4-Appendix Two - Sample Agreement.pdf

Business Associate Agreement

This Business Associate Agreement (“Agreement”), effective ___________________, 2026 (“Effective Date”), is entered into by and between The University of Texas Health Science Center at San Antonio (“Covered Entity”) and _________________________________, a _____________________________ company doing business as “________________________” (“Business Associate”, as more fully defined in section 1(c)) (each a “Party” and collectively the “Parties”).

RECITALS

WHEREAS, Covered Entity has entered or is entering into that certain Purchase Order Agreement with Business Associate (“the Underlying Agreement”) by which it has engaged Business Associate to perform services;

WHEREAS, Covered Entity possesses Protected Health Information that is protected under HIPAA and the HIPAA Regulations, HITECH Act and state law, including the Medical Records Privacy Act (MRPA), and is permitted to manage such information only in accordance with HIPAA and the HIPAA Regulations, HITECH Act, and MRPA;

WHEREAS, Business Associate may receive such information from Covered Entity, or create, receive, maintain or transmit such information on behalf of Covered Entity, in order to perform certain of the services under the Underlying Agreement;

WHEREAS, the Parties desire to comply with health information privacy and security protections subsequent to the enactment of the HITECH Act, Subtitle D of the American Recovery and Reinvestment Act of 2009 which has established requirements for compliance with HIPAA. In particular, the requirements provide that: (1) Covered Entity give affected individuals notice of security breaches affecting their PHI, and Business Associate give notice to Covered Entity pursuant to the provisions below; (2) Business Associate comply with the HIPAA security regulations; and (3) additional and/or revised provisions be included in Business Associate Agreement;

WHEREAS, Under HIPAA and HITECH, Covered Entity is required to enter into protective agreements, generally known as “business associate agreements,” with certain downstream entities that will be entrusted with HIPAA-protected health information;

WHEREAS, Health information is further protected by state law, including the MRPA; and

WHEREAS, Covered Entity wishes to ensure that Business Associate will appropriately safeguard Protected Health Information.

NOW THEREFORE, Covered Entity and Business Associate agree as follows:

1. Definitions. The Parties agree that the following terms, when used in this

Agreement, shall have the following meanings, provided that the terms set forth below shall be deemed to be modified to reflect any changes made to such terms from time to time as defined in HIPAA and the HIPAA Regulations and the MRPA. All capitalized terms used in this Agreement but not defined below shall have the meaning assigned to them under the HIPAA Regulations.

a. “Artificial Intelligence” shall mean means systems capable of perceiving an environment through data acquisition and processing and interpreting the derived information to take an action or actions or to imitate intelligent behavior given a specific goal; and learning and adapting behavior by analyzing how the environment is affected by prior actions, including automated decision system that makes final decisions, judgments, or conclusions without human intervention; including automated decision system that provides information to inform the final decision, judgment, or conclusion of a human decision maker. Tex.Govt.Code § 2054.621

b. “Breach” shall have the meaning given such term under 45 C.F.R. § 164.402 as such regulation is revised from time to time.

c. “Breach of System Security” means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of Sensitive Personal Information maintained by a person, including data that is encrypted if the person accessing the data has the key required to decrypt the data.

d. “Business Associate” means, with respect to a Covered Entity, a person who:

1) on behalf of such Covered Entity or of an Organized Health Care Arrangement (as defined under the HIPAA Regulations) in which the Covered Entity participates, but other than in the capacity of a member of the workplace of such Covered Entity or arrangement, creates, receives, maintains, or transmits PHI for a function or activity regulated by HIPAA, HIPAA Regulations, or MRPA including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, patient safety activities listed at 42 C.F.R. 3.20, billing, benefit management, practice management, and re-pricing; or

2) provides, other than in the capacity of a member of the workforce of such Covered Entity, legal, actuarial, accounting, consulting, Data Aggregation, management, administrative, accreditation, or financial services to or for such Covered Entity, or to or for an Organized Health Care Arrangement in which the Covered Entity participates, where the provision of the service involves the disclosure of PHI from such Covered Entity or arrangement, or from another Business Associate of such Covered Entity or arrangement, to the person.

e. “Data Aggregation” shall have the meaning given such term under 45 C.F.R. §

164.501 as such regulation is revised from time to time.

f. “HIPAA” means the Health Insurance Portability and Accountability Act of

1996, Public Law 104-191.

g. “HIPAA Regulations” means the regulations promulgated under HIPAA by the United States Department of Health and Human Services, including, but not limited to, 45 C.F.R. Part 160 and 45 C.F.R. Part 164 subparts A and E (“The Privacy Rule”) and the Security Standards as they may be amended from time to time, 45 C.F.R. Parts 160, 162 and 164, Subpart C (“The Security Rule”).

h. “HITECH Act” means the provisions of Division A, Title XIII of the American

Recovery and Reinvestment Act of 2009, known as The Health Information Technology for Economic and Clinical Health, Act 42 U.S.C. §3000 et. seq., and implementing regulations and guidance, including the regulations implemented in 78 Fed. Reg. 5566 (January 25, 2013).

i. “Individually Identifiable Health Information” means information that is a subset of health information, including demographic information collected from an individual, and:

1) is created or received by a health care provider, health plan, employer, or health care clearinghouse; and

2) relates to past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and

a) that identifies the individual; or

b) with respect to which there is a reasonable basis to believe the information can be used to identify the individual.

j. “MRPA” means Texas Medical Records Privacy Act, as codified in Section 181 et seq. of the Texas Health and Safety Code and as implemented through regulations including the Standards Relating to the Electronic Exchange of Health Information, codified at Title 1, Section 390.1 et seq. of the Texas Administrative Code.

k. “Protected Health Information” or “PHI” means Individually Identifiable

Health Information that is transmitted by electronic media; maintained in any medium described in the definition of the term electronic media in the HIPAA Regulations; or transmitted or maintained in any other form or medium. The term excludes Individually Identifiable Health Information in educational records covered by the Family Educational Right and Privacy Act, as amended, 20 U.S.C. § 1232g; records described at 20 U.S.C. § 1232g(a)(4)(B)(iv); and employment records held by a Covered Entity in its role as employer and regarding a person who has been deceased more than 50 years.

l. “Security Incident” shall have the meaning given such term under 45 C.F.R. §

164.304 as such regulation is revised from time to time

m. “Sensitive Personal Information” means: (1) an individual’s first name or first initial and last name in combination with any one or more of the following items, if the name and the items are not encrypted: (a) social security number; (b) driver’s license number or government-issued identification number; (c) account number or credit or debit card number in combination with any required security code, access, code, or password that would permit access to an individual’s financial account; or (2) PHI information that identifies an individual and relates to: (a) the physical or mental health or condition of the individual; (b) the provision of health care to the individual;

or (c) payment for the provision of health care to the individual.

n. “Unsecured PHI” means PHI that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified in the guidance issued under Section 13402(h)(2) of the HITECH Act on the HHS web site.

2. Permitted Uses and Disclosures.

a. Compliance with Law. Covered Entity and Business Associate agree to comply with HIPAA, HIPAA Regulations, the HITECH Act, and the MRPA.

b. Performance of Services. Except as otherwise permitted by this Agreement, Business Associate may create, receive, maintain or transmit PHI on behalf of Covered Entity only in connection with the performance of the services contracted for in the Underlying Agreement or as Required by Law (as that term is defined by 45 C.F.R. § 164.103).

c. Proper Management and Administration. Business Associate may use PHI it receives in its capacity as Covered Entity’s Business Associate for the proper management and administration of Business Associate in connection with the performance of services in the Underlying Agreement, as permitted by this Agreement or as Required by Law (as that term is defined by 45 C.F.R. § 164.103), and to carry out the legal responsibilities of Business Associate.

Business Associate may also disclose Covered Entity’s PHI for such proper management and administration of Business Associate and to carry out the legal responsibilities of Business Associate. Any such disclosure of PHI shall only be made in accordance with the terms of this Agreement, including Section 5(c) if to an agent or subcontractor of Business Associate, and only if Business Associate obtains reasonable written assurances from the person to whom the PHI is disclosed that: (1) the PHI will be held confidentially and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and (2) Business Associate will be notified by such person of any instances of which it becomes aware in which the confidentiality of the PHI has been breached.

d. Data Aggregation. Business Associate may use and disclose PHI received by Business Associate in its capacity as Covered Entity’s business associate in order to provide Data Aggregation services relating to Covered Entity’s health care operations only with Covered Entity’s permission.

e. De-identified information. Business Associate may use and disclose de-identified health information if written approval from the Covered Entity is obtained, and the PHI is de-identified in compliance with the HIPAA Rules.

f. Artificial Intelligence (AI). Business Associate is prohibited from using, sharing or disclosing PHI for the training, submission, or use of any artificial intelligence (AI) module, product, or service offering created, offered, or used by Business Associate and any subcontractor or agent. Business Associate shall work with Covered Entity to address appropriate legal and data privacy protections related to PHI if AI tools are desired to be used by both Parties.

3. Nondisclosure.

a. As Provided in Agreement. Business Associate shall not use or further disclose Covered Entity’s PHI other than as permitted or required by this Agreement or as Required by Law (as that term is defined by 45 C.F.R. § 164.103).

b. Disclosures Required By Law. Business Associate shall not, without prior written consent of Covered Entity, disclose any PHI on the possibility that such disclosure is required by law without notifying, to the extent legally permitted, Covered Entity so that the Covered Entity shall have an opportunity to object to the disclosure and to seek appropriate relief. If Covered Entity objects to such a disclosure, Business Associate, shall, to the extent permissible by law, refrain from disclosing the PHI until Covered Entity has exhausted all alternatives for relief. Business Associate shall require reasonable assurances from persons receiving PHI in accordance with Section 2(c) that such persons will provide Covered Entity with similar notice and opportunity to object before disclosing PHI when a disclosure is required by law.

c. Additional Restrictions. If Covered Entity notifies Business Associate that

Covered Entity has agreed to be bound by additional restrictions on the uses or disclosures of Covered Entity’s PHI pursuant to HIPAA or the HIPAA Regulations, Business Associate shall be bound by such additional restrictions and shall not disclose Covered Entity’s PHI in violation of such additional restrictions to the extent possible consistent with Business Associate’s obligations set forth in the Underlying Agreement.

d. Restrictions Pursuant to Subject’s Request. If Business Associate has knowledge that an individual who is the subject of PHI in the custody and control of Business Associate has requested restrictions on the disclosure of PHI, Business Associate must comply with the requested restriction if (a) the

Covered Entity agrees to abide by the restriction; or (b) the disclosure is to a health plan for purposes of carrying out payment or health care operations and the PHI pertains solely to a health care item or service for which Covered Entity has been paid out of pocket in full. If the use or disclosure of PHI in this Agreement is based upon an Individual’s specific authorization for the use or disclosure of his or her PHI, and the Individual revokes such authorization, the effective date of such authorization has expired, or such authorization is found to be defective in any manner that renders it invalid, Business Associate shall, if it has notice of such revocation, expiration, or invalidity, cease the use and disclosure of the Individual’s PHI except to the extent it has relied on such use or disclosure, or if an exception under the Privacy Rule expressly applies.

e. Remuneration. Business Associate shall not directly or indirectly receive remuneration in exchange for disclosing PHI received from or on behalf of Covered Entity except as permitted by HITECH Act § 13405, the MRPA, and any implementing regulations that may be promulgated or revised from time to time.

f. Disclosure. Business Associate shall not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. part 164, or MRPA, if done by the Covered Entity itself except as authorized under Section 2 of this Agreement.

4. Minimum Necessary. Business Associate shall limit its uses and disclosures of, and requests for, PHI, to the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure or request.

5. Additional Business Associate Obligations.

a. Safeguards. Business Associate shall use appropriate safeguards and comply with Subpart C of 45 C.F.R. 164 with respect to electronic PHI to prevent use or disclosure of the PHI other than as provided for by this Agreement.

Business Associate shall implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of any paper or electronic PHI it creates, receives, maintains, or transmits on behalf of Covered Entity.

b. To the extent the Business Associate is to carry out one or more of Covered

Entity’s obligation(s) under the Privacy Rule, Business Associate shall comply with the requirements of the Privacy Rule that apply to the Covered Entity in the performance of the obligations.

c. To the extent Business Associate will collect biometric identifying information as defined by Texas Government Code § 560.001, in carrying out requirements of this Agreement, Business Associate will Texas Government Code § 2062.002 and obtain consent prior to gathering biometric identyfing information.

d. Business Associate’s Agents and Subcontractors.

1) Business Associate shall ensure that any agents and subcontractors to whom it provides PHI agree to only create, receive, maintain or transmit PHI on behalf of the Business Associate under the same restrictions that apply to Business Associate. Such agreement between Business Associate and subcontractor or agent must be in writing and must comply with the terms of this Agreement and the requirements outlined at 45 C.F.R. §164.504(e)(2); 45 C.F.R. §164.502(e)(1)(ii); 45 C.F.R. §164.314; and 45 C.F.R. §164.308(b)(2). Additionally, Business Associate shall ensure agent or subcontractor agree to and implement reasonable and appropriate safeguards to protect PHI.

2) If Business Associate knows of a pattern of activity or practice of its subcontractor or agent that constitutes a material breach or violation of the agent or subcontractor’s obligation under the contract or other arrangement, the Business Associate must take steps to cure the breach and end the violation and if such steps are not successful, must terminate the contract or arrangement if feasible. If it is not feasible to terminate the contract, Business Associate must promptly notify the Covered Entity.

e. Reporting. Business Associate shall, as soon as practicable but not more than five (5) business days after becoming aware of any successful security incident or use or disclosure of Covered Entity’s PHI or Sensitive Personal Information in violation of this Agreement, report any such use or disclosure to Covered Entity. With the exception of law enforcement delays that satisfy the requirements under 45 C.F.R. § 164.412 or as otherwise required by applicable state law, Business Associate shall notify Covered Entity in writing without unreasonable delay and in no case later than ten (10) calendar days upon discovery of a Breach of Unsecured PHI or Breach of Security System. Such notice must include, to the extent possible, the name of each individual whose Unsecured PHI or Sensitive Personal Information has been, or is reasonably believed by Business Associate to have been, accessed, acquired, or disclosed during such breach. Business Associate shall also provide, to the extent possible, Covered Entity with any other available information that Covered Entity is required to include in its notification to individuals under 45 C.F.R. § 164.404(c) and Section 521.053, Texas Business & Commerce Code at the time of Business Associate’s notification to Covered Entity or promptly thereafter as such information becomes available. For purposes of this Agreement, a Breach of Unsecured PHI or Breach of Security System shall be treated as discovered by Business Associate as of the first day on which such breach is known to Business Associate (including any person, other than the individual committing the breach, who is an employee, officer, or other agent of Business Associate, as determined in accordance with the federal common law of agency) or should reasonably have been known to Business Associate following the exercise of reasonable diligence.

f. Mitigation. Business Associate shall have procedures in place to mitigate, to the maximum extent practicable, any deleterious effect from any Use or Disclosure (as defined by 45 C.F.R. §160.103).

g. Sanctions. Business Associate shall apply appropriate sanctions in accordance with Business Associate’s policies against any employee, subcontractor or agent who uses or discloses Covered Entity’s PHI in violation of this Agreement or applicable law.

h. Covered Entity’s Rights of Access and Inspection. From time to time upon reasonable notice, or upon a reasonable determination by Covered Entity that Business Associate has breached this Agreement, Covered Entity may inspect the facilities, systems, books and records of Business Associate related to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of Covered Entity or the safeguarding of such PHI to monitor compliance with this Agreement. Business Associate shall document and keep current such security measures and safeguards and make them available to Covered Entity for inspection upon reasonable request including summaries of any internal or external assessments Business Associate performed related to such security controls and safeguards. The fact that Covered Entity inspects, or fails to inspect, or has the right to inspect, Business Associate’s facilities, systems and procedures does not relieve Business Associate of its responsibility to comply with this Agreement, nor does Covered Entity’s (1) failure to detect or (2) detection but failure to require Business Associate’s remediation of any unsatisfactory practices, constitute acceptance of such practice or a waiver of Covered Entity’s enforcement or termination rights under this Agreement. This Section shall survive termination of this Agreement.

i. United States Department of Health and Human Services. Business

Associate shall make its internal practices, books and records relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of, Covered Entity available to the Secretary of the United States Department of Health and Human Services for purposes of determining Covered Entity’s compliance with HIPAA and the HIPAA regulations, provided that Business Associate shall promptly notify Covered Entity upon receipt by Business Associate of any such request for access by the Secretary of the United States Department of Health and Human Services, and shall provide Covered Entity with a copy thereof as well as a copy of all materials disclosed pursuant thereto, unless otherwise prohibited by law.

j. Training. Business Associate shall provide such training in the privacy and security of PHI to its Workforce (as that term is defined by 45 C.F.R. § 160.103) as is required for Business Associate’s compliance with HIPAA, HIPAA Regulations, HITECH, and the MRPA.

6. Obligation to Provide Access, Amendment and Accounting of PHI.

a. Access to PHI. Business Associate shall make available to Covered Entity, in the time and manner designated by the Covered Entity, such information as necessary to allow Covered Entity to meet its obligations under the HIPAA Regulations, PHI contained in a Designated Record Set held by Business Associate as Covered Entity may require to fulfill Covered Entity’s obligations to provide access to, and copies of, PHI in accordance with HIPAA and the HIPAA Regulations and MRPA. In the event that any individual requests access to PHI directly from Business Associate, Business Associate shall notify Covered Entity within five (5) business days that such request has been made.

b. Amendment of PHI. Business Associate shall make available to Covered

Entity PHI contained in a Designated Record Set held by Business Associate as Covered Entity may require to fulfill Covered Entity’s obligations to amend PHI in accordance with HIPAA and the HIPAA Regulations. In addition, Business Associate shall, as directed by Covered Entity, incorporate any amendments to Covered Entity’s PHI into copies of such information maintained by Business Associate. In the event that any individual requests amendment of PHI directly from Business Associate, Business Associate shall forward such request to Covered Entity within five (5) business days.

c. Accounting of Disclosures of PHI.

1) Record of Disclosures. Business Associate shall maintain a record of all disclosures of PHI received from, or created or received by Business Associate on behalf of, Covered Entity, except for those disclosures identified in Section 6(c)(2) below, including the date of the disclosure, the name and, if known, the address of the recipient of the PHI, a brief description of the PHI disclosed, and the purpose of the disclosure which includes an explanation of the reason for such disclosure.

Business Associate shall make this record available to Covered Entity upon Covered Entity’s request. If Business Associate maintains records in electronic form, Business Associate shall account for all disclosures made during the period of three (3) years preceding the request. In the event that any individual requests an accounting of disclosures of PHI directly from Business Associate, Business Associate shall notify Covered Entity within five (5) business days that such request has been made and provide Covered Entity with a record of disclosures within ten (10) days of an individual’s request. If the request from an individual comes directly to Covered Entity and Covered Entity notifies Business Associate that it requires information from Business Associate in order to respond to the individual, Business Associate shall make available to Covered Entity such information as Covered Entity may require within ten (10) days from the time of request by Covered Entity.

2) Certain Disclosures Need Not Be Recorded. The following disclosures need not be recorded:

a) disclosures to carry out Covered Entity’s treatment, payment and health care operations as defined under the HIPAA Regulations;

b) disclosures to individuals of PHI about them as provided by the

HIPAA Regulations;

c) disclosures for Covered Entity’s facility’s directory, to persons involved in the individual’s care, or for other notification purposes as provided by the HIPAA Regulations;

d) disclosures for national security or intelligence purposes as provided by the HIPAA Regulations;

e) disclosures to correctional institutions or law enforcement officials as provided by the HIPAA Regulations;

f) disclosures that occurred prior to the later of (i) the Effective Date or

(ii) the date that Covered Entity is required to comply with HIPAA and the HIPAA Regulations;

g) disclosures pursuant to an individual’s authorization in accordance with HIPAA and the HIPAA Regulations; and

h) any other disclosures excepted from the right to an accounting by the

HIPAA Regulations.

7. Material Breach, Enforcement and Termination.

a. Term. This Agreement shall become effective on the Effective Date and shall continue unless or until this Agreement terminates, the Underlying Agreement terminates, or the Business Associate has completed performance of the services in the Underlying Agreement, whichever is earlier.

b. Termination. Either Party may terminate this Agreement:

1) immediately if the other Party is finally convicted in a criminal proceeding for a violation of HIPAA or the HIPAA Regulations;

2) immediately if a final finding or stipulation that the other Party has violated any standard or requirement of HIPAA or other security or privacy laws is made in any administrative or civil proceeding in which the other Party has been joined; or completed performance of the services in the Underlying Agreement, whichever is earlier.

3) pursuant to Sections 7(c) or 8(b) of this Agreement.

c. Remedies. Upon a Party's knowledge of a material breach by the other Party, the non-breaching Party shall either:

1) provide an opportunity for the breaching Party to cure the breach and end the violation or terminate this Agreement and the Underlying Agreement if the breaching Party does not cure the breach or end the violation within ten (10) business days or a reasonable time period as agreed upon by the non-breaching party; or

2) immediately terminate this Agreement and the Underlying

Agreement if cure is not possible.

d. Injunctions. Covered Entity and Business Associate agree that any violation of the provisions of this Agreement may cause irreparable harm to Covered Entity. Accordingly, in addition to any other remedies available to Covered Entity at law or in equity, Covered Entity shall be entitled to seek an injunction or other decree of specific performance with respect to any violation of this Agreement or explicit threat thereof, without any bond or other security being required and without the necessity of demonstrating actual damages.

e. Indemnification. This indemnification provision is enforceable against the

Parties only to the extent authorized under the constitution and laws of the State of Texas. The Parties will indemnify, defend and hold harmless each other and each other’s respective employees, directors, officers, subcontractors, agents or other members of its workforce, each of the foregoing hereinafter referred to as “indemnified party,” against all actual and direct losses suffered by the indemnified party and all liability to third parties arising from or in connection with any breach of this Agreement or of any warranty hereunder or from any negligence or wrongful acts or omissions, including failure to perform its obligations under MRPA, HIPAA, the HIPAA Regulations, and the HITECH Act by the indemnifying party or its employees, directors, officers, subcontractors, agents or other members of its workforce.

f. Breach of PHI and Breach of System Security. Business Associate will pay or reimburse Covered Entity for all costs and penalties incurred by Covered Entity in connection with any incident giving rise to a Breach of PHI and/or a Breach of System Security, including without limitation all costs related to any investigation, any notices to be given, reasonable legal fees, or other actions taken to comply with HIPAA, the HITECH Act, or any other applicable law or regulation, where (i) the PHI was in the custody or control of Business Associate when the Breach of PHI and/or Breach of System Security occurred, or (ii) the Breach of PHI and/or Breach of System Security was caused by the negligence or wrongful acts or omissions of Business Associate and its employees, directors, officers, subcontractors, agents or other members of its workforce.

8. General Provisions.

a. State Law. Nothing in this Agreement shall be construed to require Business Associate to use or disclose PHI without written authorization from an individual who is a subject of the PHI, or written authorization from any other person, where such authorization would be required under state law for such use or disclosure.

b. Amendment. Covered Entity and Business Associate agree to enter into good faith negotiations to amend this Agreement to come into compliance with changes in state and federal laws and regulations relating to the privacy, security and confidentiality of PHI. Covered Entity may terminate this Agreement upon thirty (30) days written notice in the event that Business Associate does not promptly enter into an amendment that Covered Entity, in its sole discretion, deems sufficient to ensure that Covered Entity will be able to comply with such laws and regulations.

c. No Third Party Beneficiaries. Nothing express or implied in this Agreement is intended or shall be deemed to confer upon any person other than Covered Entity, Business Associate, and their respective successors and assigns, any rights, obligations, remedies or liabilities.

d. Ambiguities. The Parties agree that any ambiguity in this Agreement shall be resolved in favor of a meaning that complies and is consistent with applicable law protecting the privacy, security, and confidentiality of PHI, including, without limitation, MRPA, HIPAA, the HIPAA Regulations, and the HITECH Act.

e. Primacy. To the extent that any provision of this Agreement conflicts with the provision of any other agreement or understanding between the Parties, this Agreement shall control.

f. Destruction/Return of PHI. Business Associate agrees that, pursuant to 45

C.F.R. § 164.504(e)(2)(ii)(I), upon termination of this Agreement or the Underlying Agreement, for whatever reason,

1) It will return or destroy all PHI, if feasible, received from or created or received by it on behalf of Covered Entity that Business Associate maintains in any form, and retain no copies of such information which for purposes of this Agreement shall mean all backup tapes. Prior to doing so, Business Associate further agrees to recover any PHI in the possession of its subcontractors or agents. An authorized representative of Business Associate shall certify in writing to Covered Entity, within thirty (30) days from the date of termination or other expiration of the Underlying Agreement, that all PHI has been returned or disposed of as provided above and that Business Associate or its subcontractors or agents no longer retain any such PHI in any form.

2) If it is not feasible for Business Associate to return or destroy said PHI, Business Associate will notify the Covered Entity in writing. The notification shall include a statement that the Business Associate has determined that it is infeasible to return or destroy the PHI in its possession, and the specific reasons for such determination. Business Associate shall comply with the Security Rule and extend any and all protections, limitations and restrictions contained in this Agreement to Business Associate’s use and/or disclosure of any PHI retained after the termination of this Agreement, and to limit any further uses and/or disclosures to the purposes that make the return or destruction of the PHI infeasible.

3) If it is infeasible for Business Associate to obtain, from a subcontractor or agent any PHI in the possession of the subcontractor or agent, Business Associate must provide a written explanation to Covered Entity and require the subcontractors and agents to agree to comply with the Security Rule and extend any and all protections, limitations and restrictions contained in this Agreement to the subcontractors’ and/or agents’ use and/or disclosure of any PHI retained after the termination of this Agreement, and to limit any further uses and/or disclosures to the purposes that make the return or destruction of the PHI infeasible.

g. Offshore Work. In performing the functions, activities or services for, or on behalf of Covered Entity, Business Associate shall not, and shall not permit any of its agents or subcontractors who receive Covered Entity’s PHI to, store, transmit or make available any PHI to any entity or individual outside the United States without prior written consent of Covered Entity. The Business Associate agrees that, as applicable, it:

Has policies and procedures in place to ensure that Medicare beneficiary PHI and other personal information remains secure and permit immediate termination of subcontractor relationships upon discovery of a significant security breach by subcontractor;

Will notify Covered Entity of its use of offshore subcontractors and prohibit any offshore subcontractor to access Medicare data not associated with the subcontractor’s contract with Business Associate; and

Includes all required Medicare Part C & D language in its subcontracting arrangements.

h. Integration. This Agreement embodies and constitutes the entire agreement and understanding between the Parties with respect to the subject matter hereof and supersedes all prior oral or written agreements, commitments and understandings pertaining to the subject matter hereof.

i. Governing Law. This Agreement is governed by, and shall be construed in accordance with, applicable federal law and the laws of the State of Texas without regard to choice of law principles.

j. Notices. Any notices to be given hereunder to a Party shall be made via U.S.

Mail or express courier to such Party’s address given below, and/or (other than for the delivery of fees) via facsimile to the facsimile telephone numbers listed below.

If to Covered Entity:

The University of Health Science Center at San Antonio 7703 Floyd Curl Drive, MSC 7962 San Antonio, TX 78229

Attn: Eric Walls Sr. Director of Supply Chain Mgmt.

Phone number: 210-562-6200 Email: buscontracts@uthscsa.edu

If to Business Associate: ______________________________________

Each Party named above may change its address and that of its representative for notice by the giving of notice thereof in the manner herein above provided.

k. Privilege. Notwithstanding any other provision in this Agreement, this

Agreement shall not be deemed to be an agreement by Business Associate to disclose information that is privileged, protected, or confidential under applicable law to the extent that such privilege, protection or confidentiality

(a) has not been waived or (b) is not superseded by applicable law.

l. Multiple Counterparts. This Agreement may be executed in any number of counterparts, each of which shall be deemed an original and all of which shall together constitute one and the same instrument. Facsimile and electronic (pdf) signatures shall be treated as if they are original signatures.

IN WITNESS WHEREOF, the Parties have caused this Agreement to be executed by their respective duly authorized representatives in the manner legally binding upon them as of the date indicated below.

[BUSINESS ASSOCIATE] The University of Texas Health Science

Center at San Antonio

By: ____________________________ By: __________________________ (Authorized Signature) (Authorized Signature) Name: _________________________ Name: ________________________ (Type or Print) (Type or Print) Title: ___________________________ Title: _________________________

Date: ___________________________ Date: _________________________

EXHIBIT E

FERPA CONFIDENTIALITY AND SECURITY ADDENDUM

This FERPA Confidentiality and Security Addendum (Addendum) is made and entered into effective as of ________________,2026 (Effective Date) by and between The University of Texas Health Science Center at San Antonio, a state agency and institution of higher education established under the laws of the State of Texas (University) and [ ] (Contractor), (collectively, Parties). The purpose of this Addendum is to provide the terms under which Contractor is required to maintain the confidentiality and security of any and all University records subject to the Family Educational Rights and Privacy Act, 20 United States Code §1232g (FERPA) which Contractor will create, receive, or maintain on behalf of University pursuant to _______________________(Underlying Agreement).

1. FERPA. The Parties understand and agree that:

1.1 As part of the work (Work) that Contractor will provide pursuant to the Underlying Agreement, Contractor is expected to create, receive or maintain, records or record systems from or on behalf of University that (a) are subject to FERPA or (b) contain personally identifiable information from “Education Records” as defined by and subject to FERPA (collectively, FERPA Records) namely:

Student Data. FERPA Records include all data in any form whatsoever, including electronic, written and machine readable form.

1.2 Notwithstanding any other provision of the Underlying Agreement, this Addendum or any other agreement, all FERPA Records created, received or maintained by Contractor pursuant to the Underlying Agreement will remain the sole and exclusive property of University.

2. FERPA Compliance. In connection with all FERPA Records that Contractor may create, receive or maintain on behalf of University pursuant to the Underlying Agreement, Contractor is designated as a University Official with a legitimate educational interest in and with respect to such FERPA Records, only to the extent to which Contractor (a) is required to create, receive or maintain FERPA Records to carry out the Underlying Agreement, and (b) understands and agrees to all of the following terms and conditions without reservation:

2.1 Prohibition on Unauthorized Use or Disclosure of FERPA Records: Contractor will hold University FERPA Records in strict confidence. Contractor will not use or disclose FERPA Records received from or on behalf of University, including any FERPA Records provided by a University student directly to Contractor, except as permitted or required by the Underlying Agreement or this Addendum.

2.2 Maintenance of the Security of FERPA Records: Contractor will use the administrative, technical and physical security measures, including secure encryption in the case of electronically maintained or transmitted FERPA Records, approved by University and that are at least as stringent as the requirements of UT System Information and Resource Use & Security Policy, UTS165 at http://www.utsystem.edu/board-of-regents/policy-library/policies/uts165-information-resources-use-and-security-policy, to preserve the confidentiality and security of all FERPA Records received from, or on behalf of University, its students or any third party pursuant to the Underlying Agreement.

2.3 Reporting of Unauthorized Disclosures or Misuse of FERPA Records and Information: Contractor, within one (1) day after discovery, will report to University any use or disclosure of FERPA Records not authorized by this Addendum. Contractor’s report will identify: (i) the nature of the unauthorized use or disclosure, (ii) the FERPA Records used or disclosed, (iii) who made the unauthorized use or received the unauthorized disclosure, (iv) what Contractor has done or will do to mitigate any deleterious effect of the unauthorized use or disclosure, and (v) what corrective action Contractor has taken or will take to prevent future similar unauthorized use or disclosure. Contractor will provide such other information, including written reports, as reasonably requested by University. For purposes of this Section 2.3, an unauthorized disclosure or use includes any access or use of an “Education Record” (as defined by FERPA) by a Contractor employee or agent that the employee or agent does not require to perform Work or access by any employee or agent that does not involve the provision of Work.

2.4 Right to Audit: If University has a reasonable basis to believe that Contractor is not in compliance with the terms of this Addendum, University may audit Contractor’s compliance with FERPA as Contractor’s compliance relates to University’s FERPA Records maintained by Contractor.

2.5 Five Year Exclusion for Improper Disclosure of Education Records. Under the federal regulations implementing FERPA, improper disclosure or redisclosure of personally identifiable information from University’s “Education Records” (as defined by FERPA) by Contractor or its employees or agents may result in Contractor’s complete exclusion from eligibility to contract with University for at least five (5) years.

3. Return or Secure Destruction of FERPA Records. Contractor agrees that no later than 30 days after expiration or termination of the Underlying Agreement or this Addendum for any reason, or within thirty (30) days after University’s written request, Contractor will halt all access, use, creation, or processing of FERPA Records and will return to University or Securely Destroy all FERPA Records, including any copies created by Contractor or any subcontractor; and Contractor will certify in writing to University that all FERPA records have been returned to University or Securely Destroyed. Secure Destruction, Securely Destroy and Securely Destroyed mean shredding, erasing or otherwise modifying a record so as to make it unreadable or indecipherable.

4. Disclosure. Contractor will restrict disclosure of FERPA Records solely to those employees, subcontractors, or agents of Contractor that have a need to access the FERPA Records in order for Contractor to perform its obligations under the Underlying Agreement or this Addendum. If Contractor discloses any FERPA Records to a subcontractor or agent, Contractor will require the subcontractor or agent to comply with restrictions and obligations that align with the restrictions and obligations imposed on Contractor by the Underlying Agreement and this Addendum, including requiring each subcontractor or agent to agree to the same restrictions and obligations in writing.

5. Termination. This Addendum will remain in effect until the earlier of (a) expiration or termination of the Underlying Agreement, or (b) the date University terminates this Addendum by giving Contractor sixty (60) days’ written notice of University’s intent to terminate. Sections 2, 3, 4, and 6 of this Addendum will survive expiration or termination of the Underlying Agreement and this Addendum.

6. Breach. In the event of a breach, threatened breach or intended breach of this Addendum by Contractor, University (in addition to any other rights and remedies available to University at law or in equity) will be entitled to preliminary and final injunctions, enjoining and restraining such breach, threatened breach or intended breach.

7. Governing Law. The validity, construction, and performance of this Addendum are governed by the laws of the State of Texas, and suit may be brought in Bexar County, Texas to enforce the terms of this Addendum.

8. Non-Assignment. The rights and obligations of the Parties under this Addendum may not be sold, assigned or otherwise transferred.

AGREED TO AND SIGNED BY THE PARTIES.

The University of Texas Health Science [Contractor] At San Antonio

By: ____________________________ By: ____________________________

Name: _________________________ Name: _________________________

Title: __________________________ Title: ___________________________

Date: __________________________ Date: __________________________