Business Associate Agreement
This Business Associate Agreement ("BAA") is entered into between the dental practice or organization that accepts it ("Covered Entity") and PracticeSteady ("Business Associate"). It governs the Business Associate's handling of Protected Health Information ("PHI") in connection with the PracticeSteady™ Services, and supplements the Terms of Service.
1. Definitions
Capitalized terms not defined here have the meanings in the HIPAA Rules (45 C.F.R. Parts 160 and 164), including "Breach," "Protected Health Information," "Required by Law," "Security Incident," "Subcontractor," and "Unsecured PHI."
2. Permitted uses and disclosures
Business Associate may use and disclose PHI only: (a) to perform the Services for, and as directed by, Covered Entity; (b) as Required by Law; and (c) for the proper management and administration of Business Associate or to carry out its legal responsibilities, provided that disclosures are protected by reasonable assurances of confidentiality. Business Associate will not use or disclose PHI in a manner that would violate the HIPAA Rules if done by Covered Entity.
3. Safeguards
Business Associate will implement administrative, physical, and technical safeguards (including those required by the HIPAA Security Rule for electronic PHI) to protect PHI, and will keep clinical/patient data on HIPAA-eligible infrastructure separated from non-PHI systems.
4. Reporting and breach notification
Business Associate will report to Covered Entity, without unreasonable delay, any use or disclosure of PHI not permitted by this BAA, any Security Incident, and any Breach of Unsecured PHI of which it becomes aware, consistent with 45 C.F.R. § 164.410.
5. Subcontractors
Business Associate will ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on its behalf agrees in writing to restrictions and conditions at least as protective as those in this BAA.
6. Individual rights
To the extent Business Associate maintains PHI in a Designated Record Set, it will make PHI available to enable Covered Entity to meet its obligations regarding individuals' rights of access (§ 164.524), amendment (§ 164.526), and an accounting of disclosures (§ 164.528).
7. Access by HHS
Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the U.S. Department of Health and Human Services as required to determine Covered Entity's compliance.
8. Term and termination
This BAA is effective when accepted and continues while Business Associate handles PHI for Covered Entity. Covered Entity may terminate if Business Associate materially breaches and does not cure. On termination, Business Associate will return or destroy PHI where feasible, or extend the protections of this BAA to any PHI it must retain.
9. Miscellaneous
The parties will amend this BAA as needed to comply with the HIPAA Rules. This BAA is interpreted to permit compliance with HIPAA. In a conflict between this BAA and the Terms of Service regarding PHI, this BAA controls.