1. Parties and Effective Date
This Business Associate Agreement ("Agreement") is entered into as of [Effective Date] by and between [Company Legal Name], located at [Company Registered Address] ("Covered Entity"), and [Business Associate Legal Name], located at [Business Associate Address] ("Business Associate"). This Agreement supplements and is incorporated into the underlying services agreement between the Parties (the "Underlying Agreement"). In the event of any conflict, this Agreement controls with respect to PHI.
2. Definitions
Capitalised terms not otherwise defined in this Agreement have the meanings given in the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164, as amended ("HIPAA Rules"). "PHI" means Protected Health Information limited to information Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity.
3. Permitted Uses and Disclosures of PHI
Business Associate may use or disclose PHI only as necessary to perform its obligations under the Underlying Agreement, as Required by Law, or as expressly permitted under this Agreement. Specifically, Business Associate may:
- Use PHI for the proper management and administration of Business Associate or to carry out its legal responsibilities (45 CFR §164.504(e)(4))
- Disclose PHI for those purposes only if disclosure is Required by Law or Business Associate obtains reasonable written assurances of confidentiality and breach notification from the recipient
- De-identify PHI in accordance with 45 CFR §164.514 for permitted purposes
- Provide Data Aggregation services to Covered Entity as permitted by 45 CFR §164.504(e)(2)(i)(B), if applicable
4. Prohibited Uses and Disclosures
Business Associate shall not use or disclose PHI in any manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, except as provided in Section 3 above. Business Associate shall not sell PHI nor use PHI for marketing without a HIPAA-compliant authorisation.
5. Safeguards
Business Associate shall implement and maintain administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic PHI in accordance with 45 CFR §§164.308, 164.310, 164.312, and 164.316 (Security Rule). Business Associate shall conduct, document, and update an annual risk analysis covering all systems that process PHI.
6. Reporting and Breach Notification
Business Associate shall report to Covered Entity:
- Any use or disclosure of PHI not permitted by this Agreement, without unreasonable delay and in no event later than ten (10) business days after discovery
- Any Security Incident of which it becomes aware (aggregate reports of unsuccessful attempts may be made annually)
- Any Breach of Unsecured PHI without unreasonable delay and in no event later than thirty (30) calendar days after discovery, to allow Covered Entity to meet the 60-day notification deadline of 45 CFR §164.404
- Reports shall include the information required by 45 CFR §164.410(c): identification of affected individuals, description of what occurred, types of PHI involved, and mitigation steps taken
7. Subcontractors
In accordance with 45 CFR §§164.502(e)(1)(ii) and 164.308(b)(2), Business Associate shall ensure that any subcontractor that creates, receives, maintains, or transmits PHI on its behalf agrees in writing to the same restrictions, conditions, and requirements that apply to Business Associate under this Agreement.
8. Individual Rights
Business Associate shall:
- Make PHI in a Designated Record Set available to Covered Entity (or to the individual, as directed) within fifteen (15) business days of request, to enable Covered Entity to meet 45 CFR §164.524
- Incorporate amendments to PHI in a Designated Record Set within thirty (30) days of receipt, per 45 CFR §164.526
- Maintain an accounting of disclosures sufficient for Covered Entity to respond to a request under 45 CFR §164.528
- Make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of HHS for purposes of determining Covered Entity's compliance
9. Term and Termination
This Agreement is effective on the date written above and continues until terminated by either Party or until the Underlying Agreement terminates, whichever is later. Covered Entity may terminate this Agreement immediately if Business Associate has materially breached its obligations and failed to cure within thirty (30) days of written notice. Upon termination, Business Associate shall return or destroy all PHI received from, or created or received on behalf of, Covered Entity. If return or destruction is infeasible, Business Associate shall extend the protections of this Agreement to such PHI and limit further uses and disclosures.
10. Miscellaneous
This Agreement shall be construed in light of any applicable interpretation of or guidance on the HIPAA Rules issued by HHS. The Parties agree to amend this Agreement as necessary to comply with the HIPAA Rules. Neither Party intends to create a joint venture or agency relationship. This Agreement is governed by the laws of [Governing State].
11. Signatures
Executed by the duly authorised representatives of each Party.
Covered Entity: [Company Legal Name]
Signature: _______________________ Name: _______________________ Title: _______________________ Date: _______________________
Business Associate: [Business Associate Legal Name]
Signature: _______________________ Name: _______________________ Title: _______________________ Date: _______________________
Disclaimer: This template is provided for general informational purposes only and does not constitute legal advice. Customise to your specific facts and have counsel review before execution.