Business Associate Agreement (HIPAA) — Delaware, United States; New York, United States; California, United States; United States (Federal) | IndexLaw Templates
Business associate agreementDelaware, United States · New York, United States · California, United States · United States (Federal)
Business Associate Agreement (HIPAA)
A HIPAA business associate agreement, made as an addendum to an underlying services agreement (the Main Agreement), between a covered entity and its business associate or between a business associate and its subcontractor. Adapted from three published business associate agreements and checked against the HIPAA Privacy, Security and Breach Notification Rules (45 CFR Parts 160 and 164): permitted uses and disclosures, minimum necessary, safeguards, reporting of impermissible uses, security incidents and breaches with a choice of reporting periods, subcontractor flow-down, individual access, amendment and accounting, HHS access, termination and return or destruction of PHI, with balanced, Covered Entity-leaning and Business Associate-leaning positions on breach costs, liability, indemnity, audit, offshore processing and de-identification. Whether the vendor is a HIPAA business associate at all, so that this agreement and not a data processing agreement is the right instrument, is settled by the decision card (business_associate_status), from the facts, not assumed from the label.
What it covers
A vendor that creates, receives, maintains or transmits protected health information on behalf of a US covered entity (health plan, health care clearinghouse or covered health care provider) under a separate services agreement.
A business associate and its subcontractor, using the subcontractor variant of the Background and Roles clause.
The contract terms 45 CFR 164.504(e) and 164.314(a) require: permitted and required uses, safeguards and Security Rule compliance, reporting including breaches of unsecured PHI, subcontractor flow-down, access, amendment and accounting, compliance with covered entity obligations, HHS access to books and records, return or destruction, and termination for material violation.
Optional management-and-administration, data aggregation and de-identification permissions, no sale of PHI or marketing, mitigation and covered entity obligations.
Negotiated positions with alternatives: reporting period (contractual, statutory 60-day limit or prompt initial notice), who gives breach notices and who pays, liability cap, indemnity, customer audit, offshore processing, term and return of PHI.
What it does not cover
Arrangements outside the United States: HIPAA is US federal law. For personal data processed for a customer under other laws, or US personal data that is not protected health information, use a data processing agreement.
The services, fees and other commercial terms, which stay in the Main Agreement.
Records subject to the separate federal confidentiality rules for substance use disorder treatment programs, state health-privacy statutes beyond a general deference to shorter legal periods, limited data set data use agreements, group health plan and plan sponsor arrangements, and agreements between governmental entities.
Deciding whether the vendor is a business associate: the decision card sets out the test; a lawyer should confirm a close case.
Document preview29 sections
INDEXLAW / CONTRACT LIBRARYAGREEMENT TEMPLATE
Business Associate Agreement (HIPAA)
Delaware, United States · New York, United States · California, United States · United States (Federal)
Highlighted blanks are the details your parties fill in.
Parties
This agreement is dated the date on which it is signed by the last of the parties.
This agreement is made between [TO BE CONFIRMED — Covered Entity legal name and details] (the "Covered Entity") and [TO BE CONFIRMED — Business Associate legal name and details] (the "Business Associate").
Definitions
"Main Agreement" means [TO BE CONFIRMED — Main Agreement (title, parties and date of the underlying services agreement)], being the separate agreement under which the Business Associate provides services to the Covered Entity to which this agreement relates, as amended from time to time.
Related agreements
Explore more templates in this category or region.
Delaware, United States · New York, United States · California, United States · United States (Federal)
Consumer services
Hospitality & travel
Healthcare & life sciences
Education & non-profit
"HIPAA" means the Health Insurance Portability and Accountability Act of 1996, as amended by Subtitle D of the Health Information Technology for Economic and Clinical Health Act of 2009 (the "HITECH Act"), and their implementing regulations, each as amended from time to time.
"HIPAA Rules" means the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Part 160 and Part 164. Within them, the "Privacy Rule" means the standards at 45 CFR Part 160 and Subparts A and E of Part 164, and the "Security Rule" means the standards at 45 CFR Part 160 and Subparts A and C of Part 164.
"Breach", "Data Aggregation", "Designated Record Set", "Disclosure", "Health Care Operations", "Individual", "Minimum Necessary", "Notice of Privacy Practices", "Required by Law", "Secretary", "Subcontractor", "Unsecured PHI" (unsecured protected health information), "Use" and any other term defined in the HIPAA Rules, whether capitalized or not, have the meanings given to them in the HIPAA Rules unless this agreement defines them differently. "Individual" includes a person who qualifies as a personal representative under 45 CFR 164.502(g).
"PHI" means protected health information, including electronic protected health information, as defined in 45 CFR 160.103, that the Business Associate creates, receives, maintains or transmits on behalf of the Covered Entity in connection with the Main Agreement.
"Security Incident" has the meaning given in 45 CFR 164.304 (the attempted or successful unauthorized access, use, disclosure, modification or destruction of information or interference with system operations in an information system), in each case involving PHI or an information system of the Business Associate or a Subcontractor that contains PHI.
"Unsuccessful Security Incident" means an attempted but unsuccessful Security Incident that does not result in unauthorized access, use, disclosure, modification or destruction of PHI or interference with an information system containing PHI, such as pings or other broadcast attacks on a firewall, denial-of-service attacks, port scans, unsuccessful login attempts, or interception of encrypted information where the key is not compromised, or any combination of them.
A reference in this agreement to a section or subpart of the HIPAA Rules is to that section or subpart as in effect from time to time.
Background and Roles
The Business Associate provides services to the Covered Entity under the Main Agreement that may involve creating, receiving, maintaining or transmitting PHI on the Covered Entity's behalf. The Covered Entity is a covered entity under HIPAA and the Business Associate acts as its business associate in providing those services. This agreement is an addendum to the Main Agreement and sets out the terms on which the Business Associate may create, receive, maintain, transmit, use and disclose PHI.
Permitted Uses and Disclosures
The Business Associate may use and disclose PHI to perform the functions, activities or services for, or on behalf of, the Covered Entity specified in the Main Agreement, as otherwise permitted by this agreement, or as Required by Law.
The Business Associate will not use or disclose PHI other than as permitted or required by this agreement or as Required by Law, and will not use or disclose PHI in any manner that would violate Subpart E of 45 CFR Part 164 if done by the Covered Entity, except for any use or disclosure for its own management and administration or for Data Aggregation that this agreement expressly permits. The Business Associate will ensure that its agents and Subcontractors comply with the same restrictions.
The Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities. It may disclose PHI for those purposes only if the disclosure is Required by Law, or if it first obtains reasonable assurances from the person to whom the PHI is disclosed that the PHI will be held confidentially and used or further disclosed only as Required by Law or for the purpose for which it was disclosed to that person, and that the person will notify the Business Associate of any instance of which it is aware in which the confidentiality of the PHI has been breached.
The Business Associate may use PHI to provide Data Aggregation services relating to the Health Care Operations of the Covered Entity, combining PHI with protected health information it receives as a business associate of other covered entities only to permit data analyses that relate to the health care operations of the respective covered entities.
The Business Associate may use PHI to create information that is de-identified in accordance with 45 CFR 164.514(a) to (c). Information de-identified in that way is not PHI, and the Business Associate may use and disclose it for any lawful purpose, but will not attempt to re-identify any Individual.
The Business Associate will not sell PHI (as 45 CFR 164.502(a)(5)(ii) defines a sale) except pursuant to and in compliance with an authorization under 45 CFR 164.508(a)(4) that the Covered Entity has obtained and given to it, and will not use or disclose PHI for marketing (as 45 CFR 164.501 defines it) except as the Covered Entity directs in writing and in compliance with 45 CFR 164.508(a)(3). The Business Associate will comply with the requirements of the HITECH Act that apply to business associates.
Minimum Necessary
The Business Associate will make reasonable efforts to limit its uses and disclosures of, and requests for, PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure or request, in accordance with the HIPAA Rules (including 45 CFR 164.502(b)).
Safeguards
The Business Associate will implement and maintain appropriate administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of PHI and prevent the use or disclosure of PHI other than as provided for by this agreement, and will comply with Subpart C of 45 CFR Part 164 (the Security Rule) with respect to electronic PHI.
Reporting
The Business Associate will report to the Covered Entity in writing, without unreasonable delay and in any event within 10 calendar days after discovery (or any shorter period applicable law requires), except where 45 CFR 164.412 permits a delay: (a) any use or disclosure of PHI not provided for by this agreement of which it becomes aware; (b) any Security Incident of which it becomes aware, Unsuccessful Security Incidents being reported as the Unsuccessful Security Incidents clause provides; and (c) any Breach of Unsecured PHI, as 45 CFR 164.410 requires. A Breach is treated as discovered on the first day on which it is known to the Business Associate or, by exercising reasonable diligence, would have been known to it, as 45 CFR 164.410(a)(2) provides. A report of a Breach will include, to the extent possible: the identification of each Individual whose Unsecured PHI has been, or is reasonably believed by the Business Associate to have been, accessed, acquired, used or disclosed during the Breach; a brief description of what happened, including the date of the Breach and the date of its discovery, if known; a description of the types of Unsecured PHI involved; and a brief description of what the Business Associate is doing to investigate the Breach, to mitigate harm and to protect against further Breaches. If any of that information is not available when the report is made, the Business Associate will continue to investigate diligently and supplement the report as the information becomes available, including with any other available information the Covered Entity needs to notify Individuals under 45 CFR 164.404(c), and will cooperate with the Covered Entity's reasonable requests for information needed to evaluate the Breach.
Unsuccessful Security Incidents
The parties acknowledge that Unsuccessful Security Incidents occur in the normal course of business, and agree that this clause is notice by the Business Associate to the Covered Entity of Unsuccessful Security Incidents for the purposes of the HIPAA Rules, so that no further notice of them is required.
Notification of Breaches
The Covered Entity decides whether a Breach requires notice to Individuals, the Secretary or the media under the HIPAA Rules and gives any such notice. The Business Associate will not notify Individuals, the Secretary, the media or any other third party of a Breach or Security Incident involving PHI without the Covered Entity's prior written approval unless the law requires it to do so, and will not otherwise disclose information related to a Security Incident except as the law requires.
Costs of a Breach
The Business Associate will reimburse the Covered Entity for the costs reasonably associated with a Breach or Security Incident caused by the Business Associate or any of its Subcontractors, including the reasonable costs of investigation, of notifying Individuals, the Secretary and the media, of a call center, and of credit monitoring or identity protection services that the Covered Entity reasonably offers to affected Individuals.
Mitigation
The Business Associate will mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure of PHI by the Business Associate or a Subcontractor in violation of this agreement, and will promptly tell the Covered Entity what action it has taken.
Subcontractors
In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), the Business Associate may disclose PHI to a Subcontractor, and allow a Subcontractor to create, receive, maintain or transmit PHI on its behalf, only if the Subcontractor first agrees in writing to the same restrictions, conditions and requirements that apply to the Business Associate under this agreement with respect to that PHI, including compliance with the Security Rule for electronic PHI and the reporting of Security Incidents and Breaches. If the Business Associate knows of a pattern of activity or practice of a Subcontractor that constitutes a material breach or violation of the Subcontractor's obligations, it will take reasonable steps to cure the breach or end the violation and, if those steps are unsuccessful, terminate the arrangement with the Subcontractor if feasible.
Location of PHI
The Business Associate will not, and will ensure that its Subcontractors do not, store, access, use or disclose PHI outside the United States without the Covered Entity's prior written consent.
Individual Rights
Within 10 business days after a request by the Covered Entity, the Business Associate will (a) make PHI in a Designated Record Set available to the Covered Entity, including in electronic form where 45 CFR 164.524 requires it, as necessary for the Covered Entity to meet its obligations under 45 CFR 164.524; and (b) make PHI in a Designated Record Set available for amendment and incorporate any amendments to it as directed or agreed to by the Covered Entity under 45 CFR 164.526. If an Individual asks the Business Associate directly for access to or amendment of PHI, the Business Associate will forward the request to the Covered Entity promptly and will not respond to it except as the Covered Entity directs or the law requires. The Covered Entity decides whether to grant or deny any request.
The Business Associate will document the disclosures of PHI made by it and its Subcontractors that the Covered Entity would need to include in an accounting of disclosures under 45 CFR 164.528, keep that documentation for six years from the date of each disclosure, and within 10 business days after a request by the Covered Entity give the Covered Entity the information it needs to respond to an Individual's request for an accounting in accordance with 45 CFR 164.528, including for each disclosure: the date of the disclosure; the name of the entity or person who received the PHI and, if known, their address; a brief description of the PHI disclosed; and a brief statement of the purpose of the disclosure. If an Individual asks the Business Associate directly for an accounting, it will forward the request to the Covered Entity promptly.
Covered Entity Obligations Performed by the Business Associate
To the extent the Business Associate carries out any of the Covered Entity's obligations under Subpart E of 45 CFR Part 164, it will comply with the requirements of Subpart E that apply to the Covered Entity in the performance of those obligations.
Access by the Secretary
The Business Associate will make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary for the purpose of determining compliance with the HIPAA Rules. Unless the law prohibits it, the Business Associate will promptly notify the Covered Entity of any request by the Secretary that relates to the Covered Entity and give it copies of any documents produced in response.
Compliance Information
On the Covered Entity's reasonable request, the Business Associate will make its books, records and internal policies and procedures relating to its compliance with this agreement available to the Covered Entity, except information whose disclosure would breach its confidentiality obligations to others, disclose its trade secrets or compromise the security of its systems or of other customers' data.
Obligations of the Covered Entity
The Covered Entity will notify the Business Associate of: (a) any limitation in its notice of privacy practices under 45 CFR 164.520; (b) any change in, or revocation of, permission by an Individual to use or disclose PHI; and (c) any restriction on the use or disclosure of PHI that it has agreed to or is required to abide by under 45 CFR 164.522, in each case to the extent that it may affect the Business Associate's use or disclosure of PHI.
The Covered Entity will not ask the Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by the Covered Entity, except for any use or disclosure for the Business Associate's management and administration or for Data Aggregation that this agreement expressly permits.
Term and Termination
This agreement starts on the date stated in the Parties section and ends when the Main Agreement expires or terminates, unless it is terminated earlier under this clause; the obligations described in the Survival clause continue after it ends.
If either party determines that the other has violated a material term of this agreement, it may give written notice describing the violation. If the other party does not cure the breach or end the violation within 30 days after the notice, the notifying party may terminate this agreement by further written notice; where the Covered Entity terminates, it may also terminate the Main Agreement, or the services under it that involve PHI, by the same notice. A material breach of this agreement is a material breach of the Main Agreement.
Return or Destruction of PHI
Within 60 days after this agreement ends, the Business Associate will, at the Covered Entity's election, return or destroy all PHI that it or its Subcontractors still maintain in any form, retain no copies and, on request, certify in writing that it has done so. If returning or destroying any PHI is not feasible, the Business Associate will tell the Covered Entity why, extend the protections of this agreement to that PHI and limit further uses and disclosures of it to those purposes that make its return or destruction infeasible, for as long as it maintains the PHI.
Survival
The Business Associate's obligations under this agreement continue after it ends for as long as the Business Associate or any Subcontractor maintains any PHI. The Return or Destruction of PHI clause, the reporting obligations for matters occurring before this agreement ended, and every other provision that by its nature is intended to survive, survive the end of this agreement.
Relationship to the Main Agreement
This agreement forms part of the Main Agreement. If a provision of this agreement conflicts with a provision of the Main Agreement, this agreement prevails to the extent of the conflict as regards PHI. Otherwise this agreement is construed in accordance with the Main Agreement, whose other terms, including its notice provisions, apply to it and remain in full force.
Liability
The limitations and exclusions of liability in the Main Agreement apply to each party's liability arising out of or relating to this agreement, and that liability counts towards any cap on liability in the Main Agreement.
Indemnity
The indemnification provisions of the Main Agreement apply to claims arising out of or relating to this agreement, and this agreement creates no separate indemnity.
Amendment
If the HIPAA Rules are amended or interpreted in a manner that makes this agreement inconsistent with them, the parties will cooperate in good faith and take the action necessary to amend this agreement to the extent needed to comply. Otherwise this agreement may be amended only in writing signed by both parties.
Interpretation
Any ambiguity in this agreement will be resolved to permit the parties to comply with HIPAA and the HIPAA Rules.
No Third-Party Beneficiaries
There are no third-party beneficiaries to this agreement, and nothing in it confers any right or remedy on any person other than the parties and their permitted successors and assigns.
Relationship of the Parties
The parties are independent contractors, not agents, partners or joint venturers, and neither will represent itself as the agent or legal representative of the other for any purpose.
Governing Law
This agreement is to be interpreted in accordance with HIPAA and the HIPAA Rules. Subject to that, it is governed by the law that governs the Main Agreement, and disputes under it are resolved in the courts or other forum that the Main Agreement specifies.