HIPAA Business Associate Agreement

1. Permitted uses and disclosures

Business Associate may use and disclose PHI only (a) to perform the services described in the Clinic Services Agreement, (b) as required by law, and (c) for the proper management and administration of Business Associate or to carry out its legal responsibilities, provided that disclosures are required by law or made with reasonable assurances of confidentiality and breach notification.

Business Associate will not use or disclose PHI in a manner that would violate HIPAA if done by the Covered Entity, except as permitted above. Business Associate will not sell PHI and will limit uses and disclosures to the minimum necessary.

2. Safeguards

Business Associate will implement administrative, physical, and technical safeguards (including encryption at rest and in transit, access controls, and audit controls) that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic PHI, as required by the Security Rule.

3. Subcontractors

Business Associate will ensure that any subcontractor that creates, receives, maintains, or transmits PHI on its behalf agrees in writing to restrictions and conditions at least as protective as those in this BAA. Embrata’s infrastructure and PHI-touching subprocessors operate under HIPAA business-associate terms and process data in the United States.

PHI is never placed in channels that are not covered by a business-associate agreement. In particular, email is treated as a strictly PHI-free channel (used only for one-time codes and enrollment/notification links) unless and until a BAA-covered email provider is in place.

4. Individual rights

Business Associate will, within a reasonable time, make PHI available to enable the Covered Entity to meet its obligations regarding individuals’ rights of access, amendment, and accounting of disclosures under 45 C.F.R. §§ 164.524, 164.526, and 164.528.

5. Breach notification

Business Associate will report to the Covered Entity any use or disclosure not permitted by this BAA, any Security Incident, and any Breach of Unsecured PHI without unreasonable delay and in no case later than the period required by law, and in any event within sixty (60) days of discovery. The report will include the information required by 45 C.F.R. § 164.410 to the extent available.

6. Access to records

Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of Health and Human Services for purposes of determining compliance with HIPAA.

7. Audit logging & retention

Business Associate maintains an immutable audit log of PHI access, creation, modification, export, and deletion, retained for at least six (6) years, and will make relevant records available to the Covered Entity on reasonable request.

8. Term & termination; return or destruction of PHI

This BAA is effective on acceptance and continues until all PHI is returned or destroyed. On termination, Business Associate will, if feasible, return or destroy all PHI it maintains and retain no copies; where return or destruction is not feasible, it will extend the protections of this BAA to such PHI and limit further uses and disclosures.

The Covered Entity may terminate the Clinic Services Agreement if Business Associate materially breaches this BAA and fails to cure within a reasonable time.

9. Data residency

All PHI is stored and processed in the United States. Business Associate will not transfer PHI outside the United States without the Covered Entity’s prior written consent.