Legal HIPAA Contract Forms

HIPAA BUSINESS ASSOCIATE AGREEMENT

This HIPAA Business Associate Agreement ("Agreement") is entered into as of Effective Date: , by and between Covered Entity: whose principal place of business is , and Business Associate: whose principal place of business is (each a "Party" and collectively the "Parties").

RECITALS

WHEREAS, Covered Entity is subject to the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations and amendments (collectively, "HIPAA Rules") governing the privacy and security of Protected Health Information;

WHEREAS, Business Associate may receive, create, maintain, transmit or have access to Protected Health Information on behalf of Covered Entity in connection with services described in the underlying services agreement between the Parties; and

WHEREAS, the Parties intend to define their respective rights and obligations with respect to Protected Health Information in order to comply with applicable HIPAA Rules.

NOW, THEREFORE

In consideration of the mutual promises set forth herein and other good and valuable consideration, the receipt and sufficiency of which are acknowledged, the Parties agree as follows:

1. DEFINITIONS

1.1 "Protected Health Information" or "PHI" means individually identifiable health information that is transmitted or maintained in any form, whether electronic, paper or oral, that is created by or received from Covered Entity and is protected under HIPAA Rules.

1.2 Terms used but not defined in this Agreement shall have the meanings set forth in HIPAA Rules.

2. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE

2.1 Business Associate may use or disclose PHI only as necessary to perform the services set forth in the underlying services agreement, as permitted by this Agreement, and as required by law. Business Associate shall not use or disclose PHI in a manner that would violate HIPAA Rules if done by Covered Entity.

2.2 Business Associate may de-identify PHI in accordance with HIPAA Rules and may use or disclose de-identified information without restriction provided that Business Associate follows the requirements for de-identification set forth in HIPAA Rules.

3. OBLIGATIONS OF BUSINESS ASSOCIATE

3.1 Business Associate shall implement and maintain administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of PHI, including safeguards required by the HIPAA Security Rule.

3.2 Business Associate shall report to Covered Entity any use or disclosure of PHI not permitted by this Agreement, any security incident affecting PHI, and any actual or suspected breach of unsecured PHI as required by law. Such report shall be made without unreasonable delay and in all events no later than five (5) business days after Business Associate becomes aware of the event, and shall include available details regarding the nature, extent, remedial measures and affected individuals.

3.3 Business Associate shall ensure that any subcontractors or agents that create, receive, maintain or transmit PHI on its behalf agree in writing to the same restrictions and conditions that apply to Business Associate under this Agreement.

4. OBLIGATIONS OF COVERED ENTITY

4.1 Covered Entity shall notify Business Associate of any limitations in the notice of privacy practices or in the manner in which Covered Entity permits the use or disclosure of PHI that may affect Business Associate's use or disclosure of PHI.

4.2 Covered Entity shall notify Business Associate of any reasonable requests by individuals for restrictions on the use or disclosure of PHI or for confidential communications to the extent such restrictions apply to the services performed by Business Associate.

5. ACCESS, AMENDMENT AND ACCOUNTING

5.1 To the extent Business Associate maintains PHI in a designated record set, Business Associate shall make PHI available to Covered Entity and, if directed by Covered Entity, to individuals, for access, inspection, copying or amendment in accordance with HIPAA Rules. Business Associate will cooperate with Covered Entity to provide any required information in the timeframes necessary for Covered Entity to comply with HIPAA.

5.2 Business Associate shall maintain records of disclosures and provide accounting of disclosures as required by HIPAA Rules and as requested by Covered Entity to permit Covered Entity to comply.

6. RETURN OR DESTRUCTION OF PHI

6.1 Upon termination or expiration of this Agreement for any reason, Business Associate shall, at Covered Entity's option, return or destroy all PHI received from Covered Entity or created or received on behalf of Covered Entity. Business Associate shall provide a written certification of return or destruction within thirty (30) days.

6.2 If return or destruction is not feasible, Business Associate shall extend the protections of this Agreement to the PHI and limit further uses and disclosures to those purposes that make the return or destruction infeasible, until such time as return or destruction becomes feasible.

7. INDEMNIFICATION AND LIMITATION OF LIABILITY

7.1 Business Associate shall indemnify, defend and hold harmless Covered Entity from and against any and all losses, liabilities, damages, costs and expenses (including reasonable attorney fees) arising out of Business Associate's breach of this Agreement or violation of HIPAA Rules attributable to Business Associate's acts or omissions.

7.2 Nothing in this Agreement shall be construed to waive any defenses or limitations of liability otherwise available to either Party under applicable law, except as expressly provided herein.

8. TERM AND TERMINATION

8.1 Term. This Agreement shall commence on the Effective Date and shall continue in full force and effect for the duration of the underlying services agreement and for so long as Business Associate creates, receives, maintains or transmits PHI on behalf of Covered Entity.

8.2 Termination for Cause. Covered Entity may immediately terminate this Agreement and the underlying services agreement if Covered Entity determines that Business Associate has violated a material term of this Agreement and fails to cure such violation within a reasonable period after written notice.

9. MISCELLANEOUS PROVISIONS

9.1 Notices. All notices required or permitted under this Agreement shall be in writing and delivered to the Parties' designated notice contacts set forth below. Notice is effective upon receipt.

9.2 Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the State of without regard to conflict of law principles.

9.3 Entire Agreement. This Agreement, together with any underlying services agreement, constitutes the entire agreement between the Parties with respect to PHI and supersedes all prior agreements, understandings and representations.

9.4 Amendments. Any amendment to this Agreement shall be in writing and signed by both Parties. The Parties agree to enter into such amendments as may be necessary for compliance with changes in HIPAA Rules.

9.5 Severability. If any provision of this Agreement is held invalid or unenforceable, the remainder of this Agreement shall remain in full force and effect.

9.6 Waiver. A Party's failure to enforce any provision of this Agreement shall not constitute a waiver of future enforcement of that or any other provision.

9.7 Counterparts. This Agreement may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one instrument.

NOTICES

ADDITIONAL SECURITY AND COMPLIANCE INFORMATION

Sign Now