text:
John’s practice includes representing clients in patent prosecution, litigation, and cyber security and data privacy matters.
In recognizing the pending threat of cyber-incidents his clients may face, John has worked to help develop Brook Kushman’s Cybersecurity and Data Privacy group. John’s experience includes assessing a client’s current cybersecurity and data privacy protocols and developing a comprehensive incident response plan to ensure compliance with applicable laws. John also assists his client’s in determining the potential root cause of a breach and what type of notification may be necessary. John also has experience in addressing information and data security requirements for his clients during both vendor contractual or M&A transactions.
John has also represented client’s litigation matters at the district court and appellate level, as well as, before the International Trade Commission. John has actively managed each stage of litigation from pre-suit pleadings through trial, and through appeal. John has also represented his client’s needs in negotiating settlements and licensing agreements.
While representing one client’s litigation needs, John became involved in developing and growing Brooks Kushman’s Post-Grant Proceedings team. As a result, John was part of a team that handled 25 inter partes review proceedings that invalidated hundreds of patent claims being asserted against that client.
John has also managed the patent prosecution docket for clients that range from Fortune 500 companies to individual inventors. John’s prosecution experience includes handling a patent application from an initial draft through allowance. Relying on his litigation and prosecution experience, John’s has also handled numerous patentability and clearance opinions on behalf of his clients.
Prior to joining Brooks Kushman, John worked for nearly ten years as a hardware design and software engineer in the automotive and semi-conductor industries. This work provided John with invaluable experience that helps him further counsel his client’s intellectual property needs.
Hybrid Electric Vehicles and Components Thereof, Investigation No. 337-TA-1042 (International Trade Commission) – Represented Ford in patent lawsuit relating to hybrid vehicles before the International Trade Commission.
Paice LLC v. Ford Motor Company Representative Case Nos.: 2016-1412, 2016-1746, 2017-1387, 2017-1263 (Fed. Cir. 2016-2017). Successfully represented Ford in numerous appeals challenging the Patent Trial and Appeal Board decisions that had found hundreds of patent claims as being unpatentable.
Ford Motor Company v. Paice, Representative Case Nos.: IPR2014-00571, IPR2014-00904, IPR2015-00722, IPR2015-00790 (PTAB) – Represented Ford during the pendency of the 22 inter partes review proceedings challenging the validity of hundreds of claims across five separate patents. Managed proceedings through final written decision where the Patent Trial and Appeal Board held 273 patent claims were unpatentable.
ElectroJet Technologies, Inc. v. STIHL Incorporated, Case No. 2-17-cv-00224 (E.D. Va.) – Representing Electrojet in patent lawsuit relating to engine timing control.
STIHL Incorporated et al v. ElectroJet Technologies, Inc., Case No. IPR2018-00018, IPR2018-00020 (PTAB) – Defending Electrojet relating to inter partes review petitions filed by STIHL.
Bose Corporation v. Lightspeed Aviation, Case No. 1:09-cv-10222 (D. Mass.) – Represented Lightspeed Aviation relating to aviation noise cancelling headset technology. Managed litigation through summary judgment and negotiated settlement between Bose and Lightspeed.
HTC Corporation v. Ancora Technologies, Case No. CBM2017-00054 (PTAB) – Lead counsel for Ancora in securing order from Patent Trial and Appeal Board denying institution of HTC’s covered business method (CBM) petition.
Ancora Technologies, Inc. v. Apple, Appellate Case No. 2013-1414 (Fed. Cir.) – Represented Ancora in successful appeal to the United States Court of Appeals for the Federal Circuit reversing district court’s claim construction ruling and affirming district’s court’s finding of no indefiniteness. Successfully briefed opposition to Apple’s petition for certiorari to U.S. Supreme Court.
Ancora Technologies v. Apple, Case No. 4-11-cv-06357 (N.D. Cal.) – Represented Ancora in patent infringement lawsuit relating to software security. Managed litigation through favorable settlement.
John Rondini and Ben Harel discuss the importance of teaching your IT people cybersecurity to enhance your security operations, the silliness of phishing attacks, and the new trend of insider-threat red team engagements. Music is "It Was Just Cold" by Andrew Codeman.
For their first podcast John Rondini and Ben Harel discuss creating an information security policy, breach management, knowing federal and state cyber laws, managing outside vendors and cyber insurance gotchas. Featured music is "It Was Just Cold" by Andrew Codeman.
Co-Author, “Supreme Court to Insider Availability of Extraterritorial Patent Infringement Damages,” Client Alert, January, 2018.


Today’s notable decision is Gorbacheva v. Abbott Laboratories Extended Disability Plan, et al., No. 5:14-CV-02524-EJD, 2018 WL 2387852 (N.D. Cal. May 25, 2018), where the court grants in part Plaintiff’s motion for attorneys’ fees and denies Defendants’ request for attorneys’ fees, even though Defendants were ultimately successful on the merits of the underlying long-term disability dispute.
In 2015, on the parties’ cross-motions for summary judgment, the court remanded Plaintiff’s claim to the plan administrator of the Abbott Laboratories Extended Disability Plan to consider a Functional Capacity Evaluation (“FCE”) and a favorable Social Security Disability Insurance award. Plaintiff filed a motion for attorneys’ fees at that time, which the court denied without prejudice.
On the second review, Plaintiff fared no better. Despite submitting 869 pages of additional medical records, the FCE, and the SSDI award, the plan administrator denied Plaintiff’s claim. The court noted that none of the medical records were from the relevant time frame. After Plaintiff reopened the action, the court denied Plaintiff’s motion for judgment as a matter of law and granted Defendants’ motion for summary judgment because it found that the plan administrator did not abuse her discretion in denying Plaintiff’s claim for disability benefits. The matter is currently on appeal to the Ninth Circuit Court of Appeals.
Plaintiff filed a renewed motion for attorneys’ fees seeking an award of $191,415, which breaks down to 273.45 hours at $700/hour, plus $1,201.60 in costs. This is for time spent to incur the first order remanding the claim and the time spent preparing the instant fee motion. Defendants filed a motion seeking $264,570.47 in attorneys’ fees and $9,758.02 in costs.
In awarding Plaintiff attorneys’ fees, the court determined that Plaintiff achieved some degree of success on the merits by obtaining an order of remand. The court rejected Defendant’s argument that the hourly rate of $700 was excessive and that a lower rate should be applied to work performed between 2014-2016. In addition, Plaintiff’s counsel’s hourly rate was supported by several declarations from attorneys who specialize in ERISA litigation. Applying Hensley, the court reduced the requested amount by 10% to factor in that Plaintiff only achieved limited success. Plaintiff had sought significant damages in the form of benefits and statutory penalties but was not awarded these and Defendants ultimately prevailed on all claims in the litigation.
The court denied Defendants’ motion because although they unquestionably achieved some degree of success on the merits, the majority of the Hummell factors weigh against an award, including that Plaintiff did not engage in culpable or bad faith conduct, she has no ability to satisfy a fee award (she only receives SSDI and a modest pension), and an award of fees is unlikely to have any deterrent effect.
The court awarded $172,273.50 in attorneys’ fees and all of the requested costs. This decision is notable because attorneys’ fees are an important deterrent against procedurally improper claims decisions. Remands to plan administrators allowing them a second bite at the apple causes unnecessary delay and uncertainty to claimants who are waiting for much needed disability income benefits. Fingers crossed for Ms. Gorbacheva on appeal and congratulations to our friends, colleagues and fellow ERISA Watchers at the law firm of Bolt Keenley Kim, LLP for securing this fantastic fee decision.
Gorbacheva v. Abbott Laboratories Extended Disability Plan, et al., No. 5:14-CV-02524-EJD, 2018 WL 2387852 (N.D. Cal. May 25, 2018) (Judge Edward J. Davila). See Notable Decision summary above.
Kinra, et al. v. Chicago Bridge & Iron Co., et al., No. 17 CIV. 4251 (LGS), 2018 WL 2371030 (S.D.N.Y. May 24, 2018) (Judge Lorna G. Schofield). The court granted Defendants’ motion to dismiss Plaintiff’s Complaint alleging that Defendants breached their duties to the Plans for continuing to offer the common stock of CB&I as an investment option in the Plans when Defendants knew or should have known that the price of the stock was improperly inflated. The court determined that there is a lack of subject matter jurisdiction because the original plaintiff did not have Article III standing and that defect cannot be cured with a Rule 17 substitution of a new plaintiff. In the alternative, the Complaint fails to state a claim for breach of the duties of prudence and loyalty.
International Union, United Mine Workers Of America, et al., v. Consol Energy, Inc., No. CV 1:16-12506, 2018 WL 2328028 (S.D.W. Va. May 21, 2018). In this dispute over whether CONSOL Energy, Inc., can unilaterally change the health care benefits contractually negotiated with UMWA under the 2011 National Bituminous Coal Wage Agreement, the court granted Plaintiffs’ motion to file a Second Amended Complaint to bring an ERISA claim against CONSOL and CONSOL’s Subsidiaries due to their misleading written communications sent to retiree participants. The court determined that the proposed breach of fiduciary duty claim is not futile. Plaintiffs’ request for declaratory relief in the form of an order declaring that Defendants may not change the retirees’ benefits without agreement from the UMWA is appropriate equitable relief under Section 502(a)(3).
Wildman v. American Century Services, LLC, et al., No. 4:16-CV-00737-DGK, 2018 WL 2326628 (W.D. Mo. May 22, 2018) (Judge Greg Kays). In this 401(k) plan excessive fees case, the court denied Defendants’ motion to exclude the expert report and testimony of Roger Levy, Plaintiffs’ expert witness related to the standard of care. The court determined that he is qualified to testify on this subject and his experience provides sufficient basis for his opinions. Further, challenges to the factual basis of his opinion go to the weight, not admissibility of his testimony. In a separate opinion, Wildman v. Am. Century Servs., LLC, No. 4:16-CV-00737-DGK, 2018 WL 2328348 (W.D. Mo. May 22, 2018), the court also denied Defendants’ motion to exclude the expert testimony of Dr. Steve Pomerantz because is qualified to testify about the prudent investment processes and his models are aligned to the theories of breach and any dispute as to the factual basis of his opinions goes to the weight of his testimony.
Wildman v. American Century Services, LLC, et al., No. 4:16-CV-00737-DGK, 2018 WL 2326627 (W.D. Mo. May 22, 2018) (Judge Greg Kays). The court granted in part and denied in part Defendants’ motion for summary judgment. It held that there are disputes of material fact preventing summary judgment on Count I—Breach of Fiduciary Duty because there are material facts in dispute as to whether Defendants’ conduct met the prudent person standard and Plaintiffs have established a prima facie loss to the plan. The court granted the motion as to the Section 1106(a)(1)(D) and (b)(1) claims (prohibitive transactions) since fees paid from mutual fund assets are not fees paid out of plan assets. The court denied the motion as to the Section 1106(a)(1)(C) claim since the management fees could be considered an indirect service. The court also found that PTE77-3 applies to one of Plaintiff’s Section 1106(b)(3) claims. Lastly, on the Section 502(a)(3) claim, the court found that the traceability exception applies because Plaintiffs seek only an accounting for profits.
Castillo v. Community Child Care Council of Santa Clara County, Inc., et al., No. 17-CV-07243-SVK, 2018 WL 2357698 (N.D. Cal. May 24, 2018). In this case alleging various causes of action against Defendants for allegedly misleading them to converting their vested retirement balances to financially imprudent life annuity contracts, the court granted Defendants’ motion to dismiss on the basis of the statute of limitations and that plaintiff has not established any claim against the moving individual defendants.
Weddle v. Life Insurance Company of North America, No. CV 17-12372-RGS, 2018 WL 2376323 (D. Mass. May 24, 2018) (Judge Richard G. Stearns). The court dismissed the intentional infliction of emotional distress claim and noted that as a result there is no cognizable jury claim.
Swann v. Ryder System, Inc., et al., No. 5:17-CV-330-JMH, 2018 WL 2376558 (E.D. Ky. May 23, 2018) (Judge Joseph M. Hood). The court determined that Liberty Life did not abuse its discretion in determining that Plaintiff’s (a truck driver) “base pay” for purposes of calculating his long-term disability benefits, do not include money for stops, down time, and mileage (the difference is thousands of dollars per month).
Weppler v. The Hartford Financial Services Group, Inc., No. 3:17-CV-700-CRS, 2018 WL 2305710 (W.D. Ky. May 21, 2018) (Judge Charles R. Simpson III). The court denied Plaintiff’s motion for leave to file an amended complaint to the extent she alleges claims under Section 502(a)(3) since she has not alleged any facts indicating that she suffered a separate injury distinct from the denial of benefits, or that the remedy under Section 502(a)(1)(B) would be inadequate. The court also denied the request to amend to include a trial by jury or extra-contractual damages since they are not available under ERISA.
Norris v. MK Holdings, Inc., No. 17-6078, __F.App’x__, 2018 WL 2324256 (6th Cir. May 22, 2018) (BEFORE: GIBBONS, BUSH, and LARSEN, Circuit Judges). The Sixth Circuit found that the district court did not abuse its discretion in finding that Plaintiff’s actions during discovery were in violation of Federal Rules of Civil Procedure 26(a)(3), Rule 37(d), and Rule 37(b); dismissing her suit as a sanction for those violations; and precluding her proffered expert testimony. Affirmed.
It’s Greek To Me, Inc., d/b/a GTM Sportswear, & Hanesbrands, Inc. v. Fisher, et al., No. 17-4084-KHV, 2018 WL 2376327 (D. Kan. May 24, 2018) (Magistrate Judge K. Gary Sebelius). In this case where Plaintiffs allege that Defendants received settlement funds against which Plaintiffs have a constructive trust and/or equitable lien, and where many documents exchanged in discovery will contain information that is sensitive and confidential, the court granted the parties’ request for an agreed protective order.
Sheehan v. Kaiser Foundation Health Plan, Inc., No. 18-CV-02073-JCS, 2018 WL 2376634 (N.D. Cal. May 25, 2018) (Magistrate Judge Joseph C. Spero). Plaintiff brought state law claims against Kaiser alleging that her termination deprived her of approximately $70,000 of incentive pay for deals that she had substantially completed and that Kaiser timed the termination to occur approximately three months before the date on which her retirement benefits otherwise would have vested, causing her enormous financial loss. The court denied Plaintiff’s motion to remand to state court because the claims are preempted by ERISA to the extent they are based on Kaiser’s intent to deprive her of benefits.
Castillo v. Community Child Care Council of Santa Clara County, Inc., et al., No. 17-CV-07243-SVK, 2018 WL 2357698 (N.D. Cal. May 24, 2018). In this case alleging various causes of action against Defendants for allegedly misleading them to converting their vested retirement balances to financially imprudent life annuity contracts, the court determined that Plaintiffs’ claims for breach of contract, fraud in the inducement, and conversion are preempted by ERISA. It does not matter if the unlawful actions were “pre-plan” since all of the claims are of the type ordinarily preempted by ERISA, regardless of whether the conduct occurred before or after the inception of the ERISA plan. Additionally, the claims depend on the existence of the ERISA plan.
Walsh v. Empire Blue Cross/Blue Shield, Inc., No. 16CV3746DRHARL, 2018 WL 2324066 (E.D.N.Y. May 22, 2018) (Judge Denis R. Hurley). The court granted Defendants’ motion for summary judgment, affirming the decision that the use of Botox Injections for the treatment of gastroparesis is investigational or experimental and not covered by the Plan. The court also rejected Plaintiff’s argument that EHS violated Section 502(a)(3) by failing to provide the specific reason for the adverse determination and failing to give a description of any additional information to perfect the claim.
Lyn M., & David M. v. Premera Blue Cross, No. 2:17-CV-01152-BSJ, 2018 WL 2336115 (D. Utah May 23, 2018) (Judge Bruce S. Jenkins). In this dispute over the payment under an ERISA health insurance plan for a fourteen-month stay at Eva Carlston Academy, a residential treatment center in Salt Lake County, Utah, the court granted summary judgment to Defendant. The court determined that the governing plan documents need not be in the “administrative record” for purposes of determining the standard of review. Even though only the SPD was in the record and it did not contain the discretionary language, the discretionary authority was set forth in the Plan. Thus, abuse of discretion review applies. The court determined that the insured did not satisfy the criteria for continued stay at a residential psychiatric center as of April 1, 2015.
Amy G. v. United Healthcare, No. 2:17-CV-00427-BSJ, 2018 WL 2303156 (D. Utah May 21, 2018) (Judge Bruce S. Jenkins). The court determined that the Independent Review Organization’s external review decision affirming the denial of residential treatment center benefits is not binding but that Defendants’ denial decision was reasonable under an arbitrary and capricious standard of review. The court granted Defendants’ motion for summary judgment.
Goodrich Pump & Engine Control Systems, Inc. v. International Union United Automobile Aerospace, No. 17-3737-CV, __F.App’x__, 2018 WL 2331762 (2d Cir. May 23, 2018) (Present: ROSEMARY S. POOLER, RICHARD C. WESLEY, RAYMOND J. LOHIER, JR., Circuit Judges). The court affirmed the district court’s finding that the dispute over the calculation of the early retirement provision of the CBA is arbitrable. Goodrich’s argument that the CBA’s arbitration clause is trumped entirely by the dispute resolution procedure in the incorporated pension plan is foreclosed by the court’s prior decisions.
Miner v. Johns, No. 5:17-CV-0879, 2018 WL 2347095 (W.D. La. May 23, 2018) (Judge Elizabeth Erny Foote). On appeal by the debtors challenging the denial of their proposed Chapter 13 plan, the court reversed the Bankruptcy Court’s determination that post-petition voluntary 401(k) contributions are considered disposable income. In coming to this conclusion, the court joins other courts within the Fifth Circuit that have considered this issue and reached the same conclusion.
Beggins v. CBRE Capital Markets of Texas L.P., No. CV H-17-1541, 2018 WL 2289509 (S.D. Tex. May 18, 2018) (Judge Lee H. Rosenthal). Pursuant to Fed. R. Civ. P. 16(b), CBRE filed a motion for leave to amend after the amended-pleadings deadline expired in order to amend its answer to assert a failure to exhaust affirmative defense. The court granted the motion and found that CBRE has shown good cause to amend under Rule 16(b) and Plaintiff will not be prejudiced by the amendment.
Johnson v. Providence Health & Services, et al., No. C17-1779-JCC, 2018 WL 2289331 (W.D. Wash. May 18, 2018) (Judge John C. Coughenour). In this putative class action alleging breach of fiduciary duties, Plaintiff moved to strike the following affirmative defenses: (1) lack of standing; (2) bad faith; (3) the safe harbor provision in ERISA § 404(c); failure to satisfy Federal Rule of Civil Procedure 23; and (5) a reservation of rights to assert additional defenses. The court granted the motion in part and struck all but the ERISA Section 404(c) affirmative defense. Plaintiff’s request to strike goes to the merits of Providence’s defense which should be determined on a motion for summary judgment.
Chamblin v. VIAS (One Exch. Co.), No. 2:18-CV-0725-UJB-VEH, 2018 WL 2329803 (N.D. Ala. May 23, 2018) (Judge Virginia Emerson Hopkins). In this dispute over employee welfare benefit plan benefits, the court denied the pro se plaintiff’s motion to remand to state court and for preliminary injunction against Defendant advancing the case until it is heard by the court. The court determined that Defendant’s removal to this court was substantively proper and timely. It also determined that Plaintiff has not carried his burden of clearly establishing a right to preliminary injunctive relief, and the injunctive relief he seeks is beyond what the court has the power to award.
University Spine Center v. Anthem Blue Cross Blue Shield, No. CV 18-01103, 2018 WL 2357756 (D.N.J. May 24, 2018) (Judge William J. Martini). The court granted Defendant’s motion to dismiss Plaintiff’s Complaint seeking payment of benefits and a claim for breach of fiduciary duty. The court found that Plaintiff’s patient could not assign his right to receive reimbursement to Plaintiff or anyone else. The Third Circuit has found that the anti-assignment clause is valid and enforceable. Plaintiff lacks standing to bring its claims.
University Spine Center v. United Healthcare, No. CV1710978ESSCM, 2018 WL 2332204 (D.N.J. May 23, 2018) (Judge Esther Salas). The court granted Defendant’s motion to dismiss Plaintiff’s Complaint based on the existence of a valid and enforceable anti-assignment provision in the ERISA-governed plan.
Salinas Valley Mem’l Healthcare Sys. v. Envirotech Molded Prod., Inc., No. 17-CV-03887-LHK, 2018 WL 2298676 (N.D. Cal. May 21, 2018) (Judge Lucy H. Koh). The court granted Defendant’s motion to dismiss the complaint against Defendant ELAP Services, LLC because ELAP’s interpretation of the terms of the Plan does not conflict with the Plan’s MOOP Provision or its definition of reasonable and customary. ELAP is not a proper defendant on Plaintiff’s claim that the allowable claim limits was inadequately disclosed in the SPD. No factual allegations suggest that ELAP was involved in any way with the formation or preparation of the SPD.
Davis v. Soc. Sec. Admin., No. CV PX-17-1356, 2018 WL 2321122 (D. Md. May 22, 2018) (Judge Paula Xinis). Plaintiff brought a claim under 29 U.S.C. § 1132(c)(1) against Defendant for allegedly violating the disclosure requirements of ERISA by failing to respond to his request for information about survivor’s benefits. The court dismissed the claim because the SSA’s benefits are not subject to ERISA. Specifically, they are not established or maintained by an employer or employee organization for the benefit of an employer’s employees. Since SSA benefits are not covered by ERISA, the civil penalty provision does not apply to the requested information that is the subject of Plaintiff’s Amended Complaint.


The Prospero’s have had some bad luck with broken items recently and they believe that it cant get any worse, can it?
Pawel and Rosabelle spent much of their time yesterday repairing broken items around the house and that made them both very tired and they sleep in this morning, waking up with less than an hour to get ready for work.
Of course the shower breaks when Rosabelle takes her morning shower.
After a whirlwind prep for work in less than an hour both Rosabelle and Pawel leave for work.
Today’s Report came while they were at work, funds are now §13,187 simoleons.
While Rosabelle is at work she receives a crazy letter and she has to choose whether to run the letter in the column or to ignore it.
She chooses to ignore the crazy letter and not publish it.
Ehh, Rosabelle figures better safe than sorry.
Both Rosabelle and Pawel return home from work, it has been at stressful day at work for them and they have to come home to a house full of broken objects. The shower is still broken from this morning and the second computer has been broken for days.
Rosabelle got promoted today to Regular Contributor, she received §352 simoleons in regular pay and a cash bonus of §703 simoleons. She was also awarded A Open Book wall hanging. Pawel made §304 simoleons at work, their funds are now §14,546.
They are both hungry when they get home so they eat left over scrambled eggs together.
Pawel is stinky from not getting to shower this morning because it broke. He is also unhappy because of the messy environment since he is a neat sim.
He sets about repairing the shower so he can use it. Meanwhile Rosabelle starts a Fantasy novel called “The Werewolf Journals”. Pawel gets 2 common upgrade parts from fixing the shower, he keeps them for later.
After he is finished, he has to mop the floor or he will be upset for the rest of the night.
It is getting late and Pawel has not started his work task of writing book so he resumes writing his non-fiction book, Supersim Me. Rosabelle tends the garden and goes to bed early because she has to work tomorrow.
Pawel finishes his non-fiction book and rushed to send it to his NEW publisher. He has gained enough experince writing that he can actually have his books published by a company rather than self publishing them.
Pawel is now extremely tired and heads inside to bed.
He may be extremely tired but he is also extremely happy, he has found the love of his life and has a good job and a comfortable home. Pawel has been thinking recently that they are not getting any younger and if Rossabelle’s dream of having the family earn §1,000,000 simoleons is going to be achieved they are going to need to start a family soon. But he knows there is a very important step that needs to happen before the baby making can begin and tomorrow seems like just the day to to it.


Thanks for using iCouch! Here we describe how we collect, use and handle your information when you use our websites, software and services ("Services").
Services. Our Services are designed to make it simple to manage your behavioral health practice. To make that possible, we store, process, and transmit data over the internet from our servers, the servers of our vendors to your computer or devices. Transmission of Protected Health Information (“PHI”) happens using infrastructure compliant with the requirements and guidelines of the Health Insurance Portability and Accountability Act (“HIPAA”) and other relevant laws.
Usage. We collect information related to how you use the Service, including actions you take in your account. This data is used to make improvements to the Service.
Cookies and other technologies. We use technologies like cookies and pixel tags to provide, improve, protect and promote our Services. You can set your browser to not accept cookies, but this may limit your ability to use the Services.
Other users. Our Services display information like your name, profile picture, and other information that you may have explicitly provided for the purposes of promoting your services.
Law & Order. We may disclose your information to third parties if we determine that such disclosure is reasonably necessary to (a) comply with the law; (b) protect any person from death or serious bodily injury; (c) prevent fraud or abuse of iCouch or our users; or (d) protect iCouch’s property rights.
EU-US Privacy Shield and US-Swiss Safe Harbor. When transferring data from the European Union, the European Economic Area, and Switzerland, iCouch relies upon a variety of legal mechanisms, including contracts with our users. iCouch complies with the U.S.-Swiss Safe Harbor ("Safe Harbor") framework and its principles. We also participate in the EU-U.S. Privacy Shield Program ("Privacy Shield") and comply with its framework and principles.
Have questions or concerns about iCouch, our Services and privacy? Contact us at support@icouch.me.
Medical Information: ICOUCH DOES NOT PROVIDE MEDICAL ADVICE. DO NOTE USE THE SITE FOR EMERGENCY MEDICAL NEEDS. IF YOU EXPERIENCE A MEDICAL EMERGENCY CALL 911. The information on the Site, including data, text, software, music, sound, images, video, graphics, presentations, communications or other information (the “Content”) provided by iCouch does not constitute medical advice of any kind and it is not intended to be, and should not be, used to diagnose or identify treatment for a medical condition. Nothing on the Site should be construed as an attempt to offer or render a medical opinion or otherwise engage in the practice of medicine by iCouch.
ICOUCH DOES NOT RECOMMEND, REFER, ENDORSE, VERIFY, EVALUATE OR GUARANTEE ANY ADVICE, INFORMATION, TREATMENT, INSTITUTION, PRODUCT, PROFESSIONAL, COUNSELOR, PHYSICIAN, PROCEDURE, TEST, OPINION OR OTHER INFORMATION OR SERVICES PROVIDED BY ANY COUNSELOR USING THE SITE, AND NOTHING SHALL BE CONSIDERED AS A REFERRAL, ENDORSEMENT, RECOMMENDATION OR GUARANTEE OF ANY COUNSELOR. ICOUCH DOES NOT WARRANT THE VALIDITY, ACCURACY, COMPLETENESS, SAFETY, LEGALITY, QUALITY, OR APPLICABILITY OF THE CONTENT OR ANYTHING SAID OR WRITTEN BY ANY COUNSELORS OR ANY ADVICE PROVIDED, INCLUDING ANY INFORMATION CONTAINED IN ANY COUNSELOR LISTING. ICOUCH WILL NOT BE LIABLE FOR ANY DAMAGES SUSTAINED DUE TO RELIANCE BY THE USER ON SUCH INFORMATION OR ADVICE PROVIDED BY ANY COUNSELOR.
Age: If you are under 18 years old, you may use the Service, with or without registering, only with the approval of your parent or guardian.
Member Account, Password and Security: You are responsible for maintaining the confidentiality of your password and account, and are fully responsible for any and all activities that occur under your password or account. You agree to (a) immediately notify iCouch of any unauthorized use of your password or account or any other breach of security, and (b) ensure that you exit from your account at the end of each session when accessing the Service. iCouch will not be liable for any loss or damage arising from your failure to comply with this Section.
Modifications to Service: iCouch reserves the right to modify or discontinue, temporarily or permanently, the Service (or any part thereof) with or without notice. You agree that iCouch shall not be liable to you or to any third party for any modification, suspension or discontinuance of the Service.
Users are ultimately responsible for choosing their own counselor, physician or medical provider; and iCouch attempts to restrict participation in the Services to counselors, physicians or medical providers who hold active licenses and all certifications necessary to practice any services offered to patients, however verification of qualifications is the sole responsibility of the user.
You agree to not use the Service to: post, email or otherwise transmit any content outside of any counseling sessions, that in the sole judgment of iCouch, (i) is unlawful, abusive, harassing, tortious, excessively violent, defamatory, obscene, libelous, invasive of another‘s privacy, infringing of an third party’s rights or otherwise objectionable; (ii) you do not have a right to transmit under any law or under contractual or fiduciary relationships; (iii) poses or creates a privacy or security risk to any person; or (iv) which may expose iCouch or its users to any harm or liability of any type; impersonate any person or entity, or falsely state or otherwise misrepresents your affiliation with a person or entity; advertise or offer to sell or buy any goods or services for any business purpose that is not specifically authorized; violate any applicable local, state, national or international law, or any regulations having the force of law; use the Service in any manner that could damage, disable, overburden, or impair the Service or interfere with any other party’s use and enjoyment of the Service; or obtain or attempt to access or otherwise obtain any materials or information through any means not intentionally made available or provided for through the Service.
Video Conferences: You may not modify, enhance, remove, interfere with, or otherwise alter in any way any portion of iCouch’s video conference transmission system (the “Video Application”), its underlying technology, any digital rights management mechanism, device, or other content protection or access control measure incorporated into the Video Application.
Personal Use: Unless otherwise specified, you agree not to display, distribute, license, perform, publish, reproduce, duplicate, copy, create derivative works from, modify, sell, resell, exploit, transfer or transmit for any commercial purposes, any portion of the Service, use of the Service, or access to the Service.
Fees: iCouch will use reasonable efforts to process the payments due from the user according to the terms agreed upon between user and an counselor within seven (7) working days from the execution date of each transaction.
iCouch’s billing system is not fault-free or flexible; therefore iCouch shall not be liable for any problems, miscalculations or malfunctions in processing the payments owed by the user. If the user thinks that a mistake has occurred he or she may send his or her concern to support@icouch.me.
Special Notice for International Use; Export Controls: Software available in connection with the Service and the transmission of applicable data, if any, is subject to United States export controls. No Software may be downloaded from the Service or otherwise exported or re-exported in violation of U.S. export laws. Downloading or using the Software is at your sole risk. You agree to comply with all applicable laws regarding the transmission of technical data exported from the United States or the country in which you reside.
Content Posted on the Site: You are solely responsible for the content and other materials you post on or through the Service or the Site or transmit to or share with other users, counselors or recipients (collectively, “Posted Content”). You will not post any content that you did not create or that you do not own all rights, title and interest in and to, including, without limitation, all copyright and rights of publicity contained therein. By posting any Posted Content you hereby grant and will grant iCouch and its affiliated companies a nonexclusive, worldwide, royalty free, fully paid up, transferable, sublicenseable, perpetual, irrevocable license to copy, display, transmit, distribute, store, modify and otherwise use your Posted Content in connection with the operation of the Service or the promotion, advertising or marketing thereof, in any form, medium or technology now known or later developed.
You acknowledge and agree that any questions, comments, suggestions, ideas, feedback or other information about the Site or the Service (“Submissions”), provided by you to iCouch are non-confidential and iCouch shall be entitled to the unrestricted use and dissemination of these Submissions for any purpose, commercial or otherwise, without acknowledgment or compensation to you.
Copyright Complaints: iCouch respects the intellectual property of others, and we ask our users and counselors to do the same. If you believe that your work has been copied in a way that constitutes copyright infringement, or that your intellectual property rights have been otherwise violated, you should notify iCouch or your infringement claim in accordance with the procedure set forth below.
and your name, address, telephone number, and email address and a statement that you will accept service of process from the person who provided notification of the alleged infringement.
If a counter-notice is received by the Copyright Agent, iCouch will send a copy of the counter-notice to the original complaining party informing that person that it may replace the removed content or cease disabling it in 10 business days. Unless the copyright owner files an action seeking a court order against the content provider, member or user, the removed content may be replaced, or access to it restored, in 10 to 14 business days or more after receipt of the counter-notice, at iCouch’s sole discretion.
Repeat Infringer Policy: In accordance with the DMCA and other applicable law, iCouch has adopted a policy of terminating, in appropriate circumstances and at iCouch’s sole discretion, the account of anyone deemed to be a repeat infringer. iCouch may also at its sole discretion limit access to the Site and/or terminate the memberships of anyone who infringes any intellectual property rights of others, whether or not there is any repeat infringement.
The Service may provide, or third parties may provide, links to other sites and resources on the Internet. iCouch has no control over such sites and resources and iCouch is not responsible for and does not endorse such sites and resources. You further acknowledge and agree that iCouch shall not be responsible or liable, directly or indirectly, for any damage or loss caused or alleged to be caused by or in connection with use of or reliance on any content, events, goods or services available on or through any such hyperlinked site or resource. Any dealings you have with advertisers found while using the Service are between you and the advertiser, and you agree that iCouch is not liable for any loss or claim that you may have against an advertiser.
YOUR USE OF THE SERVICE IS AT YOUR SOLE RISK. THE SERVICE AND ANY CONTENT OR MATERIAL DOWNLOADED OR OTHERWISE OBTAINED THROUGH THE USE OF THE SERVICE IS PROVIDED ON AN “AS IS”, “WITH ALL FAULTS”, AND “AS AVAILABLE” BASIS. ICOUCH EXPRESSLY DISCLAIMS ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING, BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. WITHOUT LIMITING THE FOREGOING, ICOUCH MAKES NO WARRANTY THAT (I) THE SERVICE WILL BE EFFECTIVE, WILL FUNCTION WITHOUT DISRUPTIONS, DELAYS OR ERRORS, WILL BE RELIABLE OR ACCURATE, OR WILL MEET YOUR REQUIREMENTS, (II) THE SERVICE WILL BE UNINTERRUPTED, TIMELY, SECURE, ERROR-FREE, OR ACCESSIBLE AT TIMES OR LOCATIONS OF YOUR CHOOSING, (III) THE RESULTS OR INFORMATION THAT MAY BE OBTAINED FROM THE USE OF THE SERVICE WILL BE ACCURATE, RELIABLE TIMELY, OR COMPLETE, (IV) THE QUALITY OF ANY PRODUCTS, SERVICES, INFORMATION, OR OTHER MATERIAL PURCHASED OR OBTAINED BY YOU THROUGH THE SERVICE WILL MEET YOUR EXPECTATIONS, AND (V) ANY ERRORS WILL BE CORRECTED. EXCEPT AS EXPRESSLY SET FORTH HEREIN, ICOUCH MAKES NO WARRANTIES ABOUT THE INFORMATION SYSTEMS, SOFTWARE AND FUNCTIONS MADE ACCESSIBLE THROUGH THE SITE OR ANY OTHER SECURITY ASSOCIATED WITH THE TRANSMISSION OF SENSITIVE INFORMATION.
ALWAYS USE CAUTION WHEN GIVING OUT ANY PERSONALLY IDENTIFYING INFORMATION ABOUT YOURSELF OR YOUR CHILDREN. ICOUCH DOES NOT CONTROL OR ENDORSE THE CONTENT, MESSAGES OR INFORMATION FOUND ON THE SERVICE AND, THEREFORE, ICOUCH SPECIFICALLY DISCLAIMS ANY LIABILITY WITH REGARD TO THE SERVICE AND ANY OTHER ACTIONS RESULTING FROM YOUR PARTICIPATION IN THE SERVICE.
YOU EXPRESSLY UNDERSTAND AND AGREE THAT ICOUCH SHALL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY DAMAGES, OR DAMAGES FOR LOSS OF PROFITS INCLUDING BUT NOT LIMITED TO, DAMAGES FOR LOSS OF GOODWILL, USE, DATA OR OTHER INTANGIBLE LOSSES (EVEN IF ICOUCH HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES), WHETHER BASED ON CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY OR OTHERWISE, RESULTING FROM: (I) THE USE OR THE INABILITY TO USE THE SERVICE; (II) THE COST OF PROCUREMENT OF SUBSTITUTE GOODS AND SERVICES RESULTING FROM ANY GOODS, DATA, INFORMATION OR SERVICES PURCHASED OR OBTAINED OR MESSAGES RECEIVED OR TRANSACTIONS ENTERED INTO THROUGH OR FROM THE SERVICE; (III) UNAUTHORIZED ACCESS TO OR ALTERATION OF YOUR TRANSMISSIONS OR DATA; (IV) STATEMENTS OR CONDUCT OF ANY THIRD PARTY ON THE SERVICE; OR (V) ANY OTHER MATTER RELATING TO THE SERVICE. IN NO EVENT SHALL ICOUCH’S TOTAL LIABILITY TO YOU FOR ALL DAMAGES, LOSSES OR CAUSES OF ACTION EXCEED ONE HUNDRED DOLLARS ($100). SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF CERTAIN WARRANTIES OR THE LIMITATION OR EXCLUSION OF LIABILITY FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES. ACCORDINGLY, SOME OF THE ABOVE LIMITATIONS SET FORTH ABOVE MAY NOT APPLY TO YOU. IF YOU ARE DISSATISFIED WITH ANY PORTION OF THE SERVICE OR WITH THESE TERMS OF SERVICE, YOUR SOLE AND EXCLUSIVE REMEDY IS TO DISCONTINUE USE OF THE SERVICE.
Any controversy or claim arising out of or relating to this contract, or the breach thereof, shall be settled by binding arbitration administered by the American Arbitration Association in accordance with its Commercial Arbitration Rules, and judgment on the award rendered by the arbitrator(s) may be entered in any court having jurisdiction thereof. Unless otherwise agreed to by the parties, the arbitration will be held in Houston, TX.
You agree that you are solely responsible for your interactions with any other user of the Service, including counselors. iCouch reserves the right, but has no obligation, to become involved in any way with disputes between you and any other user of the Service.
By using the Service, each user understands and agrees that all advice, information, treatments, institutions, products, professionals, physicians, procedures, tests, opinions or other information or services written or provided are so written or provided by counselors who are neither employees of iCouch nor controlled by iCouch. Each user understands and agrees that, although a mental or medical health professional, physician, other professional counselor may have been accessed through the Site, iCouch cannot predict or assess the competence of, or appropriateness for their needs. Each user understands and agrees that, iCouch does not validate or otherwise endorse the Content or any individual. iCouch has no control over, and cannot guarantee the availability of any counselor at any particular time. iCouch will not be liable for cancelled or otherwise unfulfilled appointments or any injury resulting therefrom, or for any other injury resulting from the use of the Site or Services whatsoever.
Users are strongly advised to perform their own investigation prior to selecting a counselor by making confirming telephone calls to the appropriate licensing authorities to verify listed credentials and education, and to further verify information about a particular counselor by confirming with (i) their current physician, (ii) counselor’s office, (iii) the medical association relative to the counselor’s specialty, and (iv) the appropriate state medical board or other governmental authority.
USERS WHO CHOOSE TO INTERACT WITH ANY MENTAL OR MEDICAL HEALTH PROFESSIONAL, PHYSICIAN OR OTHER PROFESSIONAL COUNSELOR ON THE SITE ACKNOWLEDGE THAT SUCH RELATIONSHIP IS STRICTLY WITH SUCH PROFESSIONAL AND NOT WITH ICOUCH. ICOUCH IS NOT INVOLVED IN ANY WAY WITH THE SUBSTANCE OF SUCH RELATIONSHIP OR THE ADVICE OR INFORMATION GIVEN THEREIN, AND DOES NOT VALIDATE THE INFORMATION OR ADVICE PROVIDED TO ANY USER BY THEIR COUNSELOR. EACH USER HEREBY RELEASES AND AGREE TO HOLD HARMLESS ICOUCH, ITS DIRECTORS, OFFICERS, EMPLOYEES, AGENTS, SUCCESSORS, ADVISORS, CONSULTANTS, AND ASSIGNS FROM ANY AND ALL CAUSES OF ACTION AND CLAIMS OF ANY NATURE RESULTING FROM THE ACTS OF MEDICAL OR MENTAL HEALTH PROFESSIONALS, ANY OTHER PROVIDERS ACCESSED THROUGH THE SITE.
NO LICENSED MEDICAL PROFESSIONAL/PATIENT RELATIONSHIP IS CREATED BETWEEN USERS AND ICOUCH AND/OR COUNSELORS AND ICOUCH BY USING INFORMATION PROVIDED BY OR THROUGH THE USE OF THE SITE INCLUDING, BUT NOT LIMITED TO, LINKS TO OTHER SITES OR ANY ASSISTANCE ICOUCH MAY PROVIDE TO HELP USERS FIND AN APPROPRIATE COUNSELOR, MEDICAL PROFESSIONAL OR SPECIALIST IN ANY FIELD.
Practitioners hereby acknowledge that they are solely responsible for any and all advice, information, treatments, institutions, products, professionals, counselors, physicians, procedures, tests, opinions or other information or services written or provided, as applicable, to any iCouch user.
This BUSINESS ASSOCIATE AGREEMENT (“BAA”) is made by and between you (“Covered Entity” or “CE”) and ICOUCH, INC., a Delaware “C” corporation (“Business Associate” or “BA”) (each a “party” and, collectively, the “parties”) upon your indication that you understand and accept all of the terms and conditions herein (the “Effective Date”).
A. CE is a “covered entity” under the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 (“HIPAA”) and, as such, must enter into so-called “business associate” contracts with certain contractors that may have access to certain patient medical information.
B. Pursuant to the terms of one or more agreements between the parties, whether oral or in writing (collectively, the “Agreement”), BA shall provide certain services to CE. To facilitate BA’s provision of such services, CE wishes to disclose certain information to BA, some of which may constitute Protected Health Information (“PHI”) (defined below).
C. CE and BA intend to protect the privacy and provide for the security of PHI disclosed to BA pursuant to the Agreement in compliance with HIPAA, the Health Information Technology for Economic and Clinical Health Act, Public Law 111-005 (“HITECH Act”), and regulations promulgated thereunder by the U.S. Department of Health and Human Services (“HIPAA Regulations”) and other applicable laws, including without limitation state patient privacy laws, as such laws may be amended from time to time.
D. As part of the HIPAA Regulations, the Privacy Rule and the Security Rule (defined below) require CE to enter into a contract containing specific requirements with BA prior to the disclosure of PHI (defined below), as set forth in, but not limited to, Title 45, Sections 164.314(a), 164.502(e) and 164.504(e) of the Code of Federal Regulations (“C.F.R.”) and contained in this BAA.
1.1. Breach shall have the meaning given to such term under 42 U.S.C. § 17921(1) and 45 C.F.R. § 164.402.
1.2. Business Associate shall have the meaning given to such term under 42 U.S.C. § 17938 and 45 C.F.R. § 160.103.
1.3. Covered Entity shall have the meaning given to such term under 45 C.F.R. § 160.103.
1.4. Data Aggregation shall have the meaning given to such term under 45 C.F.R. § 164.501.
1.5. Designated Record Set shall have the meaning given to such term 45 C.F.R. § 164.501.
1.6. Electronic Protected Health Information or EPHI means Protected Health Information that is maintained in or transmitted by electronic media.
1.7. Electronic Health Record shall have the meaning given to such term under 42 U.S.C. § 17921(5).
1.8. Health Care Operations shall have the meaning given to such term under 45 C.F.R. § 164.501.
1.9. Privacy Rule shall mean the HIPAA Regulation that is codified at 45 C.F.R. Parts 160 and 164, Subparts A and E.
1.10. Protected Health Information or PHI means any information, whether oral or recorded in any form or medium: (i) that relates to the past, present or future physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and (ii) that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual, and shall have the meaning given to such term under 45 C.F.R. § 160.103. Protected Health Information includes Electronic Protected Health Information.
1.11. Protected Information shall mean PHI provided by CE to BA or created or received by BA on CE’s behalf.
1.12. Security Rule shall mean the HIPAA Regulation that is codified at 45 C.F.R. Parts 160 and 164, Subparts A and C.
1.13. Unsecured PHI shall have the meaning given to such term under 42 U.S.C. § 17932(h), 45 C.F.R. § 164.402 and guidance issued pursuant to the HITECH Act including, but not limited to that issued on April 17, 2009 and published in 74 Federal Register 19006 (April 27, 2009), by the Secretary of the U.S. Department of Health and Human Services (“Secretary”).
2. Obligations of Business Associate.
2.1. Permitted Access, Use or Disclosure. BA shall neither permit the unauthorized or unlawful access to, nor use or disclose, PHI other than as permitted or required by the Agreement, this BAA, or as permitted or required by law. Except as otherwise limited in the Agreement or this BAA, BA may access, use, or disclose PHI (i) to perform its services as specified in the Agreement; and (ii) for the proper administration of BA, provided that such access, use, or disclosure would not violate HIPAA, the HITECH Act, the HIPAA Regulations, or applicable state law if done or maintained by CE. If BA discloses Protected Information to a third party, BA must obtain, prior to making any such disclosure, (i) reasonable written assurances from such third party that such Protected Information will be held confidential as provided pursuant to this BAA and only disclosed as required by law or for the purposes for which it was disclosed to such third party, and (ii) a written agreement from such third party to promptly notify BA of any Breaches of confidentiality of the Protected Information, to the extent it has obtained knowledge of such Breach.
2.2. Prohibited Uses and Disclosures Under HITECH. Notwithstanding any other provision in this BAA, BA shall comply with the following requirements: (i) BA shall not use or disclose Protected Information for fundraising or marketing purposes, except as provided under the Agreement and consistent with the requirements of 42 U.S.C. § 17936; (ii) BA shall not disclose Protected Information to a health plan for payment or health care operations purposes if the patient has requested this special restriction, and has paid out of pocket in full for the health care item or service to which the PHI solely relates, 42 U.S.C. § 17935(a); (iii) BA shall not directly or indirectly receive remuneration in exchange for Protected Information, except with the prior written consent of CE and as permitted by the HITECH Act, 42 U.S.C. § 17935(d)(2); however, this prohibition shall not affect payment by CE to BA for services provided pursuant to the Agreement.
2.3. Appropriate Safeguards. BA shall implement appropriate safeguards designed to prevent the access, use or disclosure of Protected Information other than as permitted by the Agreement or this BAA. BA shall use administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of EPHI. BA shall comply with each of its obligations under the applicable requirements of 45 C.F.R. §§ 164.308, 164.310, and 164.312 and the policies and procedures and documentation requirements of the HIPAA Security Rule set forth in 45 C.F.R. § 164.316.
2.4. Reporting of Improper Access, Use, or Disclosure.
(a) Generally. BA shall promptly notify CE of any Breach of security, intrusion or unauthorized access, use, or disclosure of PHI of which BA becomes aware and/or any access, use, or disclosure of data in violation of the Agreement, this BAA, or any applicable federal or state laws or regulations. BA shall take (i) prompt corrective action to cure any deficiencies in its policies and procedures that may have led to the incident, and (ii) any action pertaining to such unauthorized access, use, or disclosure required of BA by applicable federal and state laws and regulations.
(b) Breaches of Unsecured PHI. Without limiting the generality of the reporting requirements set forth in Section 2.4(a), BA also shall, following the discovery of any Breach of Unsecured PHI, notify CE in writing of such Breach without unreasonable delay and in no case later than sixty (60) days after discovery. The notice shall include the following information if known (or can be reasonably obtained) by BA: (i) contact information for the individuals who were or who may have been impacted by the Breach (e.g., first and last name, mailing address, street address, phone number, email address); (ii) a brief description of the circumstances of the Breach, including the date of the Breach and date of discovery (as defined in 42 U.S.C. § 17932(c)); (iii) a description of the types of Unsecured PHI involved in the Breach (e.g., names, social security numbers, date of birth, addresses, account numbers of any type, disability codes, diagnostic and/or billing codes and similar information); (iv) a brief description of what the BA has done or is doing to investigate the Breach and to mitigate harm to the individuals impacted by the Breach.
(c) Mitigation. BA shall establish and maintain safeguards to mitigate, to the extent practicable, any deleterious effects known to BA of any unauthorized or unlawful access or use or disclosure of PHI not authorized by the Agreement, this BAA, or applicable federal or state laws or regulations; provided, however, that unless otherwise agreed in writing by the parties or required by applicable federal or state laws or regulations, such mitigation efforts by BA shall not require BA to bear the costs of notifying individuals impacted by such unauthorized or unlawful access, use, or disclosure of PHI; provided, further, however, that BA shall remain fully responsible for all aspects of its reporting duties to CE under Section 2.4(a) and Section 2.4(b).
2.5. Business Associate’s Subcontractors and Agents. BA shall ensure that any agents or subcontractors to whom it provides Protected Information agree to the same restrictions and conditions that apply to BA with respect to such PHI. To the extent that BA creates, maintains, receives or transmits EPHI on behalf of the CE, BA shall ensure that any of BA’s agents or subcontractors to whom it provides Protected Information agree to implement the safeguards required by Section 2.3 above with respect to such EPHI.
2.6. Access to Protected Information. To the extent BA maintains a Designated Record Set on behalf of the CE, BA shall make Protected Information maintained by BA or its agents or subcontractors in Designated Record Sets available to CE for inspection and copying within ten (10) days of a request by CE to enable CE to fulfill its obligations under the Privacy Rule, including, but not limited to, 45 C.F.R. § 164.524. If BA maintains an Electronic Health Record, BA shall provide such information in electronic format to enable CE to fulfill its obligations under the HITECH Act, including, but not limited to, 42 U.S.C. § 17935(e).
2.7. Amendment of PHI. To the extent BA maintains a Designated Record Set on behalf of CE, within ten (10) days of receipt of a request from the CE for an amendment of Protected Information or a record about an individual contained in a Designated Record Set, BA or its agents or subcontractors shall make PHI available to CE so that CE may make any amendments that CE directs or agrees to in accordance with the Privacy Rule.
2.8. Accounting Rights. Within ten (10) days of notice by CE of a request for an accounting of disclosures of Protected Information, BA and its agents or subcontractors shall make available to CE the information required to provide an accounting of disclosures to enable CE to fulfill its obligations under the Privacy Rule, including, but not limited to, 45 C.F.R. § 164.528, and its obligations under the HITECH Act, including but not limited to 42 U.S.C. § 17935(c), as determined by CE. BA agrees to implement a process that allows for an accounting to be collected and maintained by BA and its agents or subcontractors for at least six (6) years prior to the request. However, accounting of disclosures from an Electronic Health Record for treatment, payment, or health care operations purposes are required to be collected and maintained for only three (3) years prior to the request, and only to the extent BA maintains an electronic health record and is subject to this requirement. At a minimum, the information collected and maintained shall include, to the extent known to BA: (i) the date of the disclosure; (ii) the name of the entity or person who received PHI and, if known, the address of the entity or person; (iii) a brief description of the PHI disclosed; and (iv) a brief statement of the purpose of the disclosure that reasonably informs the individual of the basis for the disclosure, or a copy of the individual’s authorization, or a copy of the written request for disclosure. The accounting must be provided without cost to the individual or the requesting party if it is the first accounting requested by such individual within any twelve (12) month period. For subsequent accountings within a twelve (12) month period, BA may charge the individual or party requesting the accounting a reasonable fee based upon BA’s labor costs in responding to the request and a cost-based fee for the production of non-electronic media copies, so long as BA informs the individual or requesting party in advance of the fee and the individual or requesting party is afforded an opportunity to withdraw or modify the request. BA shall notify CE within five (5) business days of receipt of any request by an individual or other requesting party for an accounting of disclosures. The provisions of this Section 2.8 shall survive the termination of this BAA.
2.9. Governmental Access to Records. BA shall make its internal practices, books and records relating to the use and disclosure of Protected Information available to CE and to the Secretary for purposes of determining BA’s compliance with the Privacy Rule.
2.10. Minimum Necessary. To the extent feasible in the performance of services under the Agreement, BA (and its agents or subcontractors) shall request, use, and disclose only the minimum amount of Protected Information necessary to accomplish the purpose of the request, use, or disclosure. Because the definition of “minimum necessary” is in flux, BA shall keep itself informed of guidance issued by the Secretary with respect to what constitutes “minimum necessary.” Notwithstanding the foregoing, the parties agree that based on the nature of the services provided to CE by BA under the Agreement, BA may be unable to determine what constitutes “minimum necessary” under HIPAA, and thus BA shall be entitled to rely on CE’s direction as to what constitutes “minimum necessary” with respect to the access, use, or disclosure of CE’s PHI in the possession or under the control of BA.
2.11. Permissible Requests by Covered Entity. CE shall not request BA to use or disclose PHI in any manner that would not be permissible under HIPAA or the HITECH Act if done by CE or BA. CE shall not direct BA to act in a manner that would not be compliant with the Security Rule, the Privacy Rule, or the HITECH Act.
2.12. Breach Pattern or Practice by CE. Pursuant to 42 U.S.C. § 17934(b), if BA knows of a pattern of activity or practice of CE that constitutes a material breach or violation of CE’s obligations under the Agreement, this BAA, or other arrangement, BA must take reasonable steps to cure the breach or end the violation. If the steps are unsuccessful, BA must terminate the applicable Agreement to which the breach and/or violation relates if feasible, or if termination is not feasible, report the problem to the Secretary of the Department of Health and Human Services.
3.1. Term. The term of this BAA shall be effective as of the Effective Date and shall terminate when all of the PHI provided by CE to BA, or created or received by BA on behalf of CE, is destroyed or returned to CE.
(a) Material Breach by BA. Upon any material breach of this BAA by BA, CE shall provide BA with written notice of such breach and such breach shall be cured by BA within thirty (30) business days of such notice. If such breach is not cured within such time period, CE may immediately terminate this BAA and the applicable Agreement.
(b) Effect of Termination. Upon termination of any of the agreements comprising the Agreement for any reason, BA shall, if feasible, return or destroy all PHI relating to such agreements that BA or its agents or subcontractors still maintain in any form, and shall retain no copies of such PHI. If return or destruction is not feasible, BA shall continue to extend the protections of this BAA to such information, and limit further use of such PHI to those purposes that make the return or destruction of such PHI infeasible.
4. Compliance with State Law. Nothing in this BAA shall be construed to require BA to use or disclose Protected Information without a written authorization from an individual who is a subject of the Protected Information, or without written authorization from any other person, where such authorization would be required under state law for such use or disclosure.
5. Amendment to Comply with Law. Because state and federal laws relating to data security and privacy are rapidly evolving, amendment of the Agreement or this BAA may be required to provide for procedures to ensure compliance with such developments. BA and CE shall take such action as is necessary to implement the standards and requirements of HIPAA, the HITECH Act, the Privacy Rule, the Security Rule and other applicable laws relating to the security or confidentiality of PHI. BA shall provide to CE satisfactory written assurance that BA will adequately safeguard all PHI. Upon the request of either party, the other party shall promptly enter into negotiations concerning the terms of an amendment to this BAA embodying written assurances consistent with the standards and requirements of HIPAA, the HITECH Act, the Privacy Rule, the Security Rule or other applicable laws. CE may terminate the applicable Agreement upon thirty (30) days written notice in the event (i) BA does not promptly enter into negotiations to amend the Agreement or this BAA when requested by CE pursuant to this Section or (ii) BA does not enter into an amendment to the Agreement or this BAA providing assurances regarding the safeguarding of PHI that CE, in its reasonable discretion, deems sufficient to satisfy the standards and requirements of applicable laws, within thirty (30) days following receipt of a written request for such amendment from CE.
6. No Third-Party Beneficiaries. Nothing express or implied in the Agreement or this BAA is intended to confer, nor shall anything herein confer upon any person other than CE, BA and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.
7. Notices. All notices hereunder shall be in writing, delivered personally, by certified or registered mail, return receipt requested, or by overnight courier, and shall be deemed to have been duly given when delivered personally or when deposited in the United States mail, postage prepaid, or deposited with the overnight courier addressed as follows: If to CE, to the address set forth in your iCouch profile, as such may be amended from time-to-time. If to BA: iCouch, Inc. 2319 Marblecrest Ln Spring, TX 77386 Attn: Security Officer or to such other persons or places as either party may from time to time designate by written notice to the other.
8. Interpretation. The provisions of this BAA shall prevail over any provisions in the Agreement that may conflict or appear inconsistent with any provision in this BAA. This BAA and the Agreement shall be interpreted as broadly as necessary to implement and comply with HIPAA, the HITECH Act, the Privacy Rule and the Security Rule. Any ambiguity in this BAA shall be resolved in favor of a meaning that complies and is consistent with HIPAA, the HITECH Act, the Privacy Rule and the Security Rule. Except as specifically required to implement the purposes of this BAA, or to the extent inconsistent with this BAA, all other terms of the Agreement shall remain in force and effect.
9. Entire Agreement of the Parties. This BAA supersedes any and all prior and contemporaneous business associate agreements or addenda between the parties and constitutes the final and entire agreement between the parties hereto with respect to the subject matter hereof. Each party to this BAA acknowledges that no representations, inducements, promises, or agreements, oral or otherwise, with respect to the subject matter hereof, have been made by either party, or by anyone acting on behalf of either party, which are not embodied herein. No other agreement, statement or promise, with respect to the subject matter hereof, not contained in this BAA shall be valid or binding.
10. Regulatory References. A reference in this BAA to a section of regulations means the section as in effect or as amended, and for which compliance is required.
11. Counterparts. This BAA may be executed in one or more counterparts, each of which shall be deemed to be an original, and all of which together shall constitute one and the same instrument.
This is a sample of the iCouch Business Associates Agreement. It has no binding effect of unless signed by both the legal represenative of iCouch, Inc. and a specific Covered Entity.
Contact iCouch support at support@icouch.me to request a signed version of this document for your records.


text:
“ personal data” means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (C26, C27, C30 Reg. UE 679/2016).
specific information may be find on the Site page in relation to particular services or processing of the data provided.
DATA CONTROLLER, pursuant to art. 4 and 24 of the Regulation (EU) 2016/679, is FERRARI F.LLI LUNELLI S.P.A., Tax Number 00123890220, via Ponte di Ravina 15, 38123 Trento (TN), Italy, as represented by the pro tempore legal representative.
- to visit the website; - Contact us Area: the personal data provided by the user during registration, will be processed for purposes related to the request for information forwarded; - fulfillment of contractual obligations, of law and administrative-accounting purposes. For the purposes of the application of the provisions regarding the protection of personal data, the processing performed for administrative-accounting purposes are those related to the performance of organizational, administrative, financial and accounting activities, regardless of the nature of the data processed. In particular, these objectives pursue internal organizational activities, those functional for the fulfillment of contractual and pre-contractual obligations, information activities.
Personal data provided by you may be communicated to recipients, appointed pursuant to art. 28 of the Regulation EU 2016/679, which shall process your data as processors and/or persons acting under the authority of the Controller and the Processor, in order to perform agreements or related purposes. Precisely, your data may be communicated to recipients part of the following categories: Group companies connected or controlled by FERRARI F.LLI LUNELLI S.P.A.: - Subjects providing services for the management of the information system and communication networks of FERRARI F.LLI LUNELLI S.P.A. (including e-mail); - Studies or companies in the context of assistance and consultancy relationships; - Competent authorities for compliance with legal obligations and / or provisions of public bodies, upon request; - Subjects belonging to the distribution network; - Service and logistics companies that support the commercial office. The subjects belonging to the aforesaid categories act as data Processors or act in complete autonomy as separate data Controllers. The list of designated data Processors is constantly updated and available at the offices of FERRARI F.LL LUNELLI S.P.A.
You may exercise your rights pursuant to articles 15, 16, 17, 18, 19, 20, 21, 22 of the Regulation EU 2016/679, by contacting the data Controller, or the data Processor, or the Data Protection Officer service by writing to privacy@ferraritrento.it You have the right, at any time, to request the data Controller to access, rectify, cancel your personal data or limit their processing. Furthermore, you have the right to object, at any time, to the processing of your data (including automated processing, e.g. profiling) and to the portability of your data. Without prejudice to any other administrative and judicial appeal, if you believe that the processing of your data violates the provisions of Regulation EU 2016/679, pursuant to art. 15 letter f) of the aforementioned Regulation EU 2016/679, you have the right to lodge a complaint with the Data Protection Authority and, with reference to art. 6 paragraph 1, letter a) and art. 9 paragraph 2, letter a), you have the right to withdraw the consent given at any time. In case of request of data portability the Controller shall provide you with your personal data in a structured, commonly used and machine-readable format, subject to the provisions set forth in paragraphs 3 and 4 of art. 20 of Regulation EU 2016/679.

matches:
art. 4
art. 28
art. 15
art. 6
art. 9
art. 20