Healthcare Web Design BAA

HEALTHCARE WEB DESIGN BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement ("Agreement") is entered into between the Covered Entity and the Business Associate identified below for the purpose of ensuring compliance with federal and applicable state laws governing protected health information. The parties agree as follows.

Parties and Contact Information

Effective Date and Term

Effective Date:    Termination Date (if any):

Definitions

For purposes of this Agreement, Protected Health Information ("PHI") means individually identifiable health information created, received, maintained or transmitted by the Business Associate on behalf of the Covered Entity that is protected under applicable law.

Description of Services and PHI

Business Associate will perform web design, development, hosting, maintenance and analytics services that may require access to PHI, as described below. The Business Associate is authorized to create, receive, maintain, or transmit the following categories of PHI on behalf of the Covered Entity:

Permitted Uses and Disclosures by Business Associate

Business Associate may use or disclose PHI only to perform the services specified in this Agreement and under the same restrictions and conditions that apply to the Covered Entity under applicable law. Without limiting the foregoing, Business Associate may use PHI:

(a) For provision of web design, hosting, maintenance, analytics, patient portal integration, appointment scheduling, billing interfaces and related services; (b) For administrative functions necessary to perform those services, including quality assurance and reporting; and (c) As required by law.

Prohibited Uses and Disclosures

Business Associate shall not use or disclose PHI in a manner that would violate applicable law if done by the Covered Entity, including for marketing, sale of PHI, or any purpose not specified in this Agreement without prior written authorization from the Covered Entity.

Safeguards; Security Requirements

Business Associate shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of PHI in accordance with applicable law. Minimum safeguards include access controls, audit logging, encryption in transit, encryption at rest where feasible, secure development practices, vulnerability management, and personnel training.

Breach Notification and Response

Business Associate shall report to the Covered Entity any use or disclosure of PHI not permitted by this Agreement, including suspected breaches of unsecured PHI, without unreasonable delay and in no case later than 72 hours after discovery of the breach. The report shall include sufficient information to permit the Covered Entity to meet its obligations under applicable law.

Subcontractors

Business Associate may engage subcontractors to perform functions on its behalf that involve PHI only if Business Associate obtains satisfactory assurances in writing that the subcontractor will implement appropriate safeguards and comply with applicable provisions of this Agreement.

Access, Amendment, and Accounting

Upon request, Business Associate shall provide access to PHI in a Designated Record Set to the Covered Entity or, as directed by the Covered Entity, to an individual, in order to meet the requirements of access, amendment and accounting of disclosures under applicable law. Business Associate shall promptly notify Covered Entity of any requests received directly by Business Associate.

Return or Destruction of PHI

Upon termination or expiration of this Agreement for any reason, Business Associate shall return or, if infeasible, securely destroy all PHI received from, or created or received on behalf of, the Covered Entity and shall retain no copies except as required by law. If destruction is infeasible, Business Associate shall extend protections of this Agreement to such PHI and limit further uses and disclosures.

Audit and Inspection

Business Associate shall make available to the Covered Entity information necessary to demonstrate compliance with this Agreement and shall permit reasonable inspection and audit by the Covered Entity or its designee, subject to reasonable notice and scheduling and applicable confidentiality protections.

Indemnification and Liability

Each party shall indemnify, defend and hold the other harmless from and against losses, damages, liabilities, and expenses resulting from any breach by the indemnifying party of its obligations under this Agreement, including failure to safeguard PHI. Nothing in this Agreement shall be construed to waive statutory limitations or immunities where applicable.

Amendment; Governing Law

This Agreement may be amended only by written instrument executed by both parties. This Agreement shall be governed by and construed in accordance with the laws of the state specified by the Covered Entity, without regard to conflicts of law principles.

Miscellaneous Provisions

The parties acknowledge that the obligations set forth in this Agreement are independent of any underlying services agreement, and in the event of a conflict between this Agreement and any other agreement, the terms providing greater protection for PHI shall control. If any provision of this Agreement is found to be invalid or unenforceable, the remainder shall remain in full force and effect.

Representative Patient Information (if applicable)

The following fields capture a sample patient record structure or representative patient used for testing, staging, or integration. No actual patient data should be entered in this Agreement unless authorized.

Date of Birth:    Gender:

Insurance and Medical History (Representative)

Certification and Acknowledgment

By signing below, the individuals authorized to sign on behalf of the Covered Entity and Business Associate certify that they are duly authorized to execute this Agreement and that the parties will comply with the terms set forth herein. The parties acknowledge that this Agreement imposes specific regulatory obligations regarding the privacy and security of PHI.

Sign Now