NOW, THEREFORE, in consideration of the mutual covenants and conditions contained herein and the continued provision of PHI by Covered Entity to Business Associate under the Agreement in reliance on this BAA, the Parties agree as follows:
For purposes of this BAA, the Parties give the following meanings to each term below. Capitalized terms used but not otherwise defined herein have the meanings given to them in the Privacy Rule, Security Rule, Breach Notification Rule, or HITECH Act:
A. Permitted Services: Except as otherwise limited in this BAA or the Master Agreement, Business Associate may use or disclose PHI as reasonably necessary to perform functions, activities, or services for or on behalf of Covered Entity as specified in the Agreement, and as permitted or required by this BAA or as Required by Law.
B. Proper Management and Administration: Business Associate may use PHI in its possession for the proper management and administration of Business Associate's business operations and to carry out its legal responsibilities. Business Associate may disclose PHI for such purposes only if (i) the disclosure is Required by Law, or (ii) Business Associate obtains reasonable written assurances from the recipient that the PHI will remain confidential, be used or further disclosed solely as Required by Law or for the purpose for which it was disclosed, and that the recipient will immediately notify Business Associate of any breaches of confidentiality of which it becomes aware.
C. Minimum Necessary Standard: Business Associate will use or disclose PHI, to the extent practicable, as a limited data set or limited to the minimum necessary amount of PHI to accomplish the intended purpose of the use or disclosure, in accordance with Section 13405(b) of the HITECH Act (codified at 42 U.S.C. § 17935(b)) and 45 CFR § 164.502(b).
D. Access by Covered Entity: Upon request, Business Associate will make available to Covered Entity any of Covered Entity's PHI that Business Associate or any of its agents or subcontractors have in their possession.
E. Reporting Violations of Law: Business Associate may use PHI to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR § 164.502(j)(1).
Business Associate will implement and maintain appropriate administrative, physical, and technical safeguards in compliance with 45 CFR Part 164, Subpart C (including AES-256 encryption at rest and TLS 1.3 encryption in transit) that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic PHI created, received, maintained, or transmitted on behalf of Covered Entity. Business Associate agrees to take reasonable steps, including regular workforce security training, access governance, and vulnerability mitigation, to ensure that the actions or omissions of its personnel or agents do not cause Business Associate to breach this BAA.
Business Associate will report to Covered Entity in writing any use or disclosure of PHI not provided for by this BAA of which it becomes aware, and will report any Security Incident affecting Electronic PHI of Covered Entity of which it becomes aware. Business Associate agrees to submit such report within five (5) business days of becoming aware of the event. The Parties acknowledge that pings, port scans, and unsuccessful reconnaissance attacks occur continually and that this Section constitutes ongoing notice of such routine unsuccessful attempts, provided no compromised access occurred.
Business Associate will notify Covered Entity in writing promptly upon discovery of any confirmed Breach of Unsecured PHI in accordance with 45 CFR § 164.410, without unreasonable delay and in no case later than thirty (30) calendar days after discovery. The notification shall include, to the extent known: (a) the identification of each individual whose Unsecured PHI has been or is reasonably believed to have been breached; (b) a brief description of what happened, including the date of the breach and the date of discovery; (c) a description of the types of Unsecured PHI involved; (d) any steps individuals should take to protect themselves; and (e) a brief description of what Business Associate is doing to investigate the breach, mitigate harm, and protect against further breaches.
Business Associate will take reasonable measures to mitigate, to the extent practicable, any harmful effect known to Business Associate resulting from an unauthorized use or disclosure of PHI by Business Associate, its workforce, or its agents or subcontractors in violation of this BAA.
In accordance with 45 CFR § 164.502(e)(1)(ii) and 45 CFR § 164.504(e)(2), Business Associate will ensure that any agent, including a subcontractor (such as upstream cloud infrastructure, database hosting, or transactional delivery providers), that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to the same restrictions, conditions, and safeguard requirements that apply to Business Associate with respect to such information under this BAA. Business Associate shall ensure that all subcontracts and agreements provide the same or higher level of privacy and security as this BAA.
Upon reasonable written request, Business Associate will make available to Covered Entity copies of its independent third-party SOC 2 Type II audit report, HIPAA security risk assessment documentation, or equivalent industry-recognized security attestations verifying safeguards. Covered Entity agrees that such reports are proprietary and confidential to Business Associate and shall not be re-disclosed to third parties without prior written consent.
A. Assistance to Covered Entity: Upon request, Business Associate will furnish Covered Entity with copies of PHI maintained in a Designated Record Set in the time and format necessary to enable Covered Entity to respond to an Individual's request for access under 45 CFR § 164.524.
B. Direct Individual Inquiries: In the event an Individual or personal representative requests access to PHI directly from Business Associate, Business Associate will forward that request to Covered Entity within ten (10) business days. Any determination of, or decision not to disclose, PHI requested by an Individual shall be the sole responsibility of Covered Entity.
A. Incorporation of Amendments: Upon written instruction from Covered Entity, Business Associate will amend PHI or a record about an Individual in a Designated Record Set maintained by Business Associate as directed by Covered Entity in accordance with 45 CFR § 164.526 within fifteen (15) business days of receiving the request.
B. Direct Individual Requests: If an Individual requests an amendment of PHI directly from Business Associate, Business Associate will forward such request to Covered Entity within ten (10) business days. Any amendment or denial of amendment shall be the sole responsibility of Covered Entity.
A. Maintenance of Logs: Business Associate will document disclosures of PHI and information related to such disclosures as required for Covered Entity to respond to a request for an accounting of disclosures under 45 CFR § 164.528, including (i) date of disclosure, (ii) name and address of recipient, (iii) brief description of PHI disclosed, and (iv) purpose of disclosure.
B. Provision to Covered Entity: Business Associate will furnish such accounting information within ten (10) business days of written request by Covered Entity.
C. Direct Inquiries: If an Individual requests an accounting directly from Business Associate, Business Associate will forward the request to Covered Entity within ten (10) business days.
Business Associate will make its internal practices, books, agreements, records, and policies and procedures relating to the use and disclosure of PHI received from, or created or received on behalf of, Covered Entity available to the Secretary of HHS for purposes of determining Covered Entity's and Business Associate's compliance with HIPAA and HITECH Act requirements.
Covered Entity agrees to: (a) notify Business Associate of any limitation(s) in its notice of privacy practices under 45 CFR § 164.520 to the extent such limitation may affect Business Associate's use or disclosure of PHI; (b) notify Business Associate of any changes in, or revocation of, permission by an Individual to use or disclose PHI; (c) notify Business Associate of any restriction on use or disclosure agreed to under 45 CFR § 164.522; and (d) not request Business Associate to use or disclose PHI in any manner that would not be permissible under HIPAA if done directly by Covered Entity, except as permitted for Data Aggregation or management and administration.
The Parties expressly acknowledge that Business Associate acts solely as a data processor and data steward. Business Associate's stewardship does not confer any proprietary or ownership rights on Business Associate with respect to any PHI, medical records, or clinical data shared with it under the Agreement.
A. Term: This BAA becomes effective as of the execution date set forth above and continues in full force and effect until all obligations of the Parties under the Master Agreement and this BAA have been fully discharged.
B. Termination for Cause: If either Party determines that the other Party has committed a material breach of this BAA, the non-breaching Party will provide written notice specifying the breach and grant thirty (30) calendar days to cure the breach. If the breaching Party fails to cure within the 30-day period, the non-breaching Party may immediately terminate the Agreement and this BAA. If termination is not feasible, the non-breaching Party may report the problem to the Secretary of HHS.
C. Disposition of PHI upon Termination: Upon termination of the Agreement for any reason, Business Associate will return to Covered Entity or securely destroy all PHI maintained by Business Associate or its subcontractors, retaining no copies. If return or destruction of PHI is infeasible due to statutory record retention rules (including HIPAA 6-year retention, California CDPH Title 22 mandates, or immutable automated system backups), Business Associate will furnish written notification of the conditions making return or destruction infeasible. Business Associate will extend the protections of this BAA to such retained PHI for as long as it is maintained and limit further uses and disclosures strictly to those purposes that make return or destruction infeasible. This survival obligation shall continue indefinitely.
This BAA is incorporated into and made part of the Master SaaS Services Agreement. In the event of any conflict or inconsistency between the terms of this BAA and the Master Agreement or any related order form, the terms of this BAA shall govern and control regarding the handling, security, and privacy of PHI. Except as expressly provided by federal law, this BAA does not create any rights or remedies in favor of any third party.
A reference in this BAA to a section in HIPAA, the Privacy Rule, Security Rule, Breach Notification Rule, or HITECH Act means the section as in effect or as subsequently amended. The Parties agree to comply with the applicable provisions of the HITECH Act and negotiate in good faith to modify this BAA as reasonably necessary to remain compliant with future federal rules or guidance.