Binding effect. This public template does not become a binding agreement by being viewed or downloaded. It becomes effective only when it is signed by both parties or expressly incorporated into an executed services agreement or order form.
1. Parties and purpose
This Business Associate Agreement ("BAA") is entered into between the healthcare organization identified as the customer in the applicable services agreement or order form ("Covered Entity") and the Vocari legal entity identified in that agreement ("Business Associate"). Covered Entity and Business Associate may each be called a "Party" and together the "Parties."
The Parties have entered into one or more agreements under which Business Associate provides patient-access software, workflow automation, implementation, support, and related services for Covered Entity (collectively, the "Services Agreement"). In providing those services, Business Associate may create, receive, maintain, or transmit Protected Health Information for or on behalf of Covered Entity. This BAA supplements and forms part of the Services Agreement.
The Parties intend this BAA to satisfy the requirements applicable to business associate arrangements under the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act, and their implementing regulations, each as amended (collectively, "HIPAA").
2. Definitions
Capitalized terms not otherwise defined in this BAA have the meanings assigned under HIPAA.
- "Breach" has the meaning stated in 45 C.F.R. § 164.402.
- "Designated Record Set" has the meaning stated in 45 C.F.R. § 164.501.
- "Electronic Protected Health Information" or "Electronic PHI" has the meaning stated in 45 C.F.R. § 160.103 and is limited to Electronic PHI that Business Associate creates, receives, maintains, or transmits for Covered Entity.
- "Individual" has the meaning stated in 45 C.F.R. § 160.103 and includes a person who qualifies as a personal representative under 45 C.F.R. § 164.502(g).
- "Privacy Rule" means the Standards for Privacy of Individually Identifiable Health Information at 45 C.F.R. Part 164, Subpart E.
- "Protected Health Information" or "PHI" has the meaning stated in 45 C.F.R. § 160.103 and is limited to information Business Associate creates, receives, maintains, or transmits for or on behalf of Covered Entity.
- "Required by Law" has the meaning stated in 45 C.F.R. § 164.103.
- "Secretary" means the Secretary of the United States Department of Health and Human Services or the Secretary's designee.
- "Security Incident" has the meaning stated in 45 C.F.R. § 164.304.
- "Security Rule" means the Security Standards for the Protection of Electronic PHI at 45 C.F.R. Part 164, Subpart C.
- "Subcontractor" has the meaning stated in 45 C.F.R. § 160.103.
- "Unsecured PHI" has the meaning stated in 45 C.F.R. § 164.402.
3. Permitted uses and disclosures
Business Associate may use or disclose PHI only:
- to perform the services, functions, and activities described in the Services Agreement for or on behalf of Covered Entity;
- as permitted by this BAA;
- as directed in writing by Covered Entity, provided the direction is consistent with HIPAA and the Services Agreement; or
- as Required by Law.
Management and administration
Business Associate may use PHI for its proper management and administration and to carry out its legal responsibilities. Business Associate may disclose PHI for those purposes only if the disclosure is Required by Law or Business Associate obtains reasonable written assurances from the recipient that the PHI will remain confidential, will be used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and the recipient will notify Business Associate of any known breach of confidentiality.
Data aggregation and de-identification
Business Associate may provide data aggregation services relating to Covered Entity's healthcare operations only as authorized by the Services Agreement. Business Associate may de-identify PHI only in accordance with 45 C.F.R. § 164.514 and the Services Agreement. Business Associate will not re-identify properly de-identified information and will not use PHI or patient interaction data to train Vocari-owned generalized artificial intelligence models.
4. Restrictions and minimum necessary
Business Associate will not use or disclose PHI in a manner that would violate the Privacy Rule if done by Covered Entity, except for uses and disclosures expressly permitted for Business Associate's proper management and administration, legal responsibilities, or data aggregation services.
Business Associate will not sell PHI, use PHI for marketing, or receive remuneration in exchange for PHI except as expressly permitted by HIPAA and authorized in writing by Covered Entity. Business Associate will not use or disclose PHI for any independent advertising purpose.
Where the HIPAA minimum-necessary standard applies, Business Associate will limit its requests for, uses of, and disclosures of PHI to the minimum reasonably necessary to accomplish the intended purpose. Business Associate will apply role, workspace, workflow, and technical restrictions intended to support this obligation.
5. Safeguards and HIPAA Security Rule
Business Associate will use appropriate administrative, physical, and technical safeguards to prevent use or disclosure of PHI other than as permitted by this BAA. With respect to Electronic PHI, Business Associate will comply with the provisions of the Security Rule that apply directly to business associates.
Business Associate will maintain written policies and procedures reasonably designed to:
- protect the confidentiality, integrity, and availability of Electronic PHI;
- identify and protect against reasonably anticipated threats or hazards;
- protect against reasonably anticipated impermissible uses or disclosures;
- manage workforce access according to authorization and business purpose;
- respond to suspected Security Incidents and mitigate harmful effects to the extent practicable; and
- document compliance with applicable HIPAA requirements.
Business Associate will notify Covered Entity of material limitations in the security of the subscribed service that would materially affect Business Associate's ability to comply with this BAA.
6. Security Incidents and Breaches
Reporting obligation
Business Associate will report to Covered Entity any use or disclosure of PHI not permitted by this BAA, any Security Incident involving Electronic PHI, and any Breach of Unsecured PHI discovered by Business Associate. A Breach is treated as discovered on the first day it is known to Business Associate or, by exercising reasonable diligence, would have been known to Business Associate.
Business Associate will provide initial written notice without unreasonable delay and no later than ten business days after discovery of a reportable event. This contractual period does not extend any shorter deadline imposed by applicable law or an executed Services Agreement. Business Associate may provide information in phases as the investigation develops.
Contents of notice
To the extent known at the time, the report will include:
- the date of the event and date of discovery;
- a description of what occurred and the systems or services involved;
- the categories of PHI involved and, where reasonably available, the identity of affected Individuals;
- the known or suspected recipient or person who obtained access;
- containment, mitigation, preservation, and corrective actions taken or planned;
- a contact for follow-up; and
- other information reasonably available to Covered Entity for notifications required under 45 C.F.R. §§ 164.404, 164.406, and 164.408.
Business Associate will supplement the report as material information becomes available, cooperate with Covered Entity's risk assessment and legally required notifications, and maintain documentation sufficient to demonstrate the basis for notification decisions.
Unsuccessful activity
This BAA serves as notice of routine unsuccessful activity that does not result in unauthorized access, use, disclosure, modification, or destruction of PHI or material interference with system operations, including blocked pings, port scans, denial-of-service attempts, and failed login attempts. Business Associate will report such activity separately if it results in a reportable Security Incident or if the Services Agreement requires additional reporting.
7. Subcontractors
Before a Subcontractor creates, receives, maintains, or transmits PHI on Business Associate's behalf, Business Associate will obtain written assurances that the Subcontractor will apply restrictions, conditions, and safeguards that are at least as protective as those applicable to Business Associate under this BAA, including compliance with applicable Security Rule requirements.
Business Associate will maintain a register of relevant Subcontractors, their processing purpose, the data involved, and the status of required contractual protections. Business Associate remains responsible for managing its Subcontractors as required by HIPAA and the Services Agreement.
8. Assistance with Individual rights
Access
If Business Associate maintains PHI in a Designated Record Set for Covered Entity, Business Associate will make the requested PHI available to Covered Entity in the form and format reasonably requested so Covered Entity can satisfy its obligations under 45 C.F.R. § 164.524. Unless the Services Agreement states a shorter period, Business Associate will respond to Covered Entity within ten business days after receiving a complete request.
Amendment
Business Associate will make PHI available for amendment and incorporate an amendment directed by Covered Entity as reasonably necessary for Covered Entity to comply with 45 C.F.R. § 164.526. Unless the Services Agreement states a shorter period, Business Associate will respond within ten business days after receiving complete instructions.
Accounting of disclosures
Business Associate will document disclosures of PHI and make information available to Covered Entity as reasonably necessary to respond to a request for an accounting under 45 C.F.R. § 164.528. Business Associate will retain the required accounting information for the period required by HIPAA.
Covered Entity Privacy Rule functions
To the extent Business Associate has expressly agreed to perform a Covered Entity obligation under the Privacy Rule, Business Associate will comply with the Privacy Rule requirements that apply to Covered Entity in performing that obligation.
9. HHS access and compliance
Business Associate will make its internal practices, books, records, policies, and other materials relating to the use and disclosure of PHI received from, created for, or received on behalf of Covered Entity available to the Secretary in the time and manner designated by the Secretary for determining compliance with HIPAA.
Business Associate will cooperate with a lawful investigation or compliance review and will preserve relevant material subject to an applicable legal hold or written request.
10. Covered Entity obligations
Covered Entity will:
- notify Business Associate of any limitation in Covered Entity's Notice of Privacy Practices that may affect Business Associate's permitted use or disclosure of PHI;
- notify Business Associate of any change in or revocation of an Individual's authorization or permission that may affect the Services;
- notify Business Associate of any restriction on use or disclosure agreed to under 45 C.F.R. § 164.522 that may affect the Services;
- obtain any authorization, consent, permission, or notice required for Covered Entity's collection and disclosure of PHI through the Services;
- configure authorized users, workflows, integrations, and disclosures consistent with law and Covered Entity's policies; and
- not request Business Associate to use or disclose PHI in a manner that would violate HIPAA if performed by Covered Entity, except for activity HIPAA permits a Business Associate to perform.
Covered Entity remains responsible for clinical decisions, its patient records, its Notice of Privacy Practices, and responding to Individuals unless a specific obligation has been assigned to Business Associate in writing.
11. Term and termination
This BAA begins on the date it is signed or incorporated into the Services Agreement. It continues until termination of the Services Agreement and return or destruction of PHI, except for obligations that survive under this BAA. Production handling of PHI requires an executed BAA.
If either Party knows of a pattern of activity or practice by the other Party that constitutes a material breach of this BAA, the non-breaching Party will provide written notice and a reasonable opportunity to cure if cure is feasible. If the breach is not cured within the stated period, the non-breaching Party may terminate the affected Services Agreement. If termination is infeasible, the Parties will take the steps required by HIPAA, including reporting to the Secretary where required.
12. Return or destruction of PHI
Upon termination, Business Associate will return or destroy PHI received from Covered Entity or created, maintained, or received for Covered Entity when feasible, including PHI held by Subcontractors. Business Associate will retain no copies except where retention is Required by Law or return or destruction is infeasible.
If Business Associate determines that return or destruction is infeasible, Business Associate will notify Covered Entity of the condition, extend the protections of this BAA to the retained PHI, and limit further use and disclosure to the purpose that makes return or destruction infeasible for as long as Business Associate retains the PHI.
PHI in backup systems may remain until overwritten through the applicable backup lifecycle if immediate deletion is infeasible. Such PHI will remain protected, will not be restored for ordinary business use, and will be returned to the deletion lifecycle if restored for disaster recovery. The Services Agreement or approved data-return procedure will define export format, secure delivery, timing, and any applicable costs.
13. General provisions
Regulatory change
The Parties will amend this BAA as reasonably necessary to comply with changes to HIPAA or other applicable law. References to a regulatory provision include the provision as amended. Any ambiguity will be interpreted to permit compliance with HIPAA.
Order of precedence
If this BAA conflicts with the Services Agreement concerning PHI, this BAA controls. The Services Agreement controls for matters not addressed in this BAA.
No third-party beneficiaries
This BAA is for the benefit of the Parties and does not create rights for another person except as required by law.
Notices, assignment, and general contract terms
Formal notices, assignment, governing law, venue, waiver, severability, force majeure, electronic signatures, counterparts, and the relationship of the Parties are governed by the Services Agreement unless this BAA expressly provides otherwise.
Survival
Business Associate's obligations concerning retained PHI, confidentiality, return or destruction, HHS access, and any provision that by its nature should survive will continue after termination.
14. Execution
The executed BAA should identify the legal names and notice addresses of both Parties, the effective date, authorized signatories, privacy and security contacts, and the governing Services Agreement. Electronic signatures and counterparts are effective to the extent permitted by the Services Agreement and applicable law.