Draft, version 2026-10-18, pending review by our attorney. It will be replaced by the reviewed version before it binds anyone.
Business Associate Agreement
This agreement is between the practice that accepts it when signing up ("Covered Entity") and ("Business Associate"), which provides . It applies to all protected health information (PHI) that Business Associate creates, receives, keeps or sends for Covered Entity. Terms used here have the meanings given in HIPAA (45 CFR Parts 160 and 164).
1. Permitted uses and disclosures
Business Associate may use and disclose PHI only to provide the service to Covered Entity, as required by law, and for its own proper management and administration as 45 CFR 164.504(e)(4) allows. It uses the minimum necessary. It won't sell PHI, use it for marketing, or use it to train AI models for anyone else.
2. Safeguards
Business Associate uses administrative, physical and technical safeguards that comply with the HIPAA Security Rule (Subpart C of Part 164). These include encryption in storage and in transit, two-step sign-in for every user, a separate database for each practice, an access log that can't be edited, and daily backups.
3. Reporting
Business Associate reports to Covered Entity any use or disclosure not allowed by this agreement, any security incident, and any breach of unsecured PHI (45 CFR 164.410). It reports without unreasonable delay, and within 5 business days of discovering a breach. The report includes what is known about the individuals affected and what happened, so Covered Entity can meet its own notification duties.
4. Subcontractors
Business Associate makes sure each subcontractor that handles PHI agrees in writing to the same restrictions (45 CFR 164.502(e)(1)(ii)). These include its cloud host, AI processing within that host, its claims clearinghouse and its e-prescribing network.
5. Individuals' rights
Business Associate helps Covered Entity respond to individuals' requests:
- access to their records (45 CFR 164.524), through exports and chart PDFs available to Covered Entity at any time;
- amendment (164.526), through addenda;
- an accounting of disclosures (164.528), from the access log.
6. Books and records
Business Associate makes its internal practices, books and records about PHI available to the Secretary of HHS to determine compliance.
7. Substance use disorder records (42 CFR Part 2)
Where Covered Entity's records are protected by 42 CFR Part 2, Business Associate also acts as a qualified service organization. It acknowledges that in receiving, storing, processing or otherwise dealing with those records it is fully bound by Part 2. If necessary, it will resist in judicial proceedings any effort to obtain access to those records except as Part 2 permits.
8. Term and termination
This agreement lasts as long as Business Associate holds Covered Entity's PHI. Either party may end the service if the other materially breaches this agreement and doesn't cure the breach within 30 days of notice. When the service ends, Business Associate makes the records available for export for at least 90 days and then returns or destroys the PHI. If return or destruction isn't feasible, it extends these protections for as long as it holds the PHI.
9. Other
This agreement is part of the Terms of Service. If the two conflict, this agreement controls for PHI. It is interpreted to comply with HIPAA as amended.
Accepted electronically at sign-up. The version, time, account and network address are recorded in the practice's settings.