This Qualified Service Organization Agreement (this “QSOA”) is entered into on the date the Program accepts it electronically through the Services, as LatentWorx’s records show (the “Effective Date”), between:
LatentWorx and the Program are each a “Party” and together the “Parties.”
A. The Program operates a federally assisted substance use disorder ("SUD") program and is a “part 2 program” under 42 C.F.R. Part 2.
B. LatentWorx provides the Program with Kerrigan, an AI clinical documentation service, under the LatentWorx Terms of Service at https://latentworx.com/terms (the “Underlying Agreement”). The service is data processing: it transcribes clinical sessions, drafts notes from those transcripts, stores the results and logs access to notes. Doing this requires LatentWorx to receive, store and process records the Program holds about its patients.
C. Under 42 C.F.R. § 2.11, a person that provides data processing or other services to a part 2 program, and that signs a written agreement making the acknowledgements in Section 3 of this QSOA, is a “qualified service organization.” The Parties sign this QSOA so that LatentWorx is one.
D. Where the Program is also a HIPAA covered entity, LatentWorx is also its business associate under the Business Associate Agreement between the Parties, accepted electronically through the Services (the “BAA”). Paragraph (3) of the “qualified service organization” definition in 42 C.F.R. § 2.11 extends qualified service organization status to a business associate of a part 2 program that is also a covered entity, for protected health information that is also a Part 2 record. The Parties intend LatentWorx to be a qualified service organization on both grounds where both apply, and on the grounds in paragraphs (1) and (2) of that definition in every case.
E. The Parties have drafted this QSOA to the text of 42 C.F.R. Part 2 as amended by the final rule published February 16, 2024 (89 Fed. Reg. 12612), whose compliance date of 2026-02-16 has passed.
1.1 Capitalized terms used but not defined here (including “Actual Knowledge Date,” “Breach,” “Discovery,” “PHI,” “Required by Law,” “Security Incident,” “Services,” “Subcontractor” and “Unsecured PHI”) have the meanings the BAA gives them, and “business day” has the meaning the BAA gives it. Terms defined in 42 C.F.R. § 2.11 have those meanings here.
1.2 “Part 2” means 42 U.S.C. § 290dd-2 and 42 C.F.R. Part 2, as amended from time to time.
1.3 “Part 2 Record” means any “record,” as 42 C.F.R. § 2.11 defines it, that LatentWorx receives from, or creates, receives, stores or processes on behalf of, the Program, including any audio, transcript, draft note, final note, chat output or log entry containing Patient Identifying Information.
1.4 “Patient Identifying Information” has the meaning given in 42 C.F.R. § 2.11.
1.5 “SUD Counseling Notes” has the meaning given to “SUD counseling notes” in 42 C.F.R. § 2.11, as Section 11.2 explains in plain words.
1.6 “Legal Demand” means any subpoena, warrant, court order, discovery request, civil investigative demand, administrative demand or other legal process, or any informal request by a government authority, that seeks access to a Part 2 Record or to information about whether a person is or was a patient of the Program.
1.7 “Exhibit A” to “Exhibit D” mean those exhibits to the BAA (Services and Data; Safeguards; Subcontractors; Incident and Breach Procedure), incorporated into this QSOA by reference. “Exhibit E” (Part 2 Notices) is set out after the Acceptance section below and forms part of this QSOA. A reference to “Customer” in any Exhibit means the Program.
1.8 “Agreements” means the BAA and this QSOA.
2.1 Incorporation. The following provisions of the BAA are incorporated into this QSOA and apply to Part 2 Records as if written here, with each reference in them to “PHI” including Part 2 Records and each reference to “Customer” meaning the Program:
(a) Section 3.2 and Exhibit B (safeguards);
(b) Section 3.9 (books and records);
(c) Section 3.12 (mitigation);
(d) Section 4 and Exhibit D (Security Incident and Breach notification), including the notice periods in BAA Section 4, which this QSOA adopts by reference and does not restate;
(e) Section 5 and Exhibit C (Subcontractors), together with Section 8 of this QSOA;
(f) Section 6 (individual rights support);
(g) Section 9 (return and destruction), together with Section 13 of this QSOA;
(h) Section 10 (liability, indemnification and insurance) in full, including Sections 10.1 and 10.4, which applies as if “this BAA” read “the BAA and this QSOA.” The Section 10.2 cap is shared, not additional: it is one aggregate cap for claims under both Agreements and the Underlying Agreement. A breach of this QSOA is a breach of the BAA for Section 10 purposes. Section 10.5 (insurance) applies only if the BAA contains it when signed; and
(i) Section 11 (audit and compliance), together with Section 10 of this QSOA.
2.2 Order of precedence. On any matter governed by Part 2, this QSOA controls over the BAA. On every other matter the BAA controls. In any conflict concerning the use, disclosure or safeguarding of PHI or of Part 2 Records, the BAA and this QSOA control over the Underlying Agreement to the extent of the conflict, as BAA Section 12.4 provides.
2.3 More stringent state law. Where a state law is more stringent than Part 2 or HIPAA within the meaning of 45 C.F.R. § 160.202 and applies to a Party, that Party will comply with it. The Program will tell LatentWorx in writing of any such state-law requirement it relies on LatentWorx to follow in performing the Services. A state law does not change the notice periods in BAA Section 4 unless it applies directly to LatentWorx and requires shorter notice. Nothing in this QSOA permits a use or disclosure that an applicable state law forbids.
2.4 Program that is not a covered entity. If no BAA is in force between the Parties, the Parties will execute the BAA regardless, and it applies by contract for this QSOA’s purposes, with “Customer” meaning the Program and “PHI” meaning Part 2 Records.
These acknowledgements are made under 42 C.F.R. § 2.11 (definition of “qualified service organization,” paragraph (2)).
3.1 Bound by Part 2. LatentWorx acknowledges that in receiving, storing, processing, or otherwise dealing with any patient records from the Program, it is fully bound by the regulations in 42 C.F.R. Part 2.
3.2 Resisting judicial proceedings. LatentWorx, if necessary, will resist in judicial proceedings any efforts to obtain access to patient identifying information related to substance use disorder diagnosis, treatment, or referral for treatment except as permitted by the regulations in 42 C.F.R. Part 2. This Section 3.2 survives termination of this QSOA without limit of time.
3.3 Enforcement (for information only; creates no obligation). Under 42 C.F.R. § 2.3, violations of Part 2 are subject to the penalty provisions of the Social Security Act that apply to HIPAA violations (42 U.S.C. §§ 1320d-5 and 1320d-6), and the enforcement procedures of 45 C.F.R. Part 160, Subparts C, D and E, apply to Part 2 noncompliance.
4.1 Services. LatentWorx provides the Services described in Exhibit A: transcription of live sessions and import of existing session transcripts, AI drafting and clinician-approved revision of clinical notes, transcript-grounded clinical chat, storage, versioning and rollback of notes, clipboard export of notes by the clinician for entry into the Program’s own record system, and logging of access to notes.
4.2 Basis for disclosure. The Program discloses Part 2 Records to LatentWorx under 42 C.F.R. § 2.12(c)(4), which removes Part 2’s restrictions on use and disclosure from communications between a part 2 program and its qualified service organization of information the organization needs to provide services to or on behalf of the program. No separate patient consent is required for those communications. That exception applies only because LatentWorx has made the acknowledgements in Section 3; it covers only information LatentWorx needs to provide the Services; and it does not authorize any further disclosure by LatentWorx, which is limited to Section 5.1.
4.3 Minimum needed. The Program will send, and LatentWorx will request and use, only the Part 2 Records LatentWorx needs to provide the Services. LatentWorx will not request Part 2 Records beyond what a clinician captures or enters in the Services.
5.1 Permitted uses and disclosures. LatentWorx will use and disclose Part 2 Records only:
(a) to provide the Services to the Program, including any disclosure the Program directs in writing under Section 7.1;
(b) to the Subcontractors listed in Exhibit C, each acting for LatentWorx in providing the Services to the Program and bound as Section 8 requires, and only to the extent they need the records to support the Services. The Program authorizes these disclosures;
(c) as Required by Law, and then only in compliance with Section 6; and
(d) to LatentWorx’s legal counsel, forensic investigators and insurers, only as needed to investigate, respond to or defend a Security Incident, Breach or claim, and only after each has agreed in writing to be bound by Part 2 for those records.
5.2 No other redisclosure. LatentWorx will not redisclose any Part 2 Record, or any information identifying a person as a current or former patient of the Program, to any other person, including a patient’s family, employer, insurer or a government authority, except as Section 5.1 allows.
5.3 No model training. LatentWorx will not use Part 2 Records to train, fine-tune or improve any model, whether its own or a third party’s. Using Part 2 Records to operate, support, debug or secure the Services for the Program is not training, fine-tuning or improving a model. LatentWorx will engage a Subcontractor that processes Part 2 Records only under written terms that prohibit the same.
5.4 No de-identification. LatentWorx will not de-identify Part 2 Records for any purpose of its own.
5.5 Data location. LatentWorx stores and processes Part 2 Records only in AWS regions located in the United States, and requires each Subcontractor storing or processing such records to do the same. Transit of encrypted data, and connections a user initiates from outside the US, are not storage or processing. LatentWorx will not move storage or processing outside the US without the Program’s prior written consent.
5.6 No use against patients. LatentWorx will not use or disclose any Part 2 Record, or testimony describing its contents, to initiate or substantiate criminal charges against a patient or to conduct any criminal investigation of a patient, except under a court order meeting 42 C.F.R. § 2.65, consistent with 42 C.F.R. § 2.12(d)(1), which attaches that restriction to the record in the hands of whoever obtains it. More broadly, LatentWorx will not use or disclose any Part 2 Record in any civil, criminal, administrative or legislative proceeding against the patient unless the patient has consented in writing or a court has authorized it by an order meeting 42 C.F.R. § 2.64 or § 2.65. This Section survives termination without limit of time, and LatentWorx remains responsible for it for Part 2 Records in a Subcontractor’s possession.
6.1 No disclosure without a qualifying court order. A subpoena, warrant or other Legal Demand is not by itself enough to compel LatentWorx to disclose a Part 2 Record. LatentWorx will not disclose any Part 2 Record in response to a Legal Demand unless (a) a court has issued an order meeting 42 C.F.R. § 2.64 (non-criminal purposes) or § 2.65 (criminal investigation or prosecution of a patient), or Part 2 otherwise expressly permits the disclosure, and (b) unless the law or the order forbids that notice, the Program has been notified under Section 6.2. A disclosure compelled from LatentWorx or a Subcontractor by process that cannot lawfully be refused, made after LatentWorx has asserted Part 2 under Section 6.3, is not a breach of this QSOA.
6.2 Notice to the Program. LatentWorx will notify the Program in writing of any Legal Demand within two (2) business days after receiving it, unless the law forbids that notice. The notice will include a copy of the Legal Demand and the response deadline, so that the Program can respond, seek a protective order or take part in any proceeding under 42 C.F.R. § 2.64 or § 2.65.
6.3 Baseline steps at LatentWorx’s cost. In meeting Section 3.2, LatentWorx will, at its own cost:
(a) decline to produce any Part 2 Record unless Section 6.1 permits it;
(b) object in writing to the issuing party, citing Part 2;
(c) notify the Program under Section 6.2; and
(d) if a party applies to a court for an order under 42 C.F.R. § 2.64 or § 2.65, file a written objection asserting Part 2.
LatentWorx will cooperate reasonably with the Program’s own response and will disclose only what any qualifying order requires.
6.4 Steps beyond the baseline. Where a step beyond Section 6.3 is necessary to meet Section 3.2, including a court appearance, motion or appeal, LatentWorx will take it, acting reasonably after consulting the Program. The Program reimburses LatentWorx’s reasonable outside-counsel fees for any step beyond that baseline, except where the demand arises from LatentWorx’s own breach. This Section allocates cost only; it does not condition or limit Section 3.2.
7.1 Consent-based disclosures. Under 42 C.F.R. § 2.32(a), the redisclosure notice is required for disclosures made with the patient’s written consent. If the Program directs LatentWorx in writing to disclose a Part 2 Record to a third party on the basis of the patient’s written consent, LatentWorx will accompany that disclosure with one of the written statements in 42 C.F.R. § 2.32(a), as set out in Exhibit E, and with a copy of the consent or a clear explanation of its scope, as 42 C.F.R. § 2.32(b) requires. LatentWorx will not make a consent-based disclosure until the Program has supplied the consent or that explanation. Transfers to Subcontractors under Section 8 are governed by Section 8 and are not disclosures under this Section 7.
7.2 Export surfaces. The Program decides whether and when an export is a disclosure requiring the § 2.32 notice, and attaches it today. LatentWorx will display Statement 2 (Exhibit E) on export surfaces listed in Exhibit E § 2.2 whose status reads “implemented,” and will notify the Program in writing when a surface becomes implemented. No date is promised for any surface not yet implemented.
7.3 Text of the statements. The statements LatentWorx must use are set out in Exhibit E. If the regulation’s text changes, Section 14 applies.
8.1 Written agreement first. LatentWorx will not permit a Subcontractor to create, receive, maintain or transmit PHI or Part 2 Records unless it has first agreed in writing to the same restrictions and conditions that apply to LatentWorx under the BAA, and for Part 2 Records as Section 8.2 of this QSOA provides (45 C.F.R. §§ 164.504(e)(2)(ii)(D), 164.502(e)(1)(ii), 164.308(b)(2), 164.504(e)(5)). LatentWorx represents that, as of the Effective Date, each Exhibit C Subcontractor has executed such an agreement, stated with its date in Exhibit C. LatentWorx will not accept PHI or Part 2 Records until this is true.
8.2 What the agreement must contain. For Section 8.1:
(a) a Subcontractor that is itself a HIPAA business associate for the service it provides meets Section 8.1 through a written subcontract that meets the HIPAA sections cited there, binding it to the same restrictions and conditions that apply to LatentWorx with respect to the PHI, including Part 2 Records that are PHI; and
(b) a Subcontractor that is not a HIPAA business associate must also have a written contract meeting 42 C.F.R. § 2.33(c): it binds the Subcontractor to Part 2, gives it the § 2.32 notice, requires safeguards and breach reporting, limits disclosure to what is necessary, and bars further redisclosure.
LatentWorx does not represent that any Subcontractor has signed terms specific to Part 2 unless Exhibit C says so. LatentWorx itself keeps the duties in Sections 3.2, 5.6 and 6 for Part 2 Records in a Subcontractor’s possession.
8.3 New Subcontractors. LatentWorx will update Exhibit C and notify the Program as BAA Section 5.3 provides before adding a Subcontractor that will receive Part 2 Records. No Part 2 Record will reach a newly noticed Subcontractor before that notice period ends or the Program consents in writing, and the Program has the objection and termination rights BAA Section 5.3 gives Customer.
8.4 Responsibility. LatentWorx is responsible to the Program for each Subcontractor’s handling of Part 2 Records to the same extent the BAA makes it responsible for PHI.
9.1 Written security policies. LatentWorx will have in place, before it first receives Part 2 Records, formal written policies and procedures to protect Part 2 Records, as 42 C.F.R. § 2.16(a) requires. They will cover Part 2 Records in paper and electronic form and address: creating, receiving, maintaining and transmitting records; transferring and removing records; destroying records, including sanitizing the media on which they were stored so that Patient Identifying Information cannot be retrieved; secure storage of records and of the media that hold them; access controls for using and accessing records, workstations and storage; and de-identification to the standard of 45 C.F.R. § 164.514(b). The safeguards in BAA Section 3.2 and Exhibit B are the controls those policies put in place. LatentWorx will give the Program a copy of those policies on written request.
9.2 Incidents and Breaches. 42 C.F.R. § 2.16(b) applies the HIPAA breach notification provisions to breaches of unsecured Part 2 records in the same manner as to breaches of unsecured protected health information. LatentWorx will therefore report Security Incidents and Breaches involving Part 2 Records under BAA Section 4 and Exhibit D, within the notice periods BAA Section 4 sets. Those periods run from the Actual Knowledge Date as the BAA defines it, and every notice of a Breach is in any case given within the period 45 C.F.R. § 164.410 requires, measured from Discovery. LatentWorx will also tell the Program that the affected records are Part 2 Records, so that the Program can meet any Part 2 obligations of its own.
9.3 Unauthorized use or disclosure. LatentWorx will report to the Program any use or disclosure of a Part 2 Record that this QSOA does not permit, even if it is not a Breach, within the periods, and counted from the dates, that BAA Section 4.3A sets for reporting uses or disclosures not provided for by the BAA.
10.1 Records available to the Program. For a management audit, financial audit or program evaluation under 42 C.F.R. § 2.53, the Program will first use the Services’ own export features. On the Program’s written request, LatentWorx will provide any further Part 2 Records it holds for the Program, in a reasonable electronic form and within a reasonable time, at the Program’s reasonable cost.
10.2 Auditors reviewing Part 2 Records held by LatentWorx. LatentWorx will allow an auditor or evaluator to review Part 2 Records while they are in LatentWorx’s possession only if the Program has authorized the review in writing and has confirmed to LatentWorx in writing each of the following.
(a) The track. Whether the review is (i) a review without the records being downloaded, copied, removed or forwarded to another electronic system or device (42 C.F.R. § 2.53(a)); (ii) a review in which records are copied, removed, downloaded or forwarded (42 C.F.R. § 2.53(b)); or (iii) a Medicare, Medicaid or Children’s Health Insurance Program audit or evaluation (42 C.F.R. § 2.53(e)).
(b) Who the auditor acts for. An “Eligible Sponsor” is: (i) a federal, state or local governmental agency that provides financial assistance to the Program or is authorized by law to regulate its activities; (ii) a person that provides financial assistance to the Program, that is a third-party payer or health plan covering patients in the Program, or that is a quality improvement organization performing a quality improvement organization review, or the contractors, subcontractors or legal representatives of such a person or organization; or (iii) an entity with direct administrative control over the Program. The Program must confirm:
(c) The auditor’s written agreement. That, before the review, the auditor agreed in writing: on track (a)(i), to comply with the limits in Section 10.2(d); on tracks (a)(ii) and (a)(iii), to maintain and destroy the Patient Identifying Information consistently with the policies and procedures established under 42 C.F.R. § 2.16, to retain records in compliance with applicable federal, state and local record retention laws, and to comply with the limits in Section 10.2(d). The Program, not LatentWorx, obtains and keeps that agreement on file, and gives LatentWorx a copy before the review.
(d) The limits on the auditor (42 C.F.R. § 2.53(e) and (f)). On tracks (a)(i) and (a)(ii), two separate limits bind the auditor, and both apply (42 C.F.R. § 2.53(f)):
On track (a)(iii), neither limit above applies; 42 C.F.R. § 2.53(e)(5) and (e)(6) govern instead. The auditor may not use or disclose the Patient Identifying Information for any purpose other than those necessary to complete the audit or evaluation, and may further use or disclose it to its contractors, subcontractors or legal representatives to carry out the audit or evaluation.
10.3 Cost. Review under Section 10.2 that LatentWorx must support beyond giving access through the Services is at the Program’s reasonable cost.
10.4 Audits of LatentWorx itself. Audits of LatentWorx’s own controls, rather than of the Program’s records, are governed by BAA Section 11, including its frequency and cost limits.
11.1 The Program decides. The Program, not LatentWorx, decides whether any record it creates in the Services is a Part 2 Record, whether it is an SUD Counseling Note, and which consent applies to it.
11.2 The test. Under 42 C.F.R. § 2.11, a record is an SUD Counseling Note only if all three of the following are true:
(a) it is recorded, in any medium, by a provider of the Program who is an SUD or mental health professional;
(b) it documents or analyzes the contents of conversation during a private SUD counseling session or a group, joint or family SUD counseling session; and
(c) it is kept separated from the rest of the patient’s SUD and medical record.
Even then, the definition does not include medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, or any summary of diagnosis, functional status, the treatment plan, symptoms, prognosis or progress to date.
11.3 Consent and LatentWorx’s handling. LatentWorx does not designate any feature of the Services for SUD Counseling Notes, and treats records in the Services as part of the patient’s ordinary clinical record unless the Program notifies LatentWorx in writing that it will use the Services for SUD Counseling Notes. If the Program does so, the Program is responsible for obtaining the separate patient consent 42 C.F.R. § 2.31(b) requires for any use or disclosure of SUD Counseling Notes that needs it. That consent cannot be combined with consent for any other records except another consent for SUD Counseling Notes, and a single consent for treatment, payment and health care operations does not cover them. LatentWorx will not use or disclose a record the Program has identified as an SUD Counseling Note except to provide the Services to the Program.
11.4 Deletion after export. On the Program’s written instruction, LatentWorx will delete the session transcript and draft notes for a session once the clinician has exported the final note, within the period and subject to the backup terms BAA Section 9.4 sets for deletion requests during the term. Encrypted backups expire on their normal schedule, within thirty (30) days after active-system destruction.
12.1 The Program represents that it is a part 2 program under 42 C.F.R. Part 2, and will tell LatentWorx promptly if that changes.
12.2 For each disclosure to LatentWorx, the Program either relies on 42 C.F.R. § 2.12(c)(4) (Section 4.2) or has the patient’s written consent that Part 2 requires. Where the Program’s patient consent forms use a single consent for treatment, payment and health care operations under 42 C.F.R. § 2.31(a)(4)(i), the Program is responsible for their content and for keeping them on file.
12.3 The Program will not ask LatentWorx to use or disclose any Part 2 Record in a way Part 2 or this QSOA forbids.
12.4 The Program will notify LatentWorx in writing, promptly, of any patient’s revocation of consent, or any restriction the Program has agreed to, that affects how LatentWorx may use or disclose Part 2 Records it holds. LatentWorx will comply from the time it receives the notice.
12.5 The Program is responsible for giving its patients any notice that their sessions are transcribed and documented with AI assistance, as its own law and policies require.
12.6 Reliance. LatentWorx may rely on the Program’s classification of records under Section 11 and on the consents and notices the Program represents it holds. LatentWorx is not in breach of this QSOA for a use or disclosure the Program directed, or for one that results from the Program’s failure to meet Section 11 or this Section 12.
12.7 Support for patient requests. Within the period BAA Section 6.3 sets for accounting requests, after the Program’s written request, LatentWorx will give the Program the information it holds that the Program needs to respond to a patient’s request under Part 2 for an accounting of disclosures or for a restriction on disclosures.
13.1 Term. This QSOA starts on the Effective Date and continues until the BAA terminates or this QSOA is terminated under Section 13.2. The Sections listed in Section 15.3 then survive as that Section provides.
13.2 Termination. Either Party may terminate this QSOA on the grounds, and by the process, BAA Section 8 sets for termination of the BAA, applied to breaches of this QSOA. Termination of the BAA terminates this QSOA, and termination of this QSOA for a material breach is grounds to terminate the BAA. On termination LatentWorx stops receiving new Part 2 Records.
13.3 Return and destruction. The Program has thirty (30) days after termination to export its Part 2 Records. LatentWorx will complete destruction within thirty (30) days after that period ends, or sooner once the Program confirms in writing that export is complete, and in any case within thirty (30) days after that confirmation. On termination, LatentWorx will return or destroy Part 2 Records as BAA Section 9 provides, so that, except as Section 13.4 permits, no Part 2 Record remains with LatentWorx or any Subcontractor. LatentWorx will give the Program the certificate described in BAA Section 9.2, identifying the Part 2 Records destroyed and any held under Section 13.4.
13.4 Where return or destruction is infeasible. If returning or destroying a Part 2 Record is infeasible, LatentWorx will tell the Program which records and why. It will keep protecting them under this QSOA and limit any further use or disclosure to the purpose that makes return or destruction infeasible, for as long as it holds them. Return or destruction is infeasible, and this Section applies, for:
(a) entries in append-only audit and access logs, and disclosure records LatentWorx keeps to meet BAA Section 6.3 or another legal obligation, for the period that obligation requires, after which LatentWorx will destroy them; and
(b) encrypted backups, until they expire on LatentWorx’s normal backup cycle, within thirty (30) days after active-system destruction.
14.1 The Parties will amend this QSOA as needed to keep it compliant with Part 2 as it changes, including any further amendment of 42 C.F.R. Part 2 after the February 16, 2024 final rule. Either Party may propose an amendment by written notice.
14.2 If the Parties have not agreed a needed amendment within sixty (60) days after the proposal, either Party may terminate this QSOA and the BAA on written notice. Until then, each Party will comply with Part 2 as amended, and this QSOA will be read to permit that.
15.1 No third-party beneficiaries. Nothing in this QSOA gives any person other than the Parties any right or remedy, including patients.
15.2 Notices. Notices under this QSOA must be in writing and sent by email. Notices to the Program are also sent with a copy by mail or courier:
Security Incident, Breach and Legal Demand notices may be given by email alone, and are effective when sent.
15.3 Survival. Sections 3.2 and 5.6 survive termination without limit of time. Sections 2, 3, 5, 6, 7, 8, 9, 10.2, 11.3, 12.4, 13.3, 13.4 and this Section 15 otherwise survive termination for as long as LatentWorx or any Subcontractor holds any Part 2 Record. Section 2.1(h) also survives as to claims arising before termination.
15.4 Interpretation. Any ambiguity is resolved in favor of the meaning that lets both Parties comply with Part 2.
15.5 Governing law and venue. This QSOA is governed by federal law, and otherwise by the laws of the State of Delaware, without regard to conflict-of-laws rules. Venue is as the BAA provides.
15.6 Amendment and waiver. Except under Section 14, this QSOA may be amended only in a writing signed by both Parties. A waiver is effective only in writing.
15.7 Electronic signature and counterparts. This QSOA may be signed electronically and in counterparts, each of which is an original and all of which together are one agreement.
15.8 Entire agreement. This QSOA, the BAA and the Underlying Agreement are the Parties’ entire agreement on their subject matter.
Acceptance by the Program. The Program accepts this QSOA electronically through the Services. Acceptance by [[CUSTOMER_SIGNATORY_NAME]], [[CUSTOMER_SIGNATORY_TITLE]], on the date LatentWorx’s records show for that acceptance, binds the Program. That date is the Effective Date.
LatentWorx. LatentWorx offers this QSOA through the Services and is bound by it when it makes the Services available to the Program after that acceptance. No separate signature by LatentWorx is required.
References to signing. In this QSOA and Exhibit E, a reference to an agreement being signed or executed, to a signature page or to a date of signature means its acceptance in this way and the date of that acceptance.
This Exhibit E ("Exhibit E") forms part of the QSOA above, the Qualified Service Organization Agreement between LatentWorx, Ltd. ("LatentWorx") and [[CUSTOMER_LEGAL_NAME]] (the “Program”). It sets out the redisclosure notice text required by 42 C.F.R. § 2.32 and the surfaces of the Services where LatentWorx displays it. “Customer” means the “Program” under the QSOA, where applicable. Capitalized terms not defined here have the meanings given in the QSOA.
1.1 Under 42 C.F.R. § 2.32(a), each disclosure made with the patient’s written consent must be accompanied by one of the two statements below. The statements are reproduced exactly as codified (current eCFR text; 89 Fed. Reg. 12626, Feb. 16, 2024).
This record which has been disclosed to you is protected by Federal confidentiality rules (42 CFR part 2). These rules prohibit you from using or disclosing this record, or testimony that describes the information contained in this record, in any civil, criminal, administrative, or legislative proceedings by any Federal, State, or local authority, against the patient, unless authorized by the consent of the patient, except as provided at 42 CFR 2.12(c)(5) or as authorized by a court in accordance with 42 CFR 2.64 or 2.65. In addition, the Federal rules prohibit you from making any other use or disclosure of this record unless at least one of the following applies:
(i) Further use or disclosure is expressly permitted by the written consent of the individual whose information is being disclosed in this record or as otherwise permitted by 42 CFR part 2.
(ii) You are a covered entity or business associate and have received the record for treatment, payment, or health care operations, or
(iii) You have received the record from a covered entity or business associate as permitted by 45 CFR part 164, subparts A and E.
A general authorization for the release of medical or other information is NOT sufficient to meet the required elements of written consent to further use or redisclose the record (see 42 CFR 2.31).
“42 CFR part 2 prohibits unauthorized use or disclosure of these records.”
1.2 Copy of the consent. 42 C.F.R. § 2.32(b) provides:
(b) Each disclosure made with the patient’s written consent must be accompanied by a copy of the consent or a clear explanation of the scope of the consent provided.
2.1 Who decides, and who attaches. Under 42 C.F.R. § 2.32(a), the notice is required for disclosures made with the patient’s written consent. The Program decides whether and when an export is a disclosure requiring the § 2.32 notice, and attaches it today. LatentWorx will display Statement 2 on export surfaces listed in Section 2.2 whose status reads “implemented,” and will notify the Program in writing when a surface becomes implemented. No date is promised for any surface not yet implemented. At any surface not marked “implemented,” the Program attaches the statement through its own process; the text in Section 1 is provided for that purpose. Where the Program needs Statement 1 rather than Statement 2, or a copy of the consent under Section 1.2, the Program attaches it.
2.2 Surfaces.
| Surface | Status |
|---|---|
| Export or clipboard copy of a note | Not implemented |