BUSINESS ASSOCIATE AGREEMENT

QuickLinks -- Click here to rapidly navigate through this document

Exhibit 10.224

This Business Associate Agreement ("Agreement"), effective September 27, 2004 ("Effective Date"), is entered into by and among Nuestra Familia Medical Group, Inc., a California professional corporation ("Covered Entity") and Residential Funding Corporation, a Delware corporation ("Business Associate") (each a "Party" and collectively the "Parties").

Business Associate provides certain services for Covered Entity ("Services") that involve the use and disclosure of Protected Health Information that is created or received by Business Associate from or on behalf of Covered Entity ("PHI"). The Parties are committed to complying with the Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. Part 160 and Part 164, Subparts A and E as amended from time to time (the "Privacy Rule"), under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). This Agreement sets forth the terms and conditions pursuant to which PHI shall be handled.

The Parties agree as follows:

1. DEFINITIONS

All capitalized terms used in this Agreement but not otherwise defined shall have the meaning set forth in the Privacy Rule.

2. PERMITTED USES AND DISCLOSURES OF PHI

2.1 Unless otherwise limited herein, Business Associate may:

(a) use or disclose PHI to perform functions, activities or Services for, or on behalf of, Covered Entity as requested by Covered Entity from time to time, provided that such use or disclosure would not violate the Privacy Rule if done by Covered Entity or the minimum necessary policies and procedures of Covered Entity;

(b) disclose PHI for the purposes authorized by this Agreement only: (i) to its employees, subcontractors and agents; (ii) as directed by this Agreement; or (iii) as otherwise permitted by the terms of this Agreement;

(c) use PHI in its possession to provide Data Aggregation Services to Covered Entity as permitted by 42 C.F.R. §164.504(e)(2)(i)(B);

(d) use PHI in its possession for proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate;

(e) disclose the PHI in its possession to third parties for the proper management and administration of Business Associate;

(f) use PHI to report violations of law to appropriate Federal and state authorities, consistent with 45 C.F.R. §164.502(j)(1); and

(g) use and/or disclose PHI, to the extent and in the manner permitted under 45 C.F.R. § 164.512.

2.2 All other uses of PHI not specifically authorized by this Agreement are prohibited.

3. RESPONSIBILITIES OF THE PARTIES WITH RESPECT TO PHI

3.1 Responsibilities of Business Associate. With regard to its use and/or disclosure of PHI, Business Associate shall:

(a) use and/or disclose the PHI only as permitted or required by this Agreement or as otherwise required by law;

(b) report to the privacy officer of Covered Entity, in writing, any use and/or disclosure of the PHI that is not permitted or required by this Agreement of which Business Associate becomes aware, within fifteen (15) business days of Business Associate's determination of the occurrence of such unauthorized use and/or disclosure;

(c) use commercially reasonable efforts to maintain the security of the PHI and to prevent use and/or disclosure of such PHI other than as provided herein;

(d) require all of its subcontractors and agents that receive, use, or have access to, PHI to agree to adhere to the same restrictions and conditions on the use and/or disclosure of PHI that apply to Business Associate pursuant to this Agreement;

(e) upon fifteen (15) business days' prior written request, make available all internal practices, records, books, agreements, policies and procedures and PHI relating to the use and/or disclosure of PHI to the Secretary for purposes of determining Covered Entity's compliance with the Privacy Rule;

(f) document disclosures of PHI and information related to such disclosure and, within fifteen (15) business days of receiving a written request from Covered Entity, provide to Covered Entity such information as is requested by Covered Entity to permit Covered Entity to respond to a request by an individual for an accounting of the disclosures of the individual's PHI in accordance with 45 C.F.R. § 164.528;

(g) subject to Section 4.4 below, return to Covered Entity within twenty-one (21) business days of the termination of this Agreement, the PHI in its possession and retain no copies, including backup copies;

(h) disclose to its subcontractors, agents or other third parties, and request from Covered Entity, only the minimum PHI necessary to perform or fulfill a specific function required or permitted hereunder; and

(i) if all or any portion of the PHI is maintained in a Designated Record Set:

(i) upon fifteen (15) business days' prior written request from Covered Entity, provide access to the PHI in a Designated Record Set to Covered Entity or, as directed by Covered Entity, the individual to whom such PHI relates or his or her authorized representative to meet a request by such individual under 45 C.F.R. § 164.524; and

(ii) upon fifteen (15) business days' prior written request from Covered Entity, make any amendment(s) to the PHI that Covered Entity directs pursuant to 45 C.F.R. § 164.526.

3.2 Responsibilities of Covered Entity. Covered Entity shall, with respect to Business Associate:

(a) provide Business Associate a copy of Covered Entity's notice of privacy practices ("Notice") currently in use;

(b) notify Business Associate of any limitations in the Notice pursuant to 45 C.F.R. § 164.520, to the extent that such limitations may affect Business Associate's use or disclosure of PHI;

(c) notify Business Associate of any changes to the Notice that Covered Entity provides to individuals pursuant to 45 C.F.R. § 164.520, to the extent that such changes may affect Business Associate's use or disclosure of PHI;

(d) notify Business Associate of any changes in, or withdrawal of, the consent or authorization of an individual regarding the use or disclosure of PHI provided to Covered Entity pursuant to 45 C.F.R. § 164.506 or § 164.508, to the extent that such changes may affect Business Associate's use or disclosure of PHI; and

(e) notify Business Associate, in writing and in a timely manner, of any restrictions on use and/or disclosure of PHI as provided for in 45 C.F.R. § 164.522 agreed to by Covered Entity, to the extent that such restriction may affect Business Associate's use or disclosure of PHI.

4. TERMS AND TERMINATION

4.1 Term. This Agreement shall become effective on the Effective Date and shall continue in effect unless terminated as provided in this Article 4. Certain provisions and requirements of this Agreement shall survive its expiration or other termination as set forth in Section 5.1 herein.

4.2 Termination. Either Covered Entity or Business Associate may terminate this Agreement and any related agreements if the terminating Party determines in good faith that the terminated Party has breached a material term of this Agreement; provided, however, that no Party may terminate this Agreement if the breaching Party cures such breach to the reasonable satisfaction of the terminating Party within fifteen (15) business days after the breaching Party's receipt of written notice of such breach.

4.3 Automatic Termination. This Agreement shall automatically terminate without any further action of the Parties upon the termination or expiration of Business Associate's representation of Covered Entity.

4.4 Effect of Termination. Upon termination or expiration of this Agreement for any reason, Business Associate shall return all PHI pursuant to 45 C.F.R. § 164.504(e)(2)(ii)(I) if, and to the extent that, it is feasible to do so. Prior to doing so, Business Associate shall recover any PHI in the possession of its subcontractors or agents. To the extent it is not feasible for Business Associate to return or destroy any portion of the PHI, Business Associate shall provide Covered Entity a statement that Business Associate has determined that it is infeasible to return or destroy all or some portion of the PHI in its possession or in possession of its subcontractors or agents. Business Associate shall extend any and all protections, limitations and restrictions contained in this Agreement to any PHI retained after the termination of this Agreement until such time as the PHI is returned to Covered Entity or destroyed.

5. MISCELLANEOUS

5.1 Survival. The respective rights and obligations of Business Associate and Covered Entity under the provisions of Sections 4.4, 5.1, 5.6, 5.7, 5.8, and 5.9, and Section 2.1 (solely with respect to PHI that Business Associate retains in accordance with Section 4.4 because it is not feasible to return or destroy such PHI), shall survive termination of this Agreement until such time as the PHI is returned to Covered Entity or destroyed. In addition, Section 3.1(i) shall survive termination of this Agreement, provided that Covered Entity determines that the PHI being retained pursuant to Section 4.4 constitutes a Designated Record Set.

5.2 Amendments; Waiver. This Agreement may not be modified, nor shall any provision hereof be waived or amended, except in a writing duly signed by authorized representatives of the Parties. A waiver with respect to one event shall not be construed as continuing, or as a bar to or waiver of any right or remedy as to subsequent events.

5.3 No Third Party Beneficiaries. Nothing express or implied in this Agreement is intended to confer, nor shall anything herein confer, upon any person other than the Parties and the respective successors or assigns of the Parties, any rights, remedies, obligations, or liabilities whatsoever.

5.4 Notices. Any notices to be given hereunder to a Party shall be made via U.S. Mail or express courier to such Party's address given below, and/or (other than for the delivery of fees) via facsimile to the facsimile telephone numbers listed below.

If to Business Associate, to:

GMAC-RFC Health Capital
0000 XX Xxxxxxx Xxxxxx
Xxxxx 000
Xxxxxxxx, XX 00000
Attn: Xxxx Xxxxxxxxx
Telephone: (000) 000-0000
Facsimile: (000) 000-0000
E-Mail: xxxx.xxxxxxxxx@xxxxxxx.xxx

and

GMAC-RFC Health Capital
0000 Xxxxxxxxxx Xxxx Xxxx.
Xxxxx 000
Xxxxxxxxxxx, XX 00000
Attn: Xxxxx Xxxxxx
Telephone: (000) 000-0000
Facsimile: (000) 000-0000
E-Mail: xxxxx.xxxxxx@xxxxxxx.xxx

If to Covered Entity, to:

c/o Prospect Medical Holdings, Inc.
0000 Xxxxxxx Xxxxxxx, Xxxxx 000
Xxxxxx Xxxx, Xxxxxxxxxx 00000
Attn: Xxxxxxx Xxxx, Executive Vice President
Telephone: (000) 000-0000
Facsimile: (000) 000-0000
E-Mail: xxxxxxx.xxxx@xxxxxxxxxxxxxxx.xxx

with a copy (which shall not constitute notice) to:

Xxxxxx & Xxxxxxx
0000 Xxxxxxx Xxxx Xxxx, Xxxxx 000
Xxx Xxxxxxx, Xxxxxxxxxx 00000
Attn: Xxxxxx X. Xxxxx
Telephone: (000) 000-0000
Facsimile: (000) 000-0000
E-Mail: xxxxxx@xxxxxxxxxxxxx.xxx

Each Party named above may change its address and that of its representative for notice by the giving of notice thereof in the manner hereinabove provided. Such notice is effective upon receipt of notice, but receipt is deemed to occur on next business day if notice is sent by FedEx or other overnight delivery service.

5.5 Counterparts; Facsimiles. This Agreement may be executed in any number of counterparts, each of which shall be deemed an original. Facsimile copies hereof shall be deemed to be originals.

5.6 Disputes. If any controversy, dispute or claim arises between the Parties with respect to this Agreement, the Parties shall make good faith efforts to resolve such matters informally. In the event

that such matters cannot be resolved informally, the matters shall be subject to arbitration, as described in Section 5.7.

5.7 Arbitration of Disputes.

(a) Any controversy or claim between Covered Entity and Business Associate arising out of or relating to this Agreement shall be submitted to binding arbitration and the Parties waive their rights to a jury trial. The arbitration shall be conducted in accordance with this Agreement, the Federal Arbitration Act and the Commercial Arbitration Rules of the American Arbitration Association, as in effect on the Effective Date of this Agreement ("AAA Rules"). In the event of a conflict, the provisions of the AAA Rules shall control, except where those Rules conflict with this Agreement, in which case this Agreement shall control.

(b) The arbitration shall be conducted before a panel of three arbitrators (all of whom shall be former state or federal judges, with at least five years judicial experience), regardless of the size of the dispute, to be selected as provided in the AAA Rules. The arbitration shall be commenced and held in the city and state in which Business Associate's office is located whose attorneys spent the most amount of time on the matter in dispute. Any issue concerning the location of the arbitration, the extent to which any dispute is subject to arbitration, the applicability, interpretation, or enforceability of these procedures, including any contention that all or part of these procedures are invalid or unenforceable, and any discovery disputes, shall be resolved by all of the arbitrators. No potential arbitrator may serve on the panel unless he or she has agreed in writing to be bound by these procedures. To the extent state law is applicable, the arbitrators shall apply the substantive law of the state in which Business Associate's office is located whose attorneys spent the most amount of time on the matter in dispute.

(c) Each Party shall, upon the written request of the other Party, promptly provide the other Party with copies of all documents on which the producing Party may rely in support of or in opposition to any claim or defense and a report of any expert whom the producing Party may call as a witness in the arbitration hearing. At the request of a Party, and upon the showing of good cause, the arbitrators shall have the discretion to order production by the other Party or by a third party of other documents relevant to any claim or defense. Each Party shall be entitled to depose a maximum of three witnesses, plus all experts designated to be witnesses at the arbitration. The depositions shall be held within thirty (30) days of the making of a request and shall be limited to a maximum of six hours per deposition. All objections are reserved for the arbitration hearing, except for objections based on privilege and proprietary or confidential information. Additional depositions or deposition hours may be ordered by the arbitrators upon a showing of good cause.

(d) All aspects of the arbitration shall be treated as confidential and neither the Parties nor the arbitrators may disclose the existence, content or results of the arbitration, except as necessary to comply with legal or regulatory requirements. Before making any such disclosure, a Party shall give written notice to all other Parties and shall afford such Parties a reasonable opportunity to protect their interests. The result of the arbitration shall be binding on the Parties and judgment on the arbitrators' award may be entered in any court having jurisdiction.

5.8 Choice of Law; Interpretation. This Agreement shall be governed by the laws of the state as determined under Section 5.7 of this Agreement; provided, however, that any ambiguities in this Agreement shall be resolved in a manner that allows Covered Entity to comply with the Privacy Rule.

5.9 LIMITATION OF LIABILITY. NO PARTY SHALL BE LIABLE TO ANY OTHER PARTY FOR ANY INCIDENTAL, CONSEQUENTIAL, SPECIAL, OR PUNITIVE DAMAGES OF ANY KIND OR NATURE, WHETHER SUCH LIABILITY IS ASSERTED ON THE BASIS OF CONTRACT, TORT (INCLUDING NEGLIGENCE OR STRICT LIABILITY), OR OTHERWISE, EVEN IF THE PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH LOSS OR

DAMAGES. Notwithstanding the above, nothing in this agreement is intended to or shall be construed to limit Business Associate's liability to a client for professional malpractice.

6. INDEMNIFICATION

6.1 Indemnification. The Parties agree to indemnify, defend and hold harmless each other and each other's respective employees, directors, officers, subcontractors, agents or other members of its workforce, each of the foregoing hereinafter referred to as "indemnified party," against all actual and direct losses suffered by the indemnified party and all liability to third parties arising from or in connection with any breach of this Agreement or of any warranty hereunder or from any negligence or wrongful acts or omissions, including failure to perform its obligations under the Privacy Regulation, by the indemnifying party or its employees, directors, officers, subcontractors, agents or other members of its workforce. Accordingly, on demand, the indemnifying party shall reimburse any indemnified party for any and all actual and direct losses, liabilities, lost profits, fines, penalties, costs or expenses (including reasonable attorneys' fees) which may for any reason be imposed upon any indemnified party by reason of any suit, claim, action, proceeding or demand by any third party which results from the indemnifying party's breach hereunder. The Parties' obligation to indemnify any indemnified party shall survive the expiration or termination of this Agreement for any reason.

[Signature Page Follows]

IN WITNESS WHEREOF, each of the undersigned has caused this Agreement to be duly executed in its name and on its behalf as of the Effective Date.