Business Associate Agreement

Covered Entity is a healthcare provider subject to HIPAA. Business Associate provides software that stores and processes Protected Health Information (PHI) on Covered Entity’s behalf — patient records, care plans, clinical notes, visit records and billing data. This agreement governs that handling and is required by 45 CFR 164.502(e) and 164.504(e).

Terms used here that are defined in HIPAA — Protected Health Information, Required by Law, Secretary, Subcontractor, Unsecured PHI — carry the meanings given there.

Business Associate may use and disclose PHI only to provide the services, to manage and administer its own operations as permitted by 45 CFR 164.504(e)(4), and as Required by Law. Nothing else.

Business Associate will not sell PHI, will not use it for marketing, and will not use it to train models or build products outside the services provided to Covered Entity.

Where Business Associate carries out an obligation of Covered Entity under HIPAA, it will comply with the requirements that apply to Covered Entity in performing it.

Business Associate will use appropriate safeguards and comply with the HIPAA Security Rule at 45 CFR Part 164 Subpart C with respect to electronic PHI. That includes encryption of data in transit and at rest, access restricted to those who need it, and audit records of access to clinical data.

Business Associate will not disclose PHI other than as this agreement permits or as Required by Law.

Business Associate will report to Covered Entity any use or disclosure of PHI not permitted by this agreement, any security incident of which it becomes aware, and any breach of Unsecured PHI, without unreasonable delay and in any event within five (5) business days of discovery.

The report will describe what happened, which individuals’ information was involved so far as known, and what is being done about it.

Business Associate uses subcontractors — including hosting and infrastructure providers — to deliver the services. Any subcontractor that creates, receives, maintains or transmits PHI on Business Associate’s behalf is bound in writing to restrictions and conditions at least as protective as those in this agreement, as required by 45 CFR 164.502(e)(1)(ii).

Business Associate will make PHI in a Designated Record Set available to Covered Entity so that Covered Entity can meet an individual’s right of access under 45 CFR 164.524.

Business Associate will make such PHI available for amendment and will incorporate amendments as directed by Covered Entity, in accordance with 45 CFR 164.526.

Business Associate will maintain and make available the information required to provide an accounting of disclosures under 45 CFR 164.528.

Business Associate will make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary of Health and Human Services for purposes of determining Covered Entity’s compliance.

Covered Entity may terminate this agreement and the services if Business Associate materially breaches it and fails to cure the breach within thirty (30) days of written notice.

On termination, Business Associate will return or destroy all PHI it holds, including that held by subcontractors, where returning or destroying it is feasible. Covered Entity may export its records at any time before and for ninety (90) days after termination.

Where return or destruction is not feasible, Business Associate will extend the protections of this agreement to that PHI and limit further use and disclosure to the purposes that make return or destruction infeasible, for as long as it is retained.

Ending a subscription does not delete patient records. Access is suspended; the records remain available for export until Covered Entity asks for them to be destroyed. Clinical records carry retention obligations that have nothing to do with whether a subscription is current.

PHI remains the property of Covered Entity and the individuals it concerns. Nothing in this agreement transfers ownership of clinical data to Business Associate.

This agreement is governed by the laws of the State of Maryland and by HIPAA, the HITECH Act and their implementing regulations. Where a term of this agreement conflicts with the general terms of service, this agreement governs as to PHI.

The parties agree to amend this agreement as necessary to remain compliant with changes to HIPAA or its regulations.