Business Associate Agreement

(Business Associate) and (Customer) enter this addendum on What date does this agreement take effect?. Customer acts as Is Customer a covered entity or an upstream business associate?. The covered services and underlying agreement are Identify the service agreement and the specific HIPAA-covered services..

Protected health information (PHI) means PHI received, created, maintained, or transmitted for Customer under the covered services. HIPAA and its implementing Privacy, Security, Breach Notification, and Enforcement Rules supply the meanings of their defined terms. This addendum controls conflicting service terms concerning PHI. It does not authorize PHI in other services.

Business Associate may use and disclose PHI only to perform the covered services as instructed by Customer, as required by law, or as this addendum expressly permits. Uses, disclosures, and requests must meet applicable minimum-necessary requirements. Business Associate may not sell PHI, use it for unrelated advertising, or train general-purpose AI models on it. No de-identification or data aggregation is authorized without a separate written agreement consistent with HIPAA.

Business Associate may use PHI for proper management and administration or legal responsibilities. Disclosure for those purposes requires either a legal obligation or reasonable written assurances of confidentiality, limited purpose, and notice of breaches. It may not otherwise use or disclose PHI in a way that would violate the Privacy Rule if done by Customer.

Business Associate will implement appropriate administrative, physical, and technical safeguards and comply with the Security Rule for electronic PHI. Agreed security measures are: Describe actual administrative, technical, and physical safeguards.. Personnel may access PHI only as needed for authorized work and must be bound by confidentiality duties. Subcontractors that create, receive, maintain, or transmit PHI must accept the same applicable restrictions, conditions, and security requirements in writing. Business Associate remains responsible for its obligations.

Business Associate must report unauthorized uses or disclosures, security incidents, and breaches of unsecured PHI to Customer without unreasonable delay, within Specify the contractual outer reporting deadline, consistent with HIPAA., and sooner if law requires. It must provide known facts, affected individuals and information where available, mitigation, and continuing updates. Initial notice must not wait for a completed investigation. Notice goes to Business Associate will mitigate harmful effects and cooperate with Customer’s legally required notifications. An unsuccessful incident reporting arrangement requires a separate written description and must remain consistent with law.

Business Associate will make PHI available to Customer or its designated individual to support required access; make directed amendments; and document and supply information for accountings of disclosures. The response procedure and deadlines are State procedures and deadlines for access, amendment, and accounting requests., which must allow Customer to meet legal deadlines. Direct requests from individuals must be promptly forwarded to Customer unless Customer instructs otherwise.

To the extent Business Associate performs Customer’s Privacy Rule duties, it must comply with the rules applicable to those duties. It will make relevant internal practices, books, and records available to the Secretary of HHS for compliance review. This agreement does not restrict government oversight.

Customer will provide necessary notices, permissions, restrictions, and changes affecting lawful use of PHI. Customer must not request a use or disclosure that would violate HIPAA. Each party remains responsible for its own legal duties. Customer’s instructions do not excuse Business Associate’s independent obligations.

This addendum continues while Business Associate holds PHI. Customer may terminate the covered services for Business Associate’s material violation if uncured within State the cure period for a curable material violation., or immediately if cure is not feasible. On termination, Business Associate must return or destroy all PHI, including subcontractor-held PHI, where feasible. If infeasible, it must explain why, continue protections, and limit further use to the purpose making return or destruction infeasible. Those duties survive while PHI remains.

The parties will amend this addendum as necessary to comply with applicable HIPAA requirements. No provision creates third-party contractual rights. Governing law, notices, and other service terms remain in the underlying agreement, subject to this addendum and mandatory law. Liability terms cannot excuse either party’s regulatory duties. Counterparts and electronic signatures are effective.

Business Associate: ____________________ Name and title: ____________________ Date: ____________________

Customer: ____________________ Name and title: ____________________ Date: ____________________