Legal HIPAA Attestation Form

Legal HIPAA Attestation Form

This HIPAA Attestation (the "Attestation") is made effective as of Effective Date: by and between Covered Entity Name: with principal address: (hereinafter "Covered Entity") and Business Associate Name: with principal address: (hereinafter "Business Associate").

RECITALS

WHEREAS, Covered Entity engages Business Associate to perform certain services that involve the creation, receipt, maintenance or transmission of protected health information as defined by the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA");

WHEREAS, the parties maintain obligations under HIPAA and the Health Information Technology for Economic and Clinical Health Act ("HITECH") to implement administrative, physical and technical safeguards designed to protect the confidentiality, integrity and availability of protected health information ("PHI");

WHEREAS, this Attestation documents the parties' mutual representations and commitments regarding Business Associate's compliance with applicable HIPAA requirements and related security and privacy obligations.

NOW, THEREFORE, in consideration of the mutual covenants contained herein and other good and valuable consideration, the receipt and sufficiency of which are acknowledged, the parties agree as follows:

1. DEFINITIONS

Capitalized terms used but not otherwise defined in this Attestation have the meanings assigned to such terms in HIPAA and its implementing regulations. For purposes of this Attestation, "PHI" means protected health information as defined by 45 C.F.R. § 160.103.

2. ATTESTATION OF COMPLIANCE

Business Associate hereby attests, represents and warrants to Covered Entity that, as of the Effective Date and continuing through the term of the parties' underlying agreement, Business Associate has established and maintains administrative, physical and technical safeguards reasonably designed to protect the confidentiality, integrity and availability of PHI, and is in compliance with the applicable provisions of HIPAA and HITECH.

To evidence the foregoing, Business Associate certifies the following (check each applicable statement and provide details where requested):

3. REPRESENTATIONS AND WARRANTIES

Business Associate represents and warrants that: (a) it will use and disclose PHI only as permitted by the parties' applicable agreement and HIPAA; (b) it will implement and maintain reasonable and appropriate administrative, physical and technical safeguards to prevent use or disclosure of PHI not permitted by the parties' agreement; and (c) upon discovery of any actual or suspected breach or security incident involving PHI, it will notify Covered Entity in accordance with Section 5 below.

4. SECURITY SAFEGUARDS

Business Associate shall maintain safeguards that are at least as protective as those required by HIPAA, including but not limited to access controls, audit controls, integrity controls, person or entity authentication and transmission security. Business Associate shall document the technical and organizational measures employed and make such documentation available to Covered Entity upon reasonable request for the purpose of auditing compliance.

5. BREACH NOTIFICATION

Business Associate shall notify Covered Entity without unreasonable delay and in no event later than 72 hours after discovery of any security incident or breach involving unsecured PHI. Notification shall include, to the extent known at the time of notification, a description of the nature of the breach, the PHI affected, steps taken to mitigate harm, and corrective action planned or taken. Business Associate shall reasonably cooperate with Covered Entity’s investigation and required notifications to affected individuals and regulators.

6. TRAINING AND WORKFORCE

Business Associate shall ensure that all members of its workforce with access to PHI receive appropriate privacy and security training and are subject to sanctions for violations of policies. Business Associate will maintain training records for a minimum of three years and make those records available to Covered Entity upon request.

7. SUBCONTRACTORS & AGENTS

Business Associate shall require any subcontractor or agent that creates, receives, maintains or transmits PHI on behalf of Business Associate to agree in writing to substantially the same restrictions and conditions that apply to Business Associate under this Attestation and applicable law. Business Associate remains fully liable for any subcontractor's failure to comply.

8. AUDITS; RECORDS

Business Associate shall maintain records necessary to demonstrate compliance with this Attestation and HIPAA. Covered Entity may, upon reasonable notice and during normal business hours, audit Business Associate's relevant policies, procedures and records or require independent third-party audit reports prepared in accordance with generally accepted standards.

9. TERM; TERMINATION

This Attestation shall commence on the Effective Date and shall remain in effect for the duration of the parties' underlying service agreement or until terminated pursuant to that agreement. Upon termination, Business Associate shall return or securely destroy PHI in accordance with the parties' agreement and applicable law.

10. INDEMNIFICATION

Each party shall indemnify, defend and hold harmless the other party from and against any third-party claim, liability, loss or expense arising from its own breach of this Attestation or violation of HIPAA. The indemnifying party shall have the right to control the defense and settlement of any such claim, provided that the indemnifying party shall not settle any claim that imposes liability on the indemnified party without the indemnified party's prior written consent.

11. NOTICES

Any notice required or permitted under this Attestation shall be in writing and delivered to the parties at the addresses set forth below or to such other address as either party may designate by written notice in accordance with this section. Notices shall be deemed effective upon receipt.

12. AMENDMENT; WAIVER

No amendment or modification of this Attestation will be effective unless in writing and signed by both parties. Failure by either party to enforce any provision shall not constitute a waiver of that provision or the right to enforce it in the future.

13. GOVERNING LAW

This Attestation shall be governed by and construed in accordance with the laws of the state specified below without regard to conflict of law principles. The parties consent to the exclusive jurisdiction of the state and federal courts located therein.

14. ENTIRE AGREEMENT; SEVERABILITY

This Attestation, together with any underlying services agreement between the parties, constitutes the entire agreement between the parties with respect to the subject matter herein and supersedes all prior and contemporaneous agreements and understandings. If any provision of this Attestation is held invalid or unenforceable by a court of competent jurisdiction, the remaining provisions shall remain in full force and effect.

CERTIFICATION

The undersigned, as an authorized representative of the party for which they sign, certifies that the statements in this Attestation are true, complete and accurate to the best of their knowledge as of the Effective Date and that the signing party will comply with the representations, warranties and obligations set forth herein. The undersigned further acknowledges that false statements may result in contractual remedies and other penalties permitted by law.

Sign Now