual.

Technical Safeguards. “Technical Safeguards” has the same meaning as the term “technical safeguards” in 45 C.F.R. § 164.304, as such provision is currently drafted and as it is subsequently updated, amended, or revised.

Unsecured PHI. “Unsecured PHI” means PHI that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through use of a technology or methodology specified by the Secretary in the guidance issued under Section 13402(h)(2) of Public Law 111-5.

PERMITTED USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION

Services. Pursuant to the Services Agreement, Business Associate provides Services for the Covered Entity that involve the creation, receipt, maintenance, and/or transmission of PHI. Except as otherwise specified herein, the Business Associate may make any and all uses of PHI necessary to perform its obligations under the Services Agreement. All other uses not authorized by this Agreement or required by law are prohibited. Moreover, Business Associate may disclose PHI for the purposes authorized by this Agreement only (i) to its employees, subcontractors, and agents, in accordance with this Agreement; (ii) as directed by the Covered Entity; or (iii) as otherwise permitted by the terms of this Agreement including, but not limited to, Section 2.2(b) below. Even when PHI has been de-identified in accordance with the requirements of 45 C.F.R. § 164.514(b), Business Associate may not disclose de-identified data for purposes unrelated to performance of the Services without prior approval by the Covered Entity.

Business Activities of the Business Associate. Unless otherwise limited herein, the Business Associate may:

use the PHI in its possession for its proper management and administration and to fulfill any present or future legal responsibilities of the Business Associate provided that such uses are permitted under state and federal confidentiality laws.

disclose the PHI in its possession to third parties for the purpose of its proper management and administration or to fulfill any present or future legal responsibilities of the Business Associate, provided that the Business Associate represents to the Covered Entity, in writing, that (i) the disclosures are Required by Law; or (ii) the Business Associate has entered into a Business Associate Agreement containing substantially similar (or more stringent) terms as this Agreement with any third party that creates, receives, maintains, or transmits PHI on behalf of the Business Associate.

use and/or disclose PHI as permitted under 45 C.F.R. § 164.512 except that uses or disclosures for research are not permitted without prior approval by the Covered Entity.

aggregate the PHI in its possession with the PHI of other covered entities that the Business Associate has in its possession through its capacity as a business associate to those other covered entities provided that the purpose of such aggregation is to provide the Covered Entity with data analyses relating to the Health Care Operations of the Covered Entity. Under no circumstances may the Business Associate disclose PHI of one covered entity to another covered entity absent the explicit authorization of the covered entity.

RESPONSIBILITIES OF THE PARTIES WITH RESPECT TO PROTECTED HEALTH INFORMATION

Responsibilities of the Business Associate. With regard to its use and/or disclosure of Protected Health Information, the Business Associate will:

comply with the HIPAA Security Rule and portions of the HIPAA Privacy Rule applicable to Business Associates.

use and/or disclose the PHI only as permitted or required by this Agreement or as Required by Law and will use appropriate safeguards to prevent impermissible use, access, and disclosure of PHI. Business Associate may not use or disclose PHI in a manner that would violate the Privacy Rule if done by the Covered Entity.

report to the designated Privacy Officer of the Covered Entity, in writing, any use and/or disclosure of the PHI that is not permitted or required by this Agreement (including Breaches of Unsecured PHI as required by 45 C.F.R. § 164.410), Security Incident, Breach of System Security, or disaster incident of which Business Associate becomes aware as soon as the information specified below is known to the Business Associate, but in no case later than thirty (30) days after the Business Associate discovers such incident:

Identification of the individual whose Sensitive Personal Information and/or Unsecured PHI has been, or is reasonably believed by the Business Associate to have been, accessed, acquired, used, or disclosed;

Circumstances of the unauthorized use or disclosure of PHI (including a Breach of Unsecured PHI), Security Incident, or Breach of System Security;

Date of the incident;

Date of the discovery;

Type of PHI or other Sensitive Personal Information involved (such as full name, Social Security number, date of birth, home address, account number, or medical record number); and

Any other additional information the Covered Entity requests.

mitigate, to the greatest extent possible, any deleterious effects from any improper use and/or disclosure of PHI or other Sensitive Personal Information of which the Business Associate becomes aware and/or reports to the Covered Entity.

implement Administrative, Physical, and Technical Safeguards that reasonably and appropriately maintain the security of, prevent unauthorized use and/or disclosure of, and protect the confidentiality, integrity, and availability of any Electronic PHI or other Sensitive Personal Information it creates, receives, maintains, or transmits. At a minimum, Business Associate shall employ Safeguards that are compliant with 45 C.F.R. Part 164, Subpart C, and the National Institute of Standards and Technology (“NIST”) guidelines.

train its employees and agents that receive or use, or have access to PHI under this Agreement regarding the state and federal laws that govern the handling and use of Protected Health Information.

require all of its subcontractors and agents that create, receive, maintain, or transmit PHI on behalf of Business Associate under this Agreement to agree, in the form of a Business Associate Agreement that meets the requirements at 45 C.F.R. § 164.314(a), to adhere to substantially similar or more stringent restrictions and conditions on the use and/or disclosure of PHI as those that apply to the Business Associate pursuant to Section 3 of this Agreement.

ensure that any agent or subcontractor agrees to implement reasonable and appropriate safeguards that are compliant with 45 C.F.R. Part 164, Subpart C, and the NIST guidelines to protect the confidentiality, integrity, and availability of the Electronic PHI that it creates, receives, maintains, or transmits.

make available all records, books, agreements, policies, and procedures relating to the use and/or disclosure of PHI to the Secretary, in the time and manner designated by the Secretary, for purposes of the Secretary’s determination that the Covered Entity and Business Associate have complied with the Privacy Rule, subject to attorney-client and other applicable legal privileges.

within forty-eight (48) hours of receiving a written request from the Covered Entity, make available during normal business hours at Business Associate’s offices all records, books, agreements, policies, and procedures relating to the use and/or disclosure of PHI for purposes of enabling the Covered Entity to determine the Business Associate’s compliance with the terms of this Agreement.

within five (5) days of receiving a written request from the Covered Entity, provide to the Covered Entity such information as is requested by the Covered Entity to permit the Covered Entity to respond to a request by an Individual for an accounting of the disclosures of the Individual's PHI in accordance with 45 C.F.R. § 164.528.

to the extent that Business Associate is obligated to carry out one or more of Covered Entity’s obligations under the Privacy Rule, comply with the Privacy Rule requirements that apply to the Covered Entity in the performance of such obligations.

subject to Section 5.4 below, return to the Covered Entity or “securely destroy” (as that term is defined in Section 5.4) and certify such destruction in writing, promptly after the termination of this Agreement, the Protected Health Information in its possession and retain no copies (which for purposes of this Agreement means destroy all backup tapes).

disclose to its subcontractors, agents, or other third parties only the minimum PHI necessary to perform or fulfill a specific function required or permitted under the Services Agreement or this Agreement.

This Section 3.1 will survive the termination of this Agreement with respect to the PHI that Business Associate and its subcontractors or agents retain in accordance with Section 5.4 below because it is not feasible to return or destroy such PHI.

Responsibilities of the Covered Entity. With regard to the use and/or disclosure of PHI by the Covered Entity to the Business Associate or the use and/or disclosure of PHI by the Business Associate, the Covered Entity will:

provide Business Associate with a copy of its notice of privacy practices (the “NPP”) that the Covered Entity provides to Individuals pursuant to 45 C.F.R. § 164.520. Visit this address to view the most current NPP:

http://www.mdanderson.org/about-us/legal-and-policy/legal-statements/legal-statements-joint-notice-of-privacy-practices.html

notify the Business Associate of any changes in, or revocation of, the consent or authorization provided to the Covered Entity by Individuals pursuant to 45 C.F.R. § 164.506 or § 164.508, to the extent such changes may affect Business Associate’s use or disclosure of PHI.

notify the Business Associate, in writing and in a timely manner, of any arrangements permitted or required of the Covered Entity under 45 C.F.R. Parts 160 and 164 that may impact in any manner the use and/or disclosure of PHI by the Business Associate under this Agreement, including, but not limited to, restrictions on use and/or disclosure of PHI (as provided for in 45 C.F.R. § 164.522) agreed to by the Covered Entity, to the extent such restrictions may affect Business Associate’s use or disclosure of PHI.

not request Business Associate to use or disclose PHI in any manner that would not be permissible under the Privacy Rule if done by the Covered Entity.

ADDITIONAL RESPONSIBILITIES OF THE PARTIES WITH RESPECT TO PROTECTED HEALTH INFORMATION

Responsibilities of the Business Associate with Respect to Handling of Designated Record Set. In the event that the Covered Entity determines that the PHI constitutes a Designated Record Set, the Business Associate will:

at the request of, and in the time and manner designated by the Covered Entity, provide access to the PHI to the Covered Entity or the Individual to whom such PHI relates or his or her authorized representative in order to meet a request by such Individual under 45 C.F.R. § 164.524.

at the request of, and in the time and manner designated by the Covered Entity, make any amendment(s) to the PHI that the Covered Entity directs pursuant to 45 C.F.R. § 164.526. Provided, however, that the Covered Entity makes the determination that the amendment(s) are necessary because the PHI that is the subject of the amendment(s) has been, or could foreseeably be, relied upon by the Business Associate or others to the detriment of the Individual who is the subject of the PHI to be amended.

Responsibilities of the Covered Entity with Respect to the Handling of the Designated Record Set. In the event that the Covered Entity determines that the PHI constitutes a Designated Record Set, the Covered Entity will:

notify the Business Associate, in writing, of any PHI that Covered Entity seeks to make available to an Individual pursuant to 45 C.F.R. § 164.524 and the time, manner, and form in which the Business Associate will provide such access.

notify the Business Associate, in writing, of any amendment(s) to the PHI in the possession of the Business Associate that the Business Associate will be required to make and inform the Business Associate of the time, form, and manner in which such amendment(s) will be made.

HITECH Act Obligations. Business Associate acknowledges that:

Sections 164.306, 164.308, 164.310, 164.312, 164.314 and 164.316 of title 45 of the Code of Federal Regulations (regarding administrative, physical, and technical security standards) apply to Business Associate in the same manner in which such sections apply to Covered Entity. The provisions of the HITECH Act that impose additional requirements and standards on Covered Entities with respect to health information security are also applicable to Business Associate and are hereby incorporated into the Agreement.

the HITECH Act requires it to use or disclose PHI only if such use or disclosure is in compliance with all applicable requirements of Section 164.504(e) of the Privacy Rule. The additional requirements of the HITECH Act that impose requirements and standards on Covered Entities with respect to privacy are also applicable to Business Associate and are hereby incorporated into the Agreement.

Survival. Sections 4.1 and 4.2 of this Agreement will survive the termination of this Agreement.

TERM AND TERMINATION

Term. This Agreement will become effective on the Effective Date and will continue in effect until all obligations of the Parties have been met, unless terminated as provided in this Section 5. Expiration or termination of this Agreement will not affect any provisions that expressly survive as provided herein.

Termination by the Covered Entity. As provided for under 45 C.F.R. § 164.504(e)(2)(iii), the Covered Entity may immediately terminate this Agreement and any Services Agreement if the Covered Entity makes the determination that the Business Associate has breached a material term of this Agreement. Alternatively, the Covered Entity may choose to: (i) provide the Business Associate with thirty (30) days’ written notice of the existence of an alleged material breach; and (ii) afford the Business Associate an opportunity to cure said alleged material breach upon mutually agreeable terms. Nonetheless, in the event that mutually agreeable terms cannot be achieved within thirty (30) days, Business Associate must cure said breach to the satisfaction of the Covered Entity within thirty (30) days. Failure to cure in the manner set forth in this paragraph is grounds for the immediate termination of this Agreement and any Services Agreement. Nothing contained in this Section 5.2 will be deemed to require the Covered Entity to terminate this Agreement and the Services Agreement upon breach by Business Associate of a material term of this Agreement if termination is not feasible, and the Covered Entity will have the right to report any such breach to the Secretary as provided for under 45 C.F.R. § 164.504(e)(1)(ii).

Termination by Business Associate. If Covered Entity breaches a material term of this Agreement, Business Associate shall: (i) provide the Covered Entity with written notice of the existence of an alleged material breach, and (ii) provide the Covered Entity an opportunity to cure the alleged material breach upon mutually agreeable terms. If mutually agreeable terms cannot be achieved and the breach cannot be cured within thirty (30) days of the written notice, Business Associate will allow Covered Entity the opportunity to promptly commence curative action and diligently and continuously pursue the curative action to completion, up to a total of one hundred eighty (180) additional days. If Covered Entity is unable to cure the breach within such one hundred eighty (180) day period, Business Associate may terminate this Agreement and any applicable Services Agreement. Notwithstanding the foregoing, if Business Associate terminates this Agreement but is unable to continue to provide Services under a Service Agreement without violating HIPAA or the HITECH Act, Business Associate may terminate such Services Agreement effective immediately upon the termination of this Agreement, provided that it will not terminate this Agreement so long as any Services Agreement is in effect.

Effect of Termination. Upon termination of a Services Agreement, Business Associate will return or securely destroy all PHI pursuant to 45 C.F.R. § 164.504(e)(2)(ii)(J), if it is feasible to do so. For purposes of this Agreement, “securely destroy” means to: (1) shred; (2) erase; or (3) otherwise modify the records to make the information unreadable or indecipherable through any means. Prior to doing so, the Business Associate will recover any PHI in the possession of its subcontractors or agents. Within sixty (60) days of termination, the Business Associate shall certify in writing that the PHI has been destroyed. If it is not feasible for the Business Associate to return or destroy said PHI, the Business Associate will notify the Covered Entity in writing. The notification will include: (i) a statement that the Business Associate has determined that it is not feasible to return or destroy the PHI in its possession; and (ii) the specific reasons for such determination. Business Associate will extend any and all protections, limitations, and restrictions contained in this Agreement to the Business Associate’s use and/or disclosure of any PHI retained after the termination of this Agreement, and limit any further uses and/or disclosures to the purposes that make the return or destruction of the PHI not feasible. If it is not feasible for the Business Associate to obtain, from a subcontractor or agent any PHI in the possession of the subcontractor or agent, the Business Associate must provide a written explanation to the Covered Entity and require the subcontractors and agents to agree to extend any and all protections, limitations, and restrictions contained in this Agreement and its Business Associate Agreements with the subcontractors and agents to the subcontractors’ and/or agents’ use and/or disclosure of any PHI retained after the termination of this Agreement, and to limit any further uses and/or disclosures to the purposes that make the return or destruction of the PHI infeasible. Business Associate’s obligations under this Section 5.4 will not apply to PHI that is the subject of other agreements between Covered Entity and Business Associate to the extent those other agreements survive the termination, and Business Associate may retain any PHI necessary to Business Associate’s services under any other agreements with Covered Entity.

ACKNOWLEDGEMENT

Mutual Acknowledgments of the Parties. Each Party acknowledges and agrees that:

it is duly organized, validly existing, and in good standing under the laws of the jurisdiction in which it is organized or licensed, it has the full power to enter into this Agreement and to perform its obligations hereunder, and that the performance by it of its obligations under this Agreement have been duly authorized by all necessary corporate or other actions and will not violate any provision of any license, corporate charter, or bylaws.

neither the execution of this Agreement, nor its performance hereunder, will directly or indirectly violate or interfere with the terms of another agreement to which it is a party, or give any governmental entity the right to suspend, terminate, or modify any of its governmental authorizations or assets required for its performance hereunder. Each Party certifies to the other Party that it will not enter into any agreement the execution and/or performance of which would violate or interfere with this Agreement.

it is not currently the subject of a voluntary or involuntary petition in bankruptcy, does not currently contemplate filing any such voluntary petition, and is not aware of any claim for the filing of an involuntary petition.

all of its employees, agents, representatives, and members of its workforce, whose services may be used to fulfill obligations under this Agreement are or will be appropriately informed of the terms of this Agreement and are under legal obligation to each Party, respectively, by contract or otherwise, sufficient to enable each Party to fully comply with all provisions of this Agreement including, without limitation, the requirement that modifications or limitations to which the Covered Entity has agreed to adhere regarding the use and disclosure of PHI of any Individual that materially affect and/or limit the uses and disclosures that are otherwise permitted under the Privacy Rule will be communicated to the Business Associate, in writing, and in a timely fashion.

it will reasonably cooperate with the other Party in the performance of their mutual obligations under this Agreement and their respective obligations under HIPAA.

Each Party will immediately notify the other Party as soon as the Party becomes aware that any of the foregoing acknowledgements may be inaccurate or may become incorrect.

INDEMNIFICATION

Breach of PHI and Breach of System Security. Business Associate will pay or reimburse Covered Entity for all costs and penalties incurred by Covered Entity in connection with any incident giving rise to a Breach of PHI and/or a Breach of System Security, including without limitation all costs related to any investigation, any notices to be given, reasonable legal fees, or other actions taken to comply with HIPAA, the HITECH Act, or any other applicable law or regulation, where (i) the PHI was in the custody or control of Business Associate when the Breach of PHI and/or Breach of System Security occurred, or (ii) the Breach of PHI and/or Breach of System Security was caused by the negligence or wrongful acts or omissions of Business Associate and its employees, directors, officers, subcontractors, agents, or other members of its workforce.

MISCELLANEOUS [Some of the provisions below may be omitted except in the case of a stand-alone agreement.]

Business Associate. For purposes of this Agreement, Business Associate will include the named Business Associate herein. However, in the event that the Business Associate is otherwise a covered entity under the Privacy Rule, that entity may appropriately designate a health care component of the entity, pursuant to 45 C.F.R. § 164.105(a), as the Business Associate for purposes of this Agreement.

Amendments; Waiver. This Agreement may not be modified, nor will any provision hereof be waived or amended, except in a writing duly signed by authorized representatives of the Parties. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for Covered Entity to comply with the requirements of the Privacy Rule, the Security Rule, HIPAA, and the HITECH Act. A waiver with respect to one event will not be construed as continuing, or as a bar to or waiver of any right or remedy as to subsequent events.

No Third Party Beneficiaries. Nothing express or implied in this Agreement is intended to confer, nor will anything herein confer, upon any person other than the Parties and the respective successors or assigns of the Parties, any rights, remedies, obligations, or liabilities whatsoever.

Notices. Any notice required or permitted to be sent under this Agreement will be delivered by hand, by facsimile (with confirmation of transmission), or mailed by a nationally recognized overnight courier service (delivery receipt requested) with charges paid by the dispatching Party, or mailed by registered or certified mail (return receipt requested) to the receiving Party, at the respective notice addresses identified in this Section. Notice so mailed will be deemed effective (i) upon hand delivery; (ii) on the scheduled date of delivery by a nationally recognized overnight courier service, or (iii) on the third (3rd) day following the date of deposit into the United States mail.

If to Business Associate, to:

[Name of Business Associate]

Attn: [Insert Name and/or Title]

[Address]

[Address]

[City, State Zip Code]

Fax No.: [Insert Facsimile Number]

If to Covered Entity, to:

The University of Texas

M. D. Anderson Cancer Center

Attn: Privacy Officer

Institutional Compliance Office

Unit 1640

P.O. Box 301407

Houston, Texas 77230-1407

Fax No.: 713-563-4324

Each Party may change its address and that of its representative for notice by the giving of notice thereof in the manner hereinabove provided.

Counterparts; Facsimiles. This Agreement may be executed in any number of counterparts, each of which for all purposes will be deemed an original of this Agreement, but all of which together will constitute one and the same document. This Agreement also may be evidenced by facsimile signature or by e-mail delivery of a “.pdf” format data file, and facsimile or “.pdf” signature page will be deemed to be an original signature.

Governing Law and Venue. This Agreement will be construed under and in accordance with the laws of the State of Texas without reference to its conflicts of law provisions. Subject to the sovereign immunity of the State of Texas, any lawsuit brought against the Covered Entity under this Agreement may only be filed in the State or Federal District Courts in Harris County, Texas.

Disputes. If any controversy, dispute, or claim arises between the Parties with respect to this Agreement, the Parties will make good faith efforts to resolve such matters informally.

Survival. Expiration or termination of this Agreement will not affect any right or obligation that either Party may have accrued prior to, or that expressly survives, the expiration or termination of this Agreement.

Headings. The headings used in this Agreement are used for reference purposes only and do not constitute substantive matters to be considered in construing the terms of this Agreement.

Interpretation. Any ambiguity in this Agreement will be resolved in favor of a meaning that permits Covered Entity to comply with the Privacy Rule and the Security Rule.

[Remainder of page intentionally left blank. Signature page follows.]

IN WITNESS WHEREOF, each of the undersigned has caused this Agreement to be duly executed in its name and on its behalf as of the Effective Date.

COVERED ENTITY: The University of Texas M. D. Anderson Cancer Center	BUSINESS ASSOCIATE: [insert Complete Name]
By:	By:
Name:	Name:
Title:	Title:
Date:	Date: