Data Processing Addendum (DPA)

1. Scope & Role

Client = Controller

For applicable data protection laws, the Client acts as the Controller (or Covered Entity) of personal data and PHI.

VLMS = Processor / Business Associate

VLMS processes data only on documented instructions from the Client and for the purposes set out in the governing Statement of Work.

2. Categories of Data & Data Subjects

Patient demographic and contact information.
Protected Health Information (PHI) — clinical, coding, claims, and payment data — as defined under HIPAA.
Workforce identifiers of Client staff necessary to perform the services.
Technical logs and metadata generated during service delivery.

3. Processor Obligations

Process personal data and PHI solely on documented Client instructions.
Ensure authorized personnel are bound by confidentiality obligations and receive annual HIPAA training.
Implement and maintain the technical and organizational measures in Section 6.
Assist the Client in responding to data-subject requests and regulatory inquiries.
Promptly notify the Client of any Security Incident or Breach of Unsecured PHI per the HIPAA Breach Notification Rule and Article 33 GDPR (where applicable).

4. Subprocessors

VLMS may engage subprocessors to provide specialized components of the services. A current list of subprocessors is maintained and available on request. VLMS will give the Client prior written notice of any intended addition or replacement of subprocessors and will flow down materially equivalent data protection obligations.

5. International Transfers

Where personal data is transferred across borders, VLMS relies on appropriate safeguards — including EU Standard Contractual Clauses, the UK Addendum, and equivalent mechanisms — and applies supplementary measures as necessary based on a transfer impact assessment.

6. Security Measures

VLMS maintains an Information Security Management System aligned to ISO/IEC 27001:2022 and the HIPAA Security Rule, including:

Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
Role-based access controls, least-privilege provisioning, and MFA for all privileged accounts.
Network segmentation, endpoint protection, and centralized logging with 24×7 monitoring.
Vulnerability scanning, annual third-party penetration testing, and documented remediation tracking.
Documented incident response, business continuity, and disaster recovery plans — tested at least annually.

7–9. Audit Rights, Deletion & Liability

Audit Rights

VLMS makes available the information necessary to demonstrate compliance with this DPA, including third-party audit reports (e.g., SOC 2 Type II or ISO 27001). On reasonable notice and subject to confidentiality, the Client may audit relevant policies and controls.

Return or Deletion

On termination of the services, and at the Client's election, VLMS will return or securely delete all personal data and PHI in its possession, unless applicable law requires continued retention.

Liability

The liability provisions of the Master Services Agreement apply to this DPA, subject to any additional liability caps required by applicable law.

10. Contact

For DPA requests, subprocessor lists, or data-subject inquiries, contact our Privacy Officer at privacy@valiantlifecare.com or through our contact page.

This website content is provided for informational purposes and is subject to the terms of the Master Services Agreement and any separately signed agreement between you and Valiant Lifecare. See also our Privacy Policy and Security Trust Portal.

Data Processing Addendum