Business Associate Agreement (template)

This Business Associate Agreement ("Agreement") is entered into as of [EFFECTIVE DATE] between [CUSTOMER LEGAL NAME] ("Covered Entity") and Bell LLC, provider of eDocYouSign ("Business Associate").

1. Definitions

Terms used but not defined in this Agreement have the meanings given in the HIPAA Rules (45 C.F.R. Parts 160 and 164), including "Breach," "Protected Health Information" ("PHI"), "Security Incident," "Subcontractor" and "Unsecured PHI."

2. Obligations of Business Associate

Business Associate agrees to:

1. not use or disclose PHI other than as permitted by this Agreement or required by law;
2. use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 C.F.R. Part 164, to prevent use or disclosure of electronic PHI other than as provided by this Agreement;
3. report to Covered Entity any use or disclosure of PHI not provided for by this Agreement, including Breaches of Unsecured PHI as required by 45 C.F.R. 164.410, and any Security Incident of which it becomes aware, without unreasonable delay and in no case later than [10] business days after discovery. The parties agree that unsuccessful attempts such as pings, port scans and blocked log-in attempts are reported by this sentence and need no further notice;
4. ensure that any Subcontractors that create, receive, maintain or transmit PHI on its behalf agree to the same restrictions, conditions and requirements, in accordance with 45 C.F.R. 164.502(e)(1)(ii) and 164.308(b)(2);
5. make available PHI in a Designated Record Set to Covered Entity as necessary to satisfy its obligations under 45 C.F.R. 164.524, and make amendments as directed under 164.526, to the extent Business Associate maintains such PHI in readable form;
6. maintain and make available the information required to provide an accounting of disclosures under 45 C.F.R. 164.528;
7. to the extent it carries out an obligation of Covered Entity under Subpart E of 45 C.F.R. Part 164, comply with the requirements of Subpart E that apply to that obligation; and
8. make its internal practices, books and records available to the Secretary of Health and Human Services for purposes of determining compliance with the HIPAA Rules.

Encryption. Documents and field values are encrypted in the user's browser with keys that Business Associate does not receive. The parties agree that PHI within such encrypted content is not accessible to Business Associate in readable form.

3. Permitted uses and disclosures

1. Business Associate may use and disclose PHI only as necessary to provide the eDocYouSign service to Covered Entity under the Terms of Service, as required by law, and for the proper management and administration of Business Associate, provided that disclosures for such management are required by law or made with reasonable assurances of confidentiality.
2. Business Associate will not de-identify PHI or use it for its own marketing or sale.
3. Business Associate will make uses, disclosures and requests for PHI consistent with Covered Entity's minimum necessary policies and procedures.

4. Obligations of Covered Entity

1. Covered Entity will notify Business Associate of any limitation in its notice of privacy practices, changes in or revocation of an individual's permission, or restrictions it has agreed to, to the extent they may affect Business Associate's use or disclosure of PHI.
2. Covered Entity will not ask Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Covered Entity.
3. Covered Entity is responsible for keeping access codes, passphrases and recovery keys confidential and for choosing who may access its workspace.

5. Term and termination

1. This Agreement begins on the effective date and ends when Covered Entity's subscription ends, or on termination for cause as below.
2. If either party determines the other has violated a material term of this Agreement, it may terminate this Agreement and the related services if the violation isn't cured within 30 days of written notice.
3. On termination, Business Associate will return or destroy all PHI it maintains, retaining no copies, within 30 days and from backups within [60] days. If return or destruction is infeasible, Business Associate will extend the protections of this Agreement to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible.

6. Miscellaneous

1. A reference to a section of the HIPAA Rules means that section as in effect or amended.
2. The parties will amend this Agreement as needed to comply with changes in the HIPAA Rules.
3. Any ambiguity will be resolved to permit compliance with the HIPAA Rules.
4. If this Agreement conflicts with the Terms of Service, this Agreement controls as to PHI.
5. This Agreement is governed by the laws of [STATE].

Signatures

This template is provided for general information. It is not legal advice. Have your attorney review it for your situation. Business Associate signs BAAs on Business and Enterprise plans.