Healthcare BAA Test

HEALTHCARE BAA TEST

Parties and Effective Date

This Business Associate Agreement ("Agreement") is entered into by and between Covered Entity: and Business Associate: . Effective Date:

Recitals

WHEREAS, Covered Entity possesses Protected Health Information ("PHI") and wishes to disclose certain PHI to Business Associate to enable Business Associate to perform services for Covered Entity; and

WHEREAS, Business Associate may receive, create, maintain, or transmit PHI on behalf of Covered Entity and must agree to the terms and conditions set forth herein to ensure compliance with applicable privacy and security requirements.

Definitions

"Protected Health Information (PHI)" means any information, whether oral or recorded in any form or medium, that relates to the past, present, or future physical or mental health condition of an individual, provision of health care, or payment for health care, and that identifies or reasonably can be used to identify the individual.

Terms used but not otherwise defined in this Agreement shall have the same meaning as in applicable federal and state law governing privacy and security of health information.

Permitted Uses and Disclosures of PHI

Business Associate may use or disclose PHI only as necessary to perform the services set forth in the underlying service agreement between the parties and as required by law. Business Associate shall not use or disclose PHI in a manner that would violate the privacy rules if done by Covered Entity.

Permitted purposes (check all that apply):

Treatment Payment Healthcare Operations Other (describe below)

Obligations of Business Associate

Business Associate shall: (a) use appropriate safeguards to prevent impermissible uses or disclosures of PHI; (b) report to Covered Entity any use or disclosure of PHI not permitted by this Agreement, including breaches of unsecured PHI; (c) mitigate, to the extent practicable, any harmful effect resulting from a use or disclosure in violation of this Agreement; (d) ensure that any subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees to the same restrictions and conditions that apply to Business Associate herein; and (e) make available PHI and records required to fulfill Covered Entity's obligations under applicable law.

Security and Safeguards

Business Associate agrees to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of PHI. Such safeguards shall include, at a minimum, access controls, encryption where appropriate, audit controls, workforce training, and incident response procedures.

Breach Notification

Business Associate shall notify Covered Entity of any discovery of a breach of unsecured PHI without unreasonable delay and, in any event, no later than 72 hours after discovery, unless a shorter period is required by law. Notification shall include the nature of the breach, the PHI involved, the steps taken to mitigate harm, and contact information for further inquiries.

Subcontractors and Agents

Business Associate shall obtain satisfactory assurances, by written contract, that any subcontractor or agent that will have access to PHI will implement safeguards and agree to the same restrictions and conditions that apply to Business Associate under this Agreement.

Return or Destruction of PHI

Upon termination of this Agreement, Business Associate shall, at Covered Entity's option, return all PHI received from Covered Entity or created or received on behalf of Covered Entity, or shall destroy such PHI. If return or destruction is not feasible, Business Associate shall extend the protections of this Agreement to the retained PHI and limit further uses and disclosures to those purposes that make the return or destruction infeasible.

Term, Termination and Remedies

This Agreement shall commence on the Effective Date and shall continue until the underlying services are completed or until terminated by either party for cause upon thirty (30) days written notice of an uncured material breach. Termination shall not affect rights and obligations regarding PHI that have accrued prior to termination. Remedies for breach include injunctive relief and indemnification for actual damages arising from unauthorized use or disclosure of PHI.

Miscellaneous

This Agreement may be amended only by written agreement signed by both parties. If any provision is held invalid, the remainder shall continue in full force. This Agreement shall be governed by the laws of the state identified by Covered Entity in its signature block, except where preempted by federal law.

HIPAA Acknowledgment

By signing below, Business Associate certifies that it understands the requirements of applicable health information privacy and security laws and agrees to comply with the terms of this Agreement. Covered Entity certifies that it has authority to disclose PHI to Business Associate as permitted by law.

Acknowledged and agreed

Authorization Expiration

This authorization shall expire on:

Test Patient Information

Insurance Information

Medical and Treatment History

Attestations and Certifications

Covered Entity certifies that the PHI disclosed under this Agreement is limited to the minimum necessary to accomplish the intended purpose. Business Associate certifies that it will not use PHI for any purpose other than those expressly permitted in this Agreement and will implement reasonable safeguards to prevent unauthorized disclosures.

Covered Entity Representative Name:

Sign Now