Business Associate Agreement

This document is a template provided for convenience and does not constitute legal advice. Before execution, have it reviewed by qualified counsel for your practice. To request an executed agreement, reach out through the For providers page.

This Business Associate Agreement (“Agreement”) by and between Fratera LLC (“Business Associate”) and the undersigned physician or physician practice (“Covered Entity”), is entered into as of ___________ (“Effective Date”), for the purposes of complying with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), Public Law 104-191, as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”), Public Law 111-005, and the regulations promulgated thereunder; 45 C.F.R. Parts 160 and 164, Subparts A, C, D and E (Subpart E, together with the definitions in Subpart A, is known as the “Standards for Privacy of Individually Identifiable Health Information” (the “Privacy Rule”); Subpart C, together with the definitions in Subpart A, is known as the “Security Standards for the Protection of Electronic Protected Health Information” (the “Security Rule”); and Subpart D, together with the definitions in Subpart A, is known as the “Breach Notification Rule”) (the Privacy Rule, Breach Notification Rule and the Security Rule are collectively called the “HIPAA Rules”). Business Associate and Covered Entity are collectively referred to as the “Parties.”

WHEREAS, the undersigned physician or physician practice is a “Covered Entity” as that term is defined under HIPAA, which requires Covered Entities and certain of their service providers to enter into confidentiality agreements; and

WHEREAS, in connection with the certain services agreement(s) between Covered Entity and Business Associate for Business Associate to provide services for and on behalf of Covered Entity (collectively, the “Services Agreement”), Business Associate may create on behalf of, or receive from, the Covered Entity or the Covered Entity’s other service providers protected health information (“PHI”); and

WHEREAS, upon creation or receipt of such PHI, Business Associate would be a “Business Associate” in relation to the Covered Entity, as that term is defined under HIPAA.

NOW, THEREFORE, in consideration of the premises and the mutual promises contained herein, Covered Entity and Business Associate hereby agree as follows:

1. Capitalized Terms

All capitalized terms herein not otherwise defined shall have the meaning ascribed to such terms under HIPAA, the HITECH Act and the HIPAA Rules, as may be amended from time to time.

2. Business Associate’s Responsibilities with Respect to Use and Disclosure of PHI

Business Associate hereby agrees, with regard to its Use and/or Disclosure of the PHI, to do the following:

• to Use and/or Disclose the PHI only:
• to perform functions, activities or services for, or on behalf of Covered Entity, as specified in the Services Agreement;
• for Business Associate’s proper management and administration or to carry out any present or future legal responsibilities, provided (1) the disclosure is Required by Law, or (2) Business Associate obtains reasonable assurances from the person to whom the PHI is disclosed (“Person”) that the PHI will be held confidentially and will be used or further disclosed only as Required by Law or for the purpose for which it was disclosed to the Person, and that the Person agrees to immediately notify Business Associate in writing of any instances of which it becomes aware in which the confidentiality of the information has been breached or is suspected to have been breached;
• to provide Data Aggregation services to Covered Entity as permitted by 42 C.F.R. § 164.504(e)(2)(i)(B);
• to de-identify PHI in accordance with 45 C.F.R. § 164.514(b) and use de-identified information for any purpose;
• to report violations of law to appropriate Federal and State authorities, consistent with 45 C.F.R. § 164.502(j)(1);
• as otherwise permitted or required by this Agreement; or
• as otherwise permitted or Required by Law.
• to not use or disclose PHI other than as permitted or required by this Agreement, the Services Agreement, or as Required by Law;
• to not use or disclose PHI in a manner that would violate the Privacy Rule if done by Covered Entity, unless expressly permitted to do so pursuant to the Privacy Rule;
• to use appropriate administrative, physical, and technical safeguards to prevent use or disclosure of PHI other than as provided for by this Agreement;
• to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic PHI that it creates, receives, maintains, or transmits on behalf of Covered Entity, to prevent the use or disclosure of PHI other than as provided for by this Agreement or the Services Agreement, and to comply with the Security Rule with respect to Electronic PHI;
• to report to Covered Entity any material Use and/or Disclosure of PHI by Business Associate that is not permitted or required by this Agreement of which Business Associate becomes aware;
• to report to Covered Entity any Breach of Unsecured PHI in accordance with 45 C.F.R. § 164.410;
• to require all of Business Associate’s subcontractors utilized in providing the Services that create, receive, maintain, or transmit PHI, or that otherwise access PHI, to agree, in writing, to adhere to equivalent restrictions and conditions on the Use and/or Disclosure of the PHI that apply to Business Associate pursuant to this Agreement and comply with applicable provisions of the Security Rule; and
• to the extent Business Associate carries out an obligation of Covered Entity for which Covered Entity is responsible under the Privacy Rule, to comply with the requirements of the Privacy Rule that apply to Covered Entity in the performance of such obligation.

3. Access Requests

Business Associate shall, upon Covered Entity’s written request, provide Covered Entity with access to PHI in the Designated Record Set so that Covered Entity can comply with 45 C.F.R. § 164.524.

4. Amendment Requests

Business Associate shall, upon Covered Entity’s written request, make any PHI contained in a Designated Record Set available to Covered Entity for purposes of amendment pursuant to 45 C.F.R. § 164.526.

5. Accounting of Disclosures

To the extent applicable, Business Associate shall track and keep a record of all Disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with the Privacy Rule at 45 C.F.R. § 164.528. Business Associate shall provide Covered Entity with such documentation upon the written request of Covered Entity.

6. Requests from Secretary of Health and Human Services

If Business Associate receives a request, made by or on behalf of the Secretary of the United States Department of Health and Human Services (the “Secretary”), requiring Business Associate to make its internal practices, books, and records relating to the Use and Disclosure of the PHI created or received by Business Associate on behalf of Covered Entity available to the Secretary for the purpose of determining Covered Entity’s and/or Business Associate’s compliance with HIPAA, then Business Associate shall make its internal practices, books and records available to the Secretary or the Secretary’s authorized representative.

7. Minimum Necessary

Covered Entity shall provide, and Business Associate shall request, Use and Disclose, only the minimum amount of PHI necessary to accomplish the purpose of the request, Use or Disclosure.

8. Responsibilities of Covered Entity

With regard to the Use and/or Disclosure of the PHI by Business Associate, Covered Entity hereby agrees:

• that the Uses and Disclosures of the PHI by Business Associate pursuant to this Agreement are, at the time of execution and throughout the term of this Agreement will be, consistent with the form of notice of privacy practices that Covered Entity provides to individuals pursuant to 45 C.F.R. § 164.520;
• to notify Business Associate, in writing and in a timely manner, of any arrangements permitted or required of Covered Entity under the Privacy Rule that may impact in any manner the Use and/or Disclosure of the PHI by Business Associate under this Agreement, including, but not limited to, restrictions on Use and/or Disclosure of the PHI as provided for in 45 C.F.R. § 164.522 agreed to by Covered Entity, and to hold Business Associate harmless from the financial impact of any such agreement by Covered Entity;
• to obtain any consent or authorization that may be required under HIPAA or state law prior to furnishing the PHI to Business Associate; and
• not to request Business Associate use or disclose PHI in any manner that would violate the Privacy Rule.

9. Term

The term of this BAA shall commence as of the Effective Date, and shall automatically terminate (a) upon the later of (i) termination of the Services Agreement or (ii) discontinuation of Business Associate’s provision of services to Covered Entity involving the use, disclosure or receipt of Covered Entity’s PHI, and (b) when all of the PHI provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity or, if it is infeasible to return or destroy PHI, protections are extended to such information, in accordance with the provisions of Section 11.

10. Termination

• If either Party determines that the other Party has engaged in a pattern of activity that constitutes a material breach of the other Party’s obligations under this Agreement, the non-breaching Party shall notify the breaching Party and the breaching Party shall have thirty (30) days from receipt of that notice to cure the breach or end the violation. If the breaching Party fails to take reasonable steps to effect such a cure within such a time period, the non-breaching Party may terminate all or part of the service relationship. In no event shall such termination have any effect on sums due from Covered Entity for any services provided by Business Associate under the engagement.
• Where either Party has knowledge of a material breach by the other Party, and cure is not possible, the non-breaching Party shall terminate the portion of the arrangement for Services affected by the breach.

11. Effect of Termination

Upon the event of termination of this Agreement, Business Associate agrees, where feasible, to return or destroy the PHI which Business Associate still maintains in any form. Prior to such return or destruction, Business Associate shall extend the protections of this Agreement to such PHI, and, if return or destruction is infeasible, shall ensure that the use and disclosure of such PHI is limited to those purposes that make the return or destruction of the PHI infeasible.

12. Miscellaneous

The Parties agree that this Agreement is amendable to reflect changes in relevant laws or regulations. The Parties agree to execute such amendatory documents as may be required to comply with the HIPAA Rules.

This Agreement shall be governed by and construed in accordance with the laws of the jurisdiction in which the Covered Entity is located, without regard to its conflict-of-laws principles, and in accordance with applicable federal law.

The Parties agree to mitigate, to the extent practicable, any harmful effect that is known to a Party of a Use or Disclosure of PHI by the other Party in violation of this Agreement.

Nothing in this Agreement shall be construed as an assignment of any rights or obligations from either Party to the other, or as conferring any third-party beneficiary rights.

Signature

IN WITNESS WHEREOF, the Parties have executed this Agreement as of the Effective Date.

Business Associate: Fratera LLC — By: ______________________ Name/Title: ______________________ Date: ____________

Covered Entity: ______________________ — By: ______________________ Name/Title: ______________________ Date: ____________