DRAFT – not in effect until the owner sets version 1.0 and an effective date.

Business Associate Agreement (Template)

Template notice. This document is a template. It is not an executed agreement. The executed instrument is delivered per Section 6 of the terms-of-service.md as part of an Enterprise Order Form. Customers that require a Business Associate Agreement request one via .

1. Purpose & Definitions

This Business Associate Agreement (“BAA”) supplements the underlying services agreement between (“Business Associate”) and the customer identified in the underlying agreement (“Covered Entity”). This BAA governs the parties’ respective obligations with respect to Protected Health Information (“PHI”) disclosed by Covered Entity to Business Associate.

Terms used but not defined in this BAA have the meanings given in the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”) and implementing regulations at 45 CFR Parts 160 and 164 (collectively, “HIPAA”).

• “HIPAA Privacy Rule” means 45 CFR Part 164, Subparts A and E.
• “HIPAA Security Rule” means 45 CFR Part 164, Subparts A and C.
• “HIPAA Breach Notification Rule” means 45 CFR Part 164, Subpart D.
• “Protected Health Information” or “PHI” has the meaning at 45 CFR 164.501, limited to information Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity.
• “Electronic PHI” or “ePHI” means PHI transmitted or maintained in electronic media.
• “Covered Entity” and “Business Associate” have the meanings at 45 CFR 160.103.

2. Permitted Uses & Disclosures of PHI by Business Associate

Business Associate may use or disclose PHI only:

• (a) as necessary to perform the services described in the underlying agreement,
• (b) as permitted or required by 45 CFR 164.504(e),
• (c) as required by law, or
• (d) for the proper management and administration of Business Associate or to carry out its legal responsibilities, provided that any disclosure to a third party under this clause is (i) required by law, or (ii) accompanied by written assurances that the third party will hold the PHI confidentially and notify Business Associate of any breach.

Business Associate shall not use or disclose PHI in a manner that would violate the HIPAA Privacy Rule if done by Covered Entity, except as expressly permitted under this Section 2.

3. Obligations of Business Associate

Business Associate shall:

• (a) implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI in accordance with 45 CFR 164.502(a)(2)(v) and 45 CFR 164.504(e)(2)(ii)(B), and comply with the applicable requirements of the HIPAA Security Rule at 45 CFR Part 164, Subpart C;
• (b) mitigate, to the extent practicable, any harmful effect known to Business Associate of a use or disclosure of PHI by Business Associate in violation of this BAA;
• (c) report to Covered Entity any use or disclosure of PHI not permitted by this BAA of which Business Associate becomes aware, including any Breach of Unsecured PHI as required by Section 4;
• (d) not sell PHI or use or disclose PHI for marketing except as permitted by 45 CFR 164.508 and the HITECH Act.

4. Breach Notification

Business Associate shall notify Covered Entity of any Breach of Unsecured PHI in accordance with 45 CFR 164.410, without unreasonable delay and in no case later than sixty (60) calendar days after discovery. To the extent practicable and at the time of notification, Business Associate shall include:

• (a) a description of what happened, including the date of the Breach and the date of discovery, if known;
• (b) a description of the categories of PHI involved (such as name, date of birth, diagnosis, or account number);
• (c) any steps individuals should take to protect themselves from potential harm;
• (d) a description of what Business Associate is doing to investigate, mitigate harm, and prevent recurrence;
• (e) contact information for follow-up, including a toll-free number, email address, or postal address.

Business Associate shall cooperate with Covered Entity’s fulfillment of its own notification obligations under 45 CFR 164.404 through 164.408.

5. Subcontractors

In accordance with 45 CFR 164.502(e)(1)(ii) and 45 CFR 164.308(b)(2), Business Associate shall obtain written assurances from each subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate. Those assurances shall impose on the subcontractor the same restrictions and conditions that apply to Business Associate under this BAA.

6. Access, Amendment, Accounting

Business Associate shall, within a reasonable time after Covered Entity’s written request:

• (a) provide access to PHI in a Designated Record Set as necessary to support Covered Entity’s obligations under 45 CFR 164.524;
• (b) make amendments to PHI in a Designated Record Set as directed by Covered Entity under 45 CFR 164.526;
• (c) document and make available information required for Covered Entity to provide an accounting of disclosures under 45 CFR 164.528.

Business Associate is not required to duplicate PHI already in Covered Entity’s possession where doing so would be redundant or infeasible.

7. Availability of Books and Records

Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received on behalf of, Covered Entity available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining Covered Entity’s compliance with HIPAA.

8. Term & Termination

This BAA is effective on the effective date of the underlying agreement and is co-terminous with it. Either party may terminate this BAA for material breach on thirty (30) days’ written notice if the other party fails to cure within that period. Termination of this BAA does not terminate the underlying agreement unless required by law.

9. Return or Destruction

Upon termination of this BAA, Business Associate shall return or destroy all PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity, that Business Associate still maintains in any form. If return or destruction is infeasible, Business Associate shall extend the protections of this BAA to the PHI and limit further uses and disclosures to those purposes that make return or destruction infeasible, for so long as Business Associate maintains the PHI, in accordance with 45 CFR 164.504(e)(2)(ii)(J).

10. Governing Law, Amendment

This BAA is governed by federal law and, to the extent not preempted, the laws of the state identified in the underlying agreement. The parties agree to negotiate in good faith to amend this BAA as necessary for the parties to remain in compliance with amendments to HIPAA or other applicable laws.

11. Signatures

Executed as of the effective date of the underlying agreement.

Covered Entity: ______________

Name: __________ Title: ________

Signature: ________ Date: _________

Business Associate:

Name:

Title:

Signature: ________ Date: _________