Business Associate Agreement

This draft does not take effect when PHI is transmitted. A customer-specific BAA takes effect only after both parties execute it on the effective date stated in that agreement. No PHI should be transferred before that agreement and required subcontractor agreements are in place.

Capitalized terms used but not defined in this BAA have the meanings assigned to them in HIPAA. “PHI” means Protected Health Information that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity.

Business Associate may use and disclose PHI only:

• To perform the Services for Covered Entity, as described in the underlying Terms of Service.
• For the proper management and administration of Business Associate, provided that any disclosure is required by law or made with reasonable assurances of confidentiality and notice of any breach.
• To carry out Business Associate’s legal responsibilities.
• For data aggregation services, as that term is defined at 45 CFR § 164.501.

Business Associate will not use or disclose PHI in any manner that would violate HIPAA if done by Covered Entity, except as permitted above.

Business Associate will implement and maintain administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of PHI, as required by the HIPAA Security Rule (45 CFR Part 164, Subpart C). Specific controls and any additional notice terms belong in the executed customer agreement.

Business Associate will report to Covered Entity:

• Any use or disclosure of PHI not permitted by the executed BAA of which it becomes aware, without unreasonable delay.
• Any Security Incident as defined by 45 CFR § 164.304, with the timing and content required by the Security Rule.
• Any Breach of Unsecured PHI under 45 CFR § 164.402, without unreasonable delay and no later than 60 days after discovery, in the form required by 45 CFR § 164.410.

Customer-specific notice terms must be reviewed and agreed in the executed BAA.

Business Associate will enter into written agreements with any Subcontractor that creates, receives, maintains, or transmits PHI on its behalf, requiring the Subcontractor to comply with the same restrictions, conditions, and requirements as the executed BAA. Current and proposed provider status is published at /sub-processors.

To the extent Business Associate maintains a Designated Record Set on behalf of Covered Entity, Business Associate will:

• Make PHI available to Covered Entity to fulfill an Individual’s right of access under 45 CFR § 164.524.
• Make PHI available for amendment, and incorporate amendments, as required by 45 CFR § 164.526.
• Document and make available the information needed to provide an accounting of disclosures, as required by 45 CFR § 164.528.

Business Associate will request, use, and disclose only the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure, or request, in accordance with 45 CFR § 164.502(b).

Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of Health and Human Services for purposes of determining Covered Entity’s compliance with HIPAA.

An executed BAA is effective as set out in Section 1 and continues until terminated. Either party may terminate this BAA for material breach if the breach is not cured within 30 days of written notice. If termination is not feasible, the non-breaching party may report the breach to the Secretary.

On termination of this BAA, Business Associate will, if feasible, return or destroy all PHI received from, or created or received on behalf of, Covered Entity that Business Associate still maintains, and will retain no copies. Where return or destruction is not feasible, Business Associate will extend the protections of this BAA to such PHI and limit further uses and disclosures to those purposes that make return or destruction infeasible, for as long as Business Associate maintains the PHI.

This BAA will be interpreted to permit compliance with HIPAA. Amendments to HIPAA that affect the rights and obligations of the parties are incorporated by reference on their effective date. Governing law must be set in the executed agreement.