Ingram Micro Cloud Marketplace Reseller Business Associate Agreement
Last Modified July 14, 2017
THIS INGRAM MICRO CLOUD MARKETPLACE RESELLER BUSINESS ASSOCIATE AGREEMENT (the "Agreement") is entered into effective as of the date on which You accept this Agreement (the "Effective Date") by and between INGRAM MICRO INC., a Delaware company located at 3351 Michelson Drive, Suite 100 Irvine, California 92612-0697 ("Ingram Micro"); and the entity you represent ("Reseller").
Ingram Micro is in the business of, among other things, reselling and/or marketing third-party vendor ("Vendor") cloud-based services ("Third Party Services") through the Ingram Micro cloud marketplace at https://us.cloud.im (the "Ingram Micro Cloud Marketplace") and providing technical support to its resellers for the Third Party Services on behalf of Vendors. Reseller agrees that it is a Covered Entity or a Business Associate (both as defined below), it has ordered or will order Third Party Services on behalf of its customers from Ingram Micro through the Ingram Micro Cloud Marketplace, and its customers may transmit Protected Health Information (as defined below) using the Third Party Services. Reseller acknowledges that Ingram Micro and/or its Affiliates may incidentally receive or have incidental access to Protected Health Information as part of providing technical support services to Reseller on behalf of Vendor for Third Party Services ordered through the Ingram Micro Cloud Marketplace. Reseller and Ingram Micro are entering this Agreement to ensure that appropriate safeguards are in place with respect to Ingram Micro's incidental receipt and/or access to such Protected Health Information.
For clarity, Reseller represents and warrants that it is not an end customer, but is an entity that orders Third Party Services from Ingram Micro for reselling and/or marketing to another Reseller or an end customer.
BY ORDERING AND/OR USING THE THIRD PARTY SERVICES TO WHICH THIS AGREEMENT APPLIES, RESELLER ACKNOWLEDGES AND AGREES TO THIS AGREEMENT, AND YOU REPRESENT THAT YOU HAVE THE AUTHORITY TO LEGALLY BIND THE RESELLER TO THIS AGREEMENT. IF YOU DO NOT HAVE SUCH AUTHORITY, OR IF YOU DO NOT AGREE WITH THESE TERMS AND CONDITIONS, NEITHER YOU NOR RESELLER MAY USE THE SITE OR ANY SUCH THIRD PARTY SERVICE.
BY ORDERING AND/OR USING THE THIRD PARTY SERVICES TO WHICH THIS AGREEMENT APPLIES, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTAND, AND INTEND THAT RESELLER BE BOUND BY ALL OF THE TERMS, CONDITIONS, AND NOTICES CONTAINED HEREIN, JUST AS IF RESELLER HAD SIGNED THIS AGREEMENT. If You do not accept this Agreement, You and Reseller are not licensed or otherwise permitted to use the Third Party Services.
Ingram Micro may at any time modify the terms and conditions of this Agreement, or any part thereof. Except as otherwise stated herein, any modification to this Agreement shall be effective immediately after it initially is posted on the Site. Use of the Third Party Services to which this Agreement applies after any such modification will be conclusively deemed acceptance of such modification. If any modification is unacceptable, Reseller may terminate this Agreement, subject to the terms and conditions contained herein. The Agreement may not otherwise be amended except in a writing signed by a Reseller and Ingram Micro.
DEFINITIONS. The following terms, when capitalized, will have the meanings defined below.
"Affiliate" means, with respect to a party, any entity, whether incorporated or not, which is controlled by or under common control, either directly or indirectly, with that party.
"Breach Notification Rule" means the Breach Notification for Unsecured Protected Health Information Final Rule issued by HHS to implement certain requirements of the Health Insurance Portability and Accountability Act of 1996.
"Business Associate" shall have the same meaning as the term "business associate" in 45 CFR § 160.103 of HIPAA.
"Covered Entity" shall have the same meaning as the term "covered entity" in 45 CFR § 160.103 of HIPAA.
"Disclosure" shall have the same meaning as the term "disclosure" in 45 CFR § 160.103 of HIPAA.
"HIPAA" collectively means the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act enacted by the United States Congress, and their implementing regulations, including, without limitation, the Privacy Rule, the Breach Notification Rule, and the Security Rule.
"HHS" means the U.S. Department of Health and Human Services.
"Privacy Rule" means the Standards for Privacy of Individually Identifiable Health Information issued by HHS to implement certain requirements of the Health Insurance Portability and Accountability Act of 1996.
"Protected Health Information" shall have the same meaning as the term "protected health information" in 45 CFR § 160.103 of HIPAA, provided that it is limited to such protected health information that is received by Ingram Micro from, or created, received, maintained, or transmitted by Ingram Micro on behalf of, Vendor and/or Reseller.
"Security Rule" means the Security Standards for the Protection of Electronic Protected Health Information issued by HHS to implement certain requirements of the Health Insurance Portability and Accountability Act of 1996.
"Use" shall have the same meaning as the term "use" in 45 CFR § 160.103 of HIPAA.
SCOPE AND APPLICABILITY OF AGREEMENT.
If Reseller is a Covered Entity or a Business Associate and if its customers transmit, store or otherwise make available Protected Health Information in or through Third Party Services ordered by Reseller from Ingram Micro through the Ingram Micro Cloud Marketplace that are identified in the Ingram Micro Cloud Marketplace as HIPAA compliant ("Purchased Services"), agreements between Ingram Micro and Reseller that apply to Reseller's order and/or use of the Purchased Services ("Resale Agreements") will incorporate the terms of this Agreement. If there is any conflict between a provision in this Agreement applicable to Protected Health Information and a provision in such other agreement, this Agreement will control.
THIS AGREEMENT IS APPLICABLE AND LIMITED TO INGRAM MICRO AND ITS AFFILIATES' PROVISION OF SUPPORT SERVICES FOR THE PURCHASED SERVICES.
The parties agree that, to the extent Ingram Micro delegates its obligations or sublicenses its rights under the Resale Agreements to its Affiliates, this Agreement will enable Ingram Micro's Affiliates to Use and Disclose Protected Health Information in accordance with the terms and conditions herein. In such cases, references herein to "Ingram Micro" shall mean such Ingram Micro Affiliate.
PERMITTED USES AND DISCLOSURES.
Ingram Micro may Use or Disclose Protected Health Information to provide technical support services for the Purchased Services or to fulfill its obligations under the Resale Agreements.
Ingram Micro may Use or Disclose Protected Health Information as required by law.
Ingram Micro may not Use or Disclose Protected Health Information in a manner that would violate HIPAA, except for the specific Uses and Disclosures set forth in this Section 3.
Ingram Micro may Use Protected Health Information for the proper management and administration of Ingram Micro or to carry out its legal responsibilities. Ingram Micro may Disclose Protected Health Information for the proper management and administration of Ingram Micro or to carry out its legal responsibilities, provided the Disclosures are required by law, or Ingram Micro obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies Ingram Micro of any instances of which the confidentiality of the information has been breached.
Reseller shall not request Ingram Micro to Use or Disclose Protected Health Information in any manner that would not be permissible under HIPAA if done by Reseller.
RESPONSIBILITIES OF THE PARTIES.
To the extent Ingram Micro is acting as a Business Associate with respect to the Purchased Services, Ingram Micro will: (a) implement appropriate safeguards to prevent unauthorized Use or Disclosure of the Protected Health Information; (b) report to Reseller any Use or Disclosure of the Protected Health Information not provided for by this Agreement including, without limitation, incidents that constitute breaches of unsecured Protected Health Information; (c) ensure that any subcontractors it may engage that will have access to Protected Health Information will agree to the same restrictions and conditions that apply to Ingram Micro with respect to such information; and (d) make available its internal practices, records, and books relating to the Use and/or Disclosure of Protected Health Information received by Ingram Micro to the Secretary of the Department of Health and Human Services for purposes of determining Reseller's compliance with HIPAA, subject to attorney-client and other applicable legal privileges.
In all cases, Reseller will: (i) promptly notify Ingram Micro of any limitations in the notice of privacy practices of Reseller under HIPAA including, without limitation, 45 CFR 164.520, to the extent such limitation may affect Ingram Micro's Use or Disclosure of Protected Health Information; (ii) promptly notify Ingram Micro of any changes in, or revocation of, the permission by an individual to Use or Disclose his or her Protected Health Information, to the extent that such changes may affect Ingram Micro's Use or Disclosure of Protected Health Information; (iii) promptly notify Ingram Micro of any restriction on the Use or Disclosure of Protected Health Information that Reseller has agreed to or is required to abide by under HIPAA including, without limitation, 45 CFR 164.522, to the extent that such restriction may affect business associate's Use or Disclosure of Protected Health Information; (iv) not request Ingram Micro to use or Disclose Protected Health Information in any manner that would not be permissible under HIPAA if done by a Covered Entity (unless permitted by HIPAA for a Business Associate); (v) be responsible for implementing appropriate privacy and security safeguards to protect its Protected Health Information in compliance with HIPAA; (vi) not include Protected Health Information in information Reseller submits to Ingram Micro's technical support personnel through a technical support request or to community support forums.
TERM AND TERMINATION.
The term of this Agreement shall be effective as of the Effective Date and shall continue in effect until the Resale Agreements terminate or until this Agreement is terminated as otherwise provided herein.
Either party may terminate this Agreement if the other party has breached a material term of this Agreement and has not cured the breach within thirty (30) days after receiving written notice from the non-breaching party.
Ingram Micro may terminate this Agreement for any reason on thirty (30) days written notice.
Upon termination of this Agreement for any reason: (a) Reseller will ensure that no Protected Health Information is transmitted, stored or otherwise made available in or through the Purchased Services, or will stop using and will stop its customers from using the Purchased Services; and (b) Ingram Micro will stop providing technical support services in connection with the Purchased Services to the extent doing so would result in Ingram Micro Using or Disclosing Protected Health Information.
This Agreement will be construed and enforced in accordance with the laws of the State of California, exclusive of its conflicts of law provisions. Both parties consent to the jurisdiction and venue in the courts located in Orange County, California. The United Nations Convention on Contracts for the International Sale of Goods will not apply to this Agreement.
Except as otherwise provided herein, all notices shall be in writing and deemed given upon: (i) personal delivery; (ii) when received by the addressee if sent by a nationally recognized overnight courier (receipt requested); (iii) the second business day after mailing; or (iv) the first business day after sending by email, except that email shall not be sufficient for notices of termination or regarding a claim. Notices to Reseller will be sent to Reseller's email or postal address that Ingram Micro has on file. It is important that Reseller ensures its address information is up to date. Notices to Ingram Micro must be sent to:Ingram Micro Inc.
3351 Michelson Drive, Suite 100
Irvine, California, 92612-0697
United States of America
Attention: VP, Associate General Counsel
This Agreement constitutes the entire agreement between the parties regarding its subject matter. This Agreement supersedes and terminates any and all previous proposals, representations or statements, oral or written regarding its subject matter.
Unless a provision setting forth the rights or obligations of a party is expressly terminated as set forth in the specific language of the provision, the parties agree that all rights and obligations set forth in this Agreement, which by their nature or operation are considered material, will survive expiration or termination of this Agreement (e.g., indemnification, limitation of liability, warranties, etc.).
Each party is an independent contractor as to the other, no other relationship is created by this Agreement and neither party has any right to enter into agreements with third parties on behalf of the other.
Reseller will not assign or transfer this Agreement, whether by contract or by operation of law (such as merger or sale of Reseller's equity) without the express written consent of Ingram Micro. Ingram Micro may assign or transfer all or part of Ingram Micro's rights and obligations under this Agreement without Reseller's consent, but only to Ingram Micro's Affiliates or in connection with a merger or acquisition.
This Agreement is binding upon and will inure to the benefit of the parties hereto and their respective successors and permitted assigns.
The waiver by either party of a breach of any provision of this Agreement will not be a waiver of the provision itself or a waiver of any breach in the future, or a waiver of any other provision in this Agreement. Failure to require performance will not affect a party's right to require performance of that or any future duty.
If any provision in this Agreement is held to be invalid, illegal or unenforceable, that provision will be enforced to the fullest extent permitted by applicable law and the validity, legality and enforceability of the remaining provisions will not in any way be affected or impaired so long as the economic or legal substance of the transactions contemplated by this Agreement is not affected in any matter materially adverse to any party.