2. Business Associate Agreement (BAA)
This Business Associate Agreement (the “BAA”) is entered into between [Your practice's legal name] (the “Covered Entity”) and applaud inc, a Delaware corporation with its registered office at 8 The Green, Ste A, Dover, DE 19901 (“applaud”, the “Business Associate”), pursuant to the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations at 45 CFR Parts 160 and 164.
2.1 Definitions
Capitalized terms used in this BAA and not otherwise defined have the meaning ascribed to them in 45 CFR § 160.103 and 45 CFR § 164.501. “PHI” means Protected Health Information, limited to the information Business Associate receives from or creates on behalf of Covered Entity in connection with the service described in Section 1.
2.2 Permitted uses and disclosures
Business Associate may use and disclose PHI solely for the purpose of providing the service described in Section 1, and for the proper management and administration of Business Associate as permitted by 45 CFR § 164.504(e)(4). Business Associate will not use or disclose PHI in any manner that would violate the Privacy Rule if done by Covered Entity directly.
2.3 Minimum necessary
Business Associate will request, use, and disclose only the minimum necessary PHI to accomplish the purpose of the service. Specifically, the data fields transferred from Covered Entity to Business Associate are limited to: patient name, telephone number, email address, visit date, and treating provider. No clinical information (diagnoses, notes, vitals, lab results, prescriptions, billing codes) is transmitted.
2.4 Safeguards
Business Associate will implement appropriate administrative, physical, and technical safeguards to prevent the unauthorized use or disclosure of PHI, in accordance with the HIPAA Security Rule (45 CFR Part 164, Subpart C). These include encryption of PHI in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent), access controls on a least-privilege basis, and audit logging of access to identified patient data.
2.5 Subcontractors
Business Associate will obtain a written agreement, containing substantially the same terms as this BAA, from any subcontractor that receives, creates, maintains, or transmits PHI on Business Associate's behalf. A current list of such subcontractors is available to Covered Entity on request.
2.6 Reporting
Business Associate will report to Covered Entity any use or disclosure of PHI not permitted by this BAA, any Security Incident of which it becomes aware, and any Breach of Unsecured PHI within ten (10) days of discovery, in accordance with 45 CFR § 164.410. applaud commits to a target notification window of seventy-two (72) hours after confirmation of a Breach.
2.7 Individual rights
Business Associate will make PHI available to enable Covered Entity to comply with the access, amendment, and accounting-of-disclosures rights set forth in 45 CFR §§ 164.524, 164.526, and 164.528, within thirty (30) days of a written request.
2.8 Termination
Upon termination of this Agreement, Business Associate will return or destroy all PHI received from, or created or received on behalf of, Covered Entity. If return or destruction is not feasible, Business Associate will extend the protections of this BAA to such PHI and limit further uses and disclosures to those purposes that make the return or destruction infeasible.
2.9 Obligations of Covered Entity
Covered Entity will not request that Business Associate use or disclose PHI in any manner that would not be permissible under the Privacy Rule if done by Covered Entity directly. Covered Entity is responsible for obtaining any consents or authorizations from individuals that may be required for the contact channels used by Business Associate.
2.10 Effect
This BAA is incorporated into and made part of the Customer Agreement in Section 1. In the event of any conflict between the BAA and the Customer Agreement with respect to PHI, the BAA controls.