Business Associate Agreement (BAA)

Last Updated: 21 October 2026

This Business Associate Agreement (“BAA”) is effective as of the effective date of the Principal Agreement into which the DPA is incorporated (the “Effective Date”) and is by and between QVC Group, Inc. (“QVC”), in its role as plan sponsor acting on behalf of the group health plan components that are part of the Qurate Retail Group Master Welfare Plan (formerly known as the QVC Inc. Master Welfare Benefit Plan), all other applicable benefit plans sponsored by QVC and subject to HIPAA, and any successor of such plan(s) (collectively referred to herein as the “Plan”) and Vendor (“Business Associate”), together, the “Parties.” This BAA applies to, and governs, Business Associate’s Processing of Protected Health Information, and the applicable Data Processing Addendum or DPA applies to such Protected Health Information in addition to this BAA; if this BAA and the applicable Data Processing Addendum or DPA conflict with respect to Protected Health Information, this BAA shall control. QVC may update the version of this BAA published at the applicable URL from time to time, in accordance with the update provisions of the applicable Data Processing Addendum or DPA, including to reflect changes required by HIPAA or other applicable law, as provided in Section 4(a). Capitalized terms used but not defined in this BAA have the meaning given in the DPA. For the avoidance of doubt, where this BAA refers to Principal Agreement and Agreement, these shall have the meaning given in applicable Data Processing Addendum or DPA. QVC is a party to this BAA as plan sponsor acting on behalf of the Plan, irrespective of which QVC Group Company enters into the Principal Agreement with Business Associate.

WHEREAS, Business Associate has, with QVC or another QVC Group Company, entered into the Principal Agreement or Agreement as defined under the applicable Data Processing Addendum or DPA;

WHEREAS, the Plan is a Covered Entity as such term is defined under HIPAA (as defined below);

WHEREAS, Business Associate, on behalf of the Plan, may create, receive, maintain, transmit, use or disclose, Protected Health Information (as defined below) in the performance of its responsibilities and obligations under the Principal Agreement;

WHEREAS, the Parties intend to protect the privacy and provide for the security of the Protected Health Information disclosed by the Plan to Business Associate or accessed, created, received, transmitted, used or disclosed by Business Associate on behalf of the Plan;

WHEREAS, the Plan is required under HIPAA to enter into a Business Associate Agreement that meets certain requirements regarding Protected Health Information;

NOW, THEREFORE, in consideration of the mutual promises below and the exchange of information pursuant to this BAA and the Principal Agreement, the Parties, intending to be legally bound, hereby agree as follows:

Definitions

The following terms shall be defined as provided for in HIPAA, as applicable and as summarized below. If the definition of any of these terms in the statute or applicable regulations is amended, the definition of the term in this Section 1 shall be deemed amended accordingly.
1. "Breach" shall have the meaning given under 45 CFR § 164.402.
2. "Covered Entity" shall have the meaning given under 45 CFR § 160.103.
3. "Designated Record Set" shall have the meaning given such term under 45 CFR § 164.501. For purposes of this definition, the term “record” means any item, collection, or grouping of information that includes Protected Health Information and is maintained, collected, used or disseminated by or for the Plan.
4. "Electronic Protected Health Information" means Protected Health Information that is transmitted by or maintained in Electronic Media, limited to the information created, received, maintained, or transmitted by Business Associate from or on behalf of the Plan.
5. "Electronic Media" shall have the meaning given under 45 CFR § 160.103.
6. "HHS" means the United States Department of Health and Human Services.
7. "HIPAA" means the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations and guidance, each as amended from time to time.
8. "HIPAA Breach Notification Regulations" means the regulations promulgated under HIPAA by HHS regarding the notification requirements in the event of a Breach of Unsecured PHI set forth at 45 C.F.R. Part 164, as amended from time to time.
9. "HIPAA Privacy Regulations" means the regulations promulgated under HIPAA by HHS regarding the privacy of Protected Health Information set forth in 45 C.F.R. Part 164, as amended from time to time.
10. "HIPAA Security Regulations" means the regulations promulgated under HIPAA by HHS regarding the security of Electronic Protected Health Information set forth in 45 C.F.R. Part 164, as amended from time to time.
11. "Individual" means the person who is the subject of the Protected Health Information.
12. "Privacy Rule" means the HIPAA Privacy Regulations.
13. "Protected Health Information" has the meaning given to such term under 45 C.F.R. § 160.103, limited to information created, received, maintained or transmitted by Business Associate on behalf of the Plan. Protected Health Information includes Electronic Protected Health Information.
14. "Required by Law" shall have the meaning given under 45 CFR § 160.103.
15. "Secretary" means the Secretary of the Department of Health and Human Services.
16. "Security Incident" shall have the meaning given under 45 CFR § 164.304.
17. "Subcontractor" means a person to whom Business Associate delegates a function, activity or service, other than in the capacity as a member of the workforce of Business Associate.
18. "Unsecured PHI" shall have the meaning given to such term under 42 U.S.C. § 17932(h), 45 C.F.R. § 164.402, and guidance issued pursuant to the HITECH Act including, but not limited to the guidance issued on April 17, 2009 and published in 74 Federal Register 19006 (April 27, 2009) by the Secretary.
Obligations and Activities of Business Associate
1. Use or Disclosure. Business Associate agrees not to use or disclose Protected Health Information other than as expressly permitted or required by this BAA or as Required by Law. Except as otherwise limited in this BAA, Business Associate may use or disclose Protected Health Information for the following purposes, provided such use or disclosure of Protected Health Information would not violate the HIPAA Privacy Regulations if done by the Plan:
  1. Business Associate may use or disclose Protected Health Information to carry out the responsibilities and obligations of Business Associate under the Principal Agreement;
  2. Business Associate may use or disclose Protected Health Information for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided that such disclosure is Required By Law, or Business Associate obtains reasonable written assurances from the person to whom the information is disclosed that it will be held confidentially and used or further disclosed only as Required By Law or for the purpose for which it was disclosed to the person, and the person agrees to notify the Business Associate of any instances of which it is aware in which the confidentiality of the information is breached;
  3. Business Associate may use or disclose Protected Health Information to report violations of law to appropriate authorities, consistent with the HIPAA Privacy Regulations;
  4. Business Associate may disclose Protected Health Information to the Plan’s other business associates and to the Plan’s brokers or consultants in order for the brokers or consultants to conduct trend analysis, benefit planning, utilization review and/or other healthcare operation functions on behalf of the Plan; and
  5. if applicable, Business Associate may provide data aggregation services to the Plan consistent with the HIPAA Privacy Regulations.
2. Minimum Necessary. Business Associate agrees to make reasonable efforts to limit all uses or disclosures or requests for Protected Health Information to the minimum necessary to accomplish the intended purpose of the use, disclosure or request.
3. Safeguards. Business Associate agrees to use appropriate safeguards and comply with the requirements of the HIPAA Security Regulations including the implementation of appropriate administrative, physical and technical safeguards to protect the confidentiality, integrity and availability of all Electronic Protected Health Information and to prevent any use or disclosure of Protected Health Information other than uses and disclosures permitted or required by this BAA or as Required by Law.
4. Mitigation. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of this BAA.
5. Reporting. Business Associate agrees to report to the Plan any Security Incidents, Breaches, and any other use or disclosure of Protected Health Information in violation of this BAA by Business Associate or by a third party to which Business Associate disclosed Protected Health Information, promptly, but in no event later than forty-eight (48) hours after becoming aware of the Security Incident, Breach, use or disclosure. Business Associate further agrees to provide the Plan with any other available information that the Plan is required to disclose in accordance with the HIPAA Breach Notification Regulations, including on an ongoing basis in the event such information is not available when the initial notification is made. Business Associate shall take prompt corrective action to cure any deficiencies and will take any action pertaining to unauthorized disclosures, Security Incidents and Breaches required by applicable federal and state laws and regulations.
  Business Associate and the Plan recognize that certain situations are ambiguous in terms of whether they constitute a Breach. If Business Associate determines that the situation is a Breach, Business Associate shall notify the Plan of the situation, in accordance with this BAA. If Business Associate determines that the situation is not a Breach, but reasonably concludes that a reasonable person could reach the opposite conclusion, then Business Associate shall notify the Plan of the situation, so that the Plan can determine for itself whether a Breach occurred. The Business Associate will provide such notification in the time specified above, in this Section 2(e). This paragraph does not alter or limit Business Associate’s obligation to report any use or disclosure of Protected Health Information that is not permitted by this BAA, other than a Breach, as required by the HIPAA Breach Notification Regulations and this BAA.
  
  If directed by the Plan, Business Associate shall provide any reports or notices required by HIPAA as a result of Business Associate’s Breach. After the Plan’s review and approval, Business Associate will provide such reports or notices to any party or entity (including but not limited to media, the Secretary and individuals affected by the Breach) entitled by law to receive the reports or notices to the extent directed by the Plan. Business Associate shall provide the Plan proof that such reports or notices were timely distributed in accordance with HIPAA. Business Associate shall bear the full cost of such reports and notices. In addition, Business Associate shall reimburse the Plan's (or QVC's) reasonable costs and expenses including, but not limited to, any costs of mitigating the harm (which may include the costs of obtaining credit monitoring services and identity theft insurance, among other costs) for affected individuals whose Protected Health Information has or may have been compromised as a result of the Breach caused by Business Associate. This Section 2(e) shall be in addition to, and shall in no way limit, Business Associate's indemnification obligations set forth in Section 4(i) below.
  
  Notwithstanding the foregoing, the Parties acknowledge and agree that this Section 2(e) constitutes notice by Business Associate to the Plan of the ongoing occurrence of incidents that may constitute Security Incidents but that are trivial and do not result in unauthorized access, use, or disclosure of Protected Health Information that is Electronic Protected Health Information, including without limitation pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, and denials of services, for which no additional notice to the Plan shall be required.
6. Subcontractors. Business Associate agrees to enter into written business associate agreements with all of its Subcontractors that create, receive, maintain or transmit Protected Health Information on behalf of Business Associate and thereby require such Subcontractors to agree to the same or more stringent restrictions and conditions that apply to Business Associate under this BAA with respect to such Protected Health Information.
7. Access. Upon request from the Plan, Business Associate shall process and respond to a request by an Individual for access to such Individual’s Protected Health Information that is maintained by Business Associate in a Designated Record Set. The Processing and response shall occur within ten (10) days of such request by the Plan.
8. Amendment. Upon request from the Plan, Business Associate shall process a request by an Individual for amendments to such Individual’s Protected Health Information that is maintained by Business Associate in a Designated Record Set. The Processing and response shall occur within ten (10) days of such request by the Plan.
9. Audit and Inspection. Business Associate agrees to make its internal practices, books, and records, including policies and procedures and Protected Health Information, relating to the use and disclosure of Protected Health Information and the security of Electronic Protected Health Information, available to the Secretary or any officer or employee of HHS to whom the Secretary has delegated such authority for the purposes of determining the Plan’s and/or Business Associate’s compliance with HIPAA. Such information shall be made available in a time and manner designated by the Secretary or its delegate.
10. Documentation of Disclosures. Business Associate agrees to document such disclosures of Protected Health Information, and such information related to such disclosures, as would be required for the Plan to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with the HIPAA Privacy Regulations.
11. Accounting. Within ten (10) days of receipt of notice by or on behalf of the Plan that the Plan has received a request for an accounting of disclosures of Protected Health Information, Business Associate shall make available to the Plan such information as necessary to permit the Plan to respond to the request in accordance with the HIPAA Privacy Regulations.
12. Prohibition on Certain Activities. Business Associate shall not: (i) sell Protected Health Information (within the meaning of 45 C.F.R. § 164.508); (ii) use or disclose Protected Health Information for fundraising purposes (within the meaning of 45 C.F.R.§ 164.514); (iii) use or disclose Protected Health Information for research (within the meaning of 45 C.F.R.§ 164.512); (iv) use genetic information for underwriting purposes (within the meaning of 45 C.F.R.§ 164.514); or (v) use or disclose Protected Health Information for marketing purposes (within the meaning of 45 C.F.R.§ 164.508).
13. Restrictions. Business Associate agrees to notify the Plan of any requests by an Individual for restrictions on the use and disclosure of Protected Health Information, so that the Plan can determine whether to agree to the restriction request. The Plan shall provide Business Associate with any changes in, or revocation of, permission by an Individual to use or disclose Protected Health Information, if such changes affect Business Associate’s permitted or required uses and disclosures.
14. Duties of Business Associate. To the extent the parties agree that Business Associate will carry out directly one or more of the Plan's obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to the Plan in the performance of such obligations.
Term and Termination
1. Term. The term of this BAA shall begin on the Effective Date and shall end upon the termination of the Principal Agreement.
2. Termination for Breach. The Plan may terminate this BAA and the Principal Agreement if Business Associate has breached this BAA. Before terminating under this provision, the Plan shall provide Business Associate with twenty (20) days written notice of the existence of the breach and afford Business Associate an opportunity to cure such breach to the Plan’s reasonable satisfaction within the stated time period. Failure to cure the breach within such time period shall result in immediate termination of this BAA and the Principal Agreement.
3. Effect of Termination.
  1. Except as provided in the following paragraph, upon termination of this BAA, for any reason, Business Associate shall return or, upon written approval of Plan, destroy, within thirty (30) days all Protected Health Information within its possession or control, and all Protected Health Information that is in the possession or control of all Subcontractors or agents. Business Associate shall retain no copies of the Protected Health Information. Business Associate shall certify in writing to QVC that it has complied with its obligations under this Section 3(c)(i) (1) within 45 days after QVC's request for such certification, and in such certification, Business Associate shall disclose any applicable laws under which it is retaining Protected Health Information if Business Associate is retaining Personal Data.
  2. If Business Associate determines that returning or destroying the Protected Health Information is infeasible, Business Associate shall provide to the Plan notification of the conditions that make return or destruction infeasible. If the Plan agrees that return or destruction is infeasible, Business Associate shall extend the protections of this BAA to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such Protected Health Information. If it is not feasible, as determined by the Plan, for Business Associate to obtain from a Subcontractor or agent any Protected Health Information in the possession of the Subcontractor or agent, Business Associate must require the Subcontractor and/or agent to agree in writing to extend any and all protections, limitations, and restrictions in this BAA to the Subcontractors’ and/or agents’ use and disclosure of any Protected Health Information retained after termination of the BAA, and to limit any further uses and disclosures to the purposes that make the return of the Protected Health Information infeasible. To the extent applicable, the provisions of this Section 3(c)(ii) shall survive the expiration or termination of this BAA and the Principal Agreement.
Miscellaneous
1. Amendment. The Parties agree to take such action as is necessary to amend this BAA from time to time as is necessary for the Plan to comply with the requirements of applicable law. All amendments to this BAA shall be in writing. Where this BAA is published online and incorporated by reference, QVC may update it in accordance with the updated provisions of the applicable Data Processing Addendum, and such updates take effect as provided in that Addendum without the need for a signed amendment.
2. Interpretation. Any ambiguity in this BAA shall be resolved in favor of a meaning that permits the Plan to comply with applicable law.
3. No Third Party Beneficiaries. Nothing express or implied in this BAA is intended to confer, nor shall anything herein confer upon any person, other than QVC, the Plan, Business Associate, the Related Parties (solely with respect to Section 4(i)) and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.
4. Assignment. No assignment of rights or obligations under this BAA shall be made by either Party without the prior written consent of the other Party. This BAA shall be assigned together with, and only to the extent of a permitted assignment of, the Agreement, and may not be assigned separately from the Agreement.
5. Effect on Principal Agreement. Except as specifically required to implement the purposes of this BAA, or to the extent inconsistent with this BAA, all other terms of the Principal Agreement shall remain in force and effect. In the event of any inconsistency between the provisions of this BAA and the Principal Agreement, the provisions of this BAA shall control. Where Business Associate and the Plan (or QVC on its behalf) have previously executed a business associate agreement, this BAA replaces that agreement, with effect from the later of the Effective Date and the date this BAA is first published or incorporated by reference (and not retroactively), with respect to Protected Health Information Processed in connection with the Principal Agreement on or after that date (including Protected Health Information received before that date), unless the Principal Agreement expressly provides that the previously executed business associate agreement continues to apply.
6. Governing Law and Forum. This BAA and any claims arising hereunder or related hereto shall be governed by the laws of the Commonwealth of Pennsylvania, without regard to its conflicts of laws principles, and notwithstanding any governing law or forum provision of the Principal Agreement or the applicable Data Processing Addendum or DPA. Any dispute that cannot be solved by the parties in good faith shall be submitted to the state or federal courts located in the jurisdiction of the United States District Court in the Eastern District of Pennsylvania. Each party hereby consents to the jurisdiction of such courts and waives any objections it may have to such venue (including any defense of lack of personal jurisdiction) or any claim that such controversy or claim has been brought in an inconvenient forum.
7. Injunctive Relief. Business Associate acknowledges and agrees that unauthorized disclosure or use of Protected Health Information will cause irreparable harm and significant injury to the Plan that will be difficult to measure with certainty or to compensate through money damages. Accordingly, Business Associate agrees that injunctive or other equitable relief shall be appropriate in the event of any breach by Business Associate of any part or parts of this BAA, in addition to such other remedies as may be available at law.
8. Independent Contractor. Business Associate’s relationship to QVC and the Plan is that of an independent contractor, and not an agent.
9. Indemnification. Business Associate shall indemnify, defend, and hold the Plan, QVC, its affiliates, assignees and subsidiaries, and their respective officers, directors, employees, agents, and other representatives (together the Plan’s “Related Parties”) harmless from any actual or threatened legal or administrative action, claim, liability, penalty, fine, assessment, lawsuit, litigation, or other loss, expense, or damage, including without limitation any reasonable attorneys’ fees and costs, that the Related Parties may incur directly or indirectly resulting from any actions or omissions of Business Associate, including without limitation failure to perform its obligations under this BAA and any Breach of Unsecured PHI that was due to the use, access, disclosure, or failure to safeguard by Business Associate, its Subcontractor, agent or a related party. Business Associate’s obligation to indemnify the Related Parties shall survive the expiration or termination of this BAA and the Principal Agreement for any reason.
10. Hybrid Entity Status of the Plan. The Plan has group health plan components that are subject to HIPAA and non-group health plan components that are not subject to HIPAA. Accordingly, the Plan is a Hybrid Entity as defined in the HIPAA Privacy Regulations and the HIPAA Security Regulations. This BAA applies only to those group health plan components of the Plan and does not apply to any other benefit plan components of the Plan.