Customer PHIPA Canada

NexHealth PHIPA Agent Agreement‍

Version: November 1st, 2026 (Latest)

‍

This PHIPA Agent Agreement (“DPA”) is incorporated by reference into the NexHealth Provider Terms (Canada). To the extent of any conflict between this DPA and any other provision of the Agreement, this DPA will govern with respect to PHI. This DPA applies to the extent you are a health information custodian under PHIPA (“Custodian”) or are authorized to engage NexHealth on behalf of a Custodian, and NexHealth acts as an Agent of that Custodian under PHIPA.

1. DEFINITIONS

“Personal Health Information” or “PHI” means personal health information, as defined in section 4 of PHIPA, that NexHealth collects, receives, creates, uses, discloses, maintains, or otherwise handles as an agent of a Custodian in connection with the NexHealth Services.“PHIPA” means Ontario’s Personal Health Information Protection Act, 2004 and its regulations, as amended.Other capitalized terms used in this DPA without definition have the respective meanings given to such terms under PHIPA or the Agreement, as applicable.

2. USE AND DISCLOSURE OF PHI
   1. Agent Relationship. NexHealth acts as an Agent of the applicable Custodian under PHIPA with respect to PHI handled in connection with the NexHealth Services and, in that capacity, will collect, use, disclose, retain and dispose of PHI only on behalf of, and for the purposes of, the applicable Custodian and not for NexHealth’s own purposes, in accordance with this DPA and section 17 of PHIPA (including any conditions or restrictions imposed under Section 7.3 below).
   2. Permitted Uses and Disclosures. You authorize NexHealth to collect, use, disclose, retain, and dispose of PHI as necessary to provide, operate, maintain, support, secure, and administer the NexHealth Services, including carrying out your instructions and transferring or making disclosures of PHI on the Custodian's behalf to third parties you authorize. You also authorize NexHealth, acting as the applicable Custodian's Agent, to use PHI to create Deidentified Data by de-identifying PHI on the Custodian’s behalf in a manner consistent with Part II of PHIPA. NexHealth shall not re-identify or attempt to re-identify de-identified information derived from PHI pursuant to this DPA, except as permitted by PHIPA, and shall require any third party to which it discloses Deidentified Data to agree not to re-identify or attempt to re-identify it. NexHealth will not otherwise use or disclose PHI except as authorized by you in accordance with this DPA and PHIPA, or as required by law or otherwise permitted for agents under PHIPA.
   3. Subcontractors. You authorize NexHealth to engage affiliates, subcontractors, and other service providers to assist in providing the NexHealth Services, including by accessing or otherwise handling PHI as necessary for that purpose. NexHealth shall require any such person with access to PHI to agree in writing to confidentiality, security, and use restrictions that are no less protective of PHI than those in this DPA. For clarity, a Third-Party Service that accesses PHI at your direction (including a developer that accesses PHI through the NexHealth API) is not a subcontractor of NexHealth for purposes of this DPA. You acknowledge that NexHealth and its subcontractors may store and access PHI outside Ontario and Canada.
3. SAFEGUARDS FOR PHI
   1. Adequate Safeguards. NexHealth shall maintain reasonable administrative, physical, and technical safeguards appropriate to the sensitivity of PHI to protect against theft, loss, and unauthorized access, use, disclosure, copying, modification, or disposal, including the safeguards applicable under the Agreement. On your reasonable request, NexHealth will provide information reasonably necessary to demonstrate its compliance with this DPA, which may include summaries of its then-current third-party security audit reports.
   2. Access to PHI. NexHealth shall limit access to PHI by its personnel to those who require access in connection with activities authorized under this DPA and who are subject to appropriate confidentiality obligations and have been informed of their duties with respect to PHI.
4. REPORTING OF UNAUTHORIZED USES AND DISCLOSURES
   1. Notification. NexHealth shall notify you at the first reasonable opportunity after becoming aware that PHI handled on behalf of the Custodian has been stolen or lost, or used or disclosed without authority, as required by PHIPA, and shall take commercially reasonable steps to contain the incident and mitigate its effects. Where PHIPA requires notice directly to a Custodian other than you, NexHealth shall provide such notice as required by law.
   2. Cooperation. NexHealth shall provide reasonably available information concerning an incident described in Section 4.1 and reasonable cooperation to assist the applicable Custodian in meeting its obligations under PHIPA. You or the applicable Custodian remain responsible for determining and making notifications required of a Custodian to individuals, regulators, or other persons, except to the extent applicable law requires NexHealth to provide such notifications.
5. INDIVIDUAL RIGHTS
   1. Customer Responsibilities. You or the applicable Custodian are responsible for responding to requests for access to or correction of PHI, maintaining records in accordance with applicable law, and otherwise fulfilling the applicable Custodian’s obligations under PHIPA. Unless otherwise expressly agreed in the Agreement, NexHealth does not maintain a primary clinical system of record for you or the applicable Custodian.
   2. Assistance. NexHealth will provide reasonable assistance to you in addressing such requests through the functionality of the NexHealth Services and its existing support processes. NexHealth will promptly refer requests for access to or correction of PHI that it receives directly from individuals to you or the applicable Custodian for response.
6. TERM AND TERMINATION; RETURN OR DESTRUCTION OF PHI
   1. Term and Termination. This DPA remains in effect for so long as NexHealth handles PHI in connection with the Agreement, subject to any provisions that expressly survive termination or expiration. The parties’ termination rights and remedies are governed by the Agreement.
   2. Return, Retention, and Destruction. Upon termination or expiration of the Agreement, NexHealth shall return or destroy PHI except that you authorize NexHealth to retain PHI as necessary to perform its continuing duties as agent, including maintaining records (such as audit logs) reasonably necessary to demonstrate compliance with this DPA and PHIPA and retention in routine backups pending deletion in accordance with NexHealth’s standard backup deletion cycle, or as required by applicable law, in each case only for as long as necessary for that purpose and in accordance with PHIPA. The protections of this DPA shall continue to apply to PHI for so long as NexHealth retains it. NexHealth will destroy PHI in a manner such that its reconstruction is not reasonably foreseeable in the circumstances.
7. OBLIGATIONS OF CUSTOMER
   1. Compliance and Authority. You shall comply with PHIPA and other applicable law in connection with your use of the NexHealth Services and your instructions and authorizations to NexHealth. You represent and warrant that you are the applicable Custodian or are authorized by each applicable Custodian to engage NexHealth as its agent and to bind it to this DPA, and that each such Custodian is lawfully authorized to permit the activities contemplated by this DPA. You shall not direct NexHealth to handle PHI in a manner that would violate PHIPA if undertaken by the applicable Custodian. If you are not the Custodian, you enter into this DPA on your own behalf and on behalf of each applicable Custodian. On NexHealth’s request, you shall identify each such Custodian and provide reasonable evidence of your authority, and you shall promptly notify NexHealth if that authority ends or changes.
   2. Information Practices, Consents, and Permissions. You are responsible for ensuring that each applicable Custodian maintains the written public statement of information practices required by PHIPA (including a general description of the de-identification of PHI under Section 2.2 and the purposes for which the resulting Deidentified Data may be used), provides any required notices, and obtains and maintains any required consents or other permissions in connection with the NexHealth Services and the activities authorized by this DPA.  
   3. Changes and Restrictions. You shall promptly notify NexHealth of any withdrawal of consent, change in authorization, or other legally applicable restriction (including any express instruction from an individual that restricts the use or disclosure of their PHI) that affects NexHealth’s permitted handling of PHI. If NexHealth cannot reasonably implement a restriction through the NexHealth Services, NexHealth will notify you and may suspend the affected NexHealth Services.

‍