Business Associate Agreement (BAA) Template

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement ("Agreement") is entered into as of Day Month Year by and between Covered Entity: with principal place of business at , and Business Associate: with principal place of business at .

RECITALS

WHEREAS, Covered Entity is subject to certain federal and state laws and regulations governing the privacy and security of Protected Health Information ("PHI"), and must ensure that each Business Associate with access to PHI agrees to certain safeguards and restrictions; and

WHEREAS, Business Associate performs services for or on behalf of Covered Entity that require Business Associate to create, receive, maintain, or transmit PHI in the course of performing such services; and

WHEREAS, the parties desire to set forth the terms and conditions pursuant to which Business Associate shall handle PHI and to ensure compliance with applicable privacy and security laws and regulations.

NOW, THEREFORE, in consideration of the mutual covenants and promises contained herein and for other good and valuable consideration, the parties agree as follows:

1. DEFINITIONS

1.1 "Protected Health Information" or "PHI" shall have the same meaning as the term "protected health information" as defined under applicable law and includes individually identifiable health information transmitted or maintained in any form, whether created by Covered Entity, Business Associate, or received from another party.

1.2 "Required By Law" means a mandate contained in law that compels a use or disclosure of PHI, enforceable in a court of law.

1.3 Terms used, but not otherwise defined in this Agreement, shall have the meanings given to such terms under applicable federal and state law.

2. PERMITTED USES AND DISCLOSURES

2.1 Business Associate may use and disclose PHI only as necessary to perform the services described in the Services Description below, and as otherwise permitted by this Agreement and required by law. Business Associate shall not use or disclose PHI in a manner that would violate applicable privacy laws if done by Covered Entity.

2.2 Prohibited Uses. Business Associate shall not: (a) use PHI for its own purposes other than as permitted by this Agreement; (b) disclose PHI to third parties except as permitted herein; (c) sell PHI or use PHI for marketing or fundraising purposes without the express prior written consent of Covered Entity and applicable authorizations.

3. OBLIGATIONS OF BUSINESS ASSOCIATE

3.1 Safeguards. Business Associate shall implement administrative, physical, and technical safeguards reasonably designed to prevent unauthorized use or disclosure of PHI and to protect the confidentiality, integrity, and availability of electronic PHI in accordance with applicable law.

3.2 Reporting. Business Associate shall report to Covered Entity any use or disclosure of PHI not permitted by this Agreement, including any Security Incident or breach of unsecured PHI, within business days of discovery. Such report shall identify the nature of the incident, the PHI involved, and the actions taken to mitigate harm.

3.3 Minimum Necessary. When requesting, using, or disclosing PHI, Business Associate shall limit such requests, uses, and disclosures to the minimum necessary to accomplish the intended purpose.

4. OBLIGATIONS OF COVERED ENTITY

4.1 Covered Entity shall provide Business Associate with the minimum necessary PHI to enable Business Associate to perform its services and shall notify Business Associate of any restrictions or limitations on the use or disclosure of PHI of which it is aware.

5. SUBCONTRACTORS

5.1 Business Associate shall require any subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate to agree in writing to the same restrictions and conditions that apply to Business Associate under this Agreement.

6. ACCESS, AMENDMENT AND ACCOUNTING

6.1 Access. To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate shall make such PHI available to Covered Entity or, at Covered Entity's direction, to an Individual, so Covered Entity may meet its obligations under law to provide access to PHI.

6.2 Amendment and Accounting. Business Associate shall make available such information and take such actions as are necessary to permit Covered Entity to satisfy its obligations to provide amendments and accounting of disclosures in accordance with applicable law.

7. TERM AND TERMINATION

7.1 Term. The term of this Agreement shall commence on the effective date and shall continue until terminated as provided herein.

7.2 Termination for Cause. Covered Entity may terminate this Agreement if it determines that Business Associate has violated a material term of this Agreement and fails to cure such breach within thirty (30) days after receipt of written notice specifying the breach.

7.3 Effect of Termination. Upon termination, Business Associate shall return or destroy all PHI received from Covered Entity that Business Associate still maintains in any form, if feasible. If return or destruction is infeasible, Business Associate shall extend protections of this Agreement to such PHI and limit further uses and disclosures to those purposes that make return infeasible.

8. BREACH NOTIFICATION AND MITIGATION

8.1 Notification Content. Business Associate's notification of a breach shall include, to the extent known, identification of each affected individual, a description of the PHI involved, steps taken to mitigate harm, and contact information for inquiries.

8.2 Mitigation. Business Associate shall mitigate, to the extent practicable, any harmful effect known to Business Associate resulting from a use or disclosure of PHI in violation of this Agreement.

9. INDEMNIFICATION

9.1 Indemnification. Business Associate shall indemnify, defend, and hold harmless Covered Entity from and against any and all claims, liabilities, losses, damages, fines, penalties, and expenses (including reasonable attorneys' fees) arising out of or resulting from Business Associate's breach of this Agreement or its negligent or willful acts or omissions related to PHI.

10. LIMITATION OF LIABILITY

10.1 Except for indemnification obligations, willful misconduct, or breaches of confidentiality, neither party shall be liable to the other for consequential, incidental, special, or punitive damages arising out of this Agreement.

11. MISCELLANEOUS PROVISIONS

11.1 Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the State of without regard to conflict of laws principles.

11.2 Notices. All notices required under this Agreement shall be in writing and delivered to the addresses set forth below or to such other address as either party designates in writing. Notice shall be deemed effective upon delivery.

11.3 Amendments. This Agreement may be amended only by a written instrument executed by both parties. Any amendment required by changes in law shall be incorporated by mutual written agreement to the extent necessary for compliance.

11.4 Waiver. The failure of either party to exercise any right under this Agreement shall not constitute a waiver of such right unless such waiver is in writing and signed by the waiving party.

11.5 Severability. If any provision of this Agreement is held invalid or unenforceable, the remainder of the Agreement shall remain in full force and effect, and the parties shall negotiate in good faith a substitute provision to effect the original intent.

11.6 Counterparts. This Agreement may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument.

11.7 Survival. The obligations of the parties under this Agreement with respect to PHI shall survive termination or expiration of this Agreement.

ADDITIONAL TERMS

Sign Now