Business Associate Agreement

An organization that handles protected health information executes a business associate agreement with Backsplice LLC in the app, under Settings → Agreements. Our standard agreement, which you can read on our site, is signed by Backsplice in advance and takes effect when you sign it; or you can provide your own, which we review and countersign.

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (this "Agreement") takes effect on the date
Customer signs it, as recorded with this Agreement (the "Effective Date"), between:

  CUSTOMER:           [CUSTOMER LEGAL NAME], which is a covered entity or a business associate

  BUSINESS ASSOCIATE: Backsplice LLC

Customer and Business Associate are each a "Party" and together the "Parties".
Business Associate provides Customer a compliance software service that may involve
creating, receiving, maintaining, or transmitting Protected Health Information on
Customer's behalf. The Parties enter into this Agreement to comply with the Privacy,
Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164
(collectively, the "HIPAA Rules"). Where Customer is a business associate, Business
Associate is its subcontractor, and this Agreement is the written contract 45 CFR
164.502(e)(1)(ii) and 164.504(e)(5) require between them.

1. DEFINITIONS

1.1 Capitalized terms used but not otherwise defined in this Agreement have the
meanings given to them in the HIPAA Rules, including Breach, Data Aggregation,
Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum
Necessary, Protected Health Information, Required By Law, Secretary, Security
Incident, Subcontractor, Unsecured Protected Health Information, and Use.

1.2 "PHI" means Protected Health Information that Business Associate creates,
receives, maintains, or transmits for or on behalf of Customer under this Agreement,
including Electronic Protected Health Information ("ePHI").

2. PERMITTED USES AND DISCLOSURES

2.1 Services. Business Associate may Use and Disclose PHI only as necessary to
provide the service to Customer, as permitted or required by this Agreement, or as
Required By Law.

2.2 Minimum Necessary. Business Associate will limit its Use, Disclosure, and request
of PHI to the Minimum Necessary to accomplish the intended purpose.

2.3 Management and Administration. Business Associate may Use PHI for its proper
management and administration and to carry out its legal responsibilities. It may
Disclose PHI for those purposes only if the Disclosure is Required By Law, or if it
obtains reasonable assurances from the recipient that the PHI will be held
confidentially and Used or further Disclosed only as Required By Law or for the
purpose for which it was disclosed, and that the recipient will notify Business
Associate of any instance in which the confidentiality of the PHI has been breached.

2.4 Data Aggregation. Business Associate may Use PHI to provide Data Aggregation
services relating to the Health Care Operations of Customer, or of the covered
entity Customer serves, as the HIPAA Rules permit.

2.5 De-identification. Business Associate may de-identify PHI in accordance with 45
CFR 164.514(a)-(b). Information de-identified in that way is not PHI, except as 45
CFR 164.502(d)(2) provides for a code or other means of re-identification and for
information that is re-identified.

2.6 Prohibited Uses. Business Associate will not Use or Disclose PHI in any manner
that would violate Subpart E of 45 CFR Part 164 if done by Customer, except as
permitted by Sections 2.3 and 2.4. Business Associate will not sell PHI, or Use or
Disclose PHI for marketing or fundraising, except as the HIPAA Rules permit and
Customer authorizes in writing. Business Associate will not Use PHI, or information
derived from PHI (including de-identified information), to train, fine-tune, or
otherwise improve any machine learning or artificial intelligence model.

2.7 Customer's Own Agreement. Where Customer is a business associate, Business
Associate's Uses and Disclosures of PHI are further limited to those that Customer's
own business associate agreement permits Customer, and Customer will tell Business
Associate in writing of any such limitation.

3. SAFEGUARDS

3.1 Business Associate will use appropriate administrative, physical, and technical
safeguards, and will comply with Subpart C of 45 CFR Part 164 with respect to ePHI,
to prevent Use or Disclosure of PHI other than as provided for by this Agreement.

3.2 Business Associate will implement and maintain, at a minimum: encryption of ePHI
at rest and in transit using industry-standard algorithms; unique user
identification, with multi-factor authentication for administrative access;
role-based access controls; logging of access to and changes of PHI; and a
documented workforce sanction policy.

3.3 Business Associate will conduct a risk analysis of the systems it uses to provide
the service and will maintain a risk management program consistent with 45 CFR
164.308(a)(1).

4. REPORTING

4.1 Security Incidents and Improper Use or Disclosure. Business Associate will report
to Customer any Use or Disclosure of PHI not provided for by this Agreement of which
it becomes aware, and any Security Incident of which it becomes aware, without
unreasonable delay.

4.2 Breach Notification. Business Associate will notify Customer of a Breach of
Unsecured PHI without unreasonable delay and in no case later than 30
calendar days after Discovery of the Breach (the date the Breach is treated as
discovered under 45 CFR 164.410(a)(2)), subject to any delay required under 45 CFR
164.412. The notice will include, to the extent
then known, the identification of each Individual whose Unsecured PHI has been, or
is reasonably believed to have been, accessed, acquired, Used, or Disclosed, and the
other information Customer needs to meet its own obligations under 45 CFR 164.404
through 164.410. Business Associate will supplement the notice as further
information becomes available.

4.3 Unsuccessful Security Incidents. The Parties agree that unsuccessful attempts at
unauthorized access that do not result in unauthorized access to, or Use or
Disclosure of, ePHI (such as pings, port scans, and blocked sign-in attempts) need no
individual report, and that this Section is notice of them.

4.4 Mitigation. Business Associate will mitigate, to the extent practicable, any
harmful effect known to it of a Use or Disclosure of PHI in violation of this
Agreement.

5. SUBCONTRACTORS

5.1 Business Associate will ensure that any Subcontractor that creates, receives,
maintains, or transmits PHI on its behalf agrees in writing to the same restrictions,
conditions, and requirements that apply to Business Associate under this Agreement,
in accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2).

5.2 Business Associate will keep a current list of the Subcontractors that handle
PHI and will make it available to Customer on request.

6. RIGHTS OF INDIVIDUALS

6.1 Access. Business Associate will make PHI it maintains in a Designated Record Set
available to Customer, or to the Individual as Customer directs, within 10
business days of a request, including in electronic form where it is maintained
electronically, so that Customer can meet its obligations under 45 CFR 164.524.

6.2 Amendment. Business Associate will make PHI in a Designated Record Set available
for amendment, and will incorporate amendments Customer directs, as required by 45
CFR 164.526.

6.3 Accounting of Disclosures. Business Associate will document and make available
the information Customer needs to respond to a request for an accounting of
Disclosures under 45 CFR 164.528.

6.4 Requests Received Directly. If Business Associate receives a request from an
Individual for access, amendment, an accounting, or a restriction, it will forward
the request to Customer without unreasonable delay and will not respond to it
except as Customer directs or as Required By Law.

6.5 Customer's Obligations. To the extent Business Associate carries out an
obligation of Customer under Subpart E of 45 CFR Part 164, it will comply with the
requirements of Subpart E that apply to Customer in performing that obligation.

7. AVAILABILITY TO THE SECRETARY

Business Associate will make its internal practices, books, and records relating to
the Use and Disclosure of PHI available to the Secretary for purposes of determining
compliance with the HIPAA Rules, and will tell Customer of such a request unless the
law prohibits it.

8. TERM AND TERMINATION

8.1 Term. This Agreement takes effect on the Effective Date and continues until all
PHI is returned or destroyed in accordance with Section 8.4. It terminates when
Customer's organization is closed and deleted from the service under the Terms of
Service, or earlier as provided below. A paid plan that ends, after which Customer's
organization continues on the Free plan, does not terminate this Agreement.

8.2 Termination for Cause. If Customer determines that Business Associate has
violated a material term of this Agreement, Customer may terminate this Agreement and
the service if Business Associate does not cure the violation within 30 days of
written notice, or immediately if cure is not possible.

8.3 Effect of Termination. Termination of this Agreement ends Business Associate's
authority to Use or Disclose PHI, except as provided in Section 8.4.

8.4 Return or Destruction. On termination, Business Associate will return or destroy
all PHI it maintains in any form and will keep no copies, except where return or
destruction is not feasible. Where it is not feasible, Business Associate will
extend the protections of this Agreement to that PHI and limit further Uses and
Disclosures to the purposes that make return or destruction infeasible, for as long
as it keeps the PHI. Business Associate will certify the destruction in writing on
request.

9. GENERAL

9.1 Regulatory References. A reference to a section of the HIPAA Rules means that
section as in effect or as amended.

9.2 Amendment. The Parties will amend this Agreement as necessary for compliance with
the HIPAA Rules.

9.3 Interpretation. Any ambiguity in this Agreement will be resolved to permit
compliance with the HIPAA Rules. Nothing in this Agreement confers any rights on a
third party.

9.4 No Agency. Nothing in this Agreement creates an agency relationship between the
Parties for purposes of the HIPAA Rules.

9.5 Survival. Sections 4, 7, and 8.4 survive termination of this Agreement.

9.6 Execution. Business Associate signs this standard Agreement in advance, and it is
executed when Customer signs it. It may be signed electronically. An electronic
signature recorded by the service, with the signer's name, title if given, date
and time, network address, and method of confirming identity, is an original
signature for all purposes.

SIGNATURES

  BUSINESS ASSOCIATE: Backsplice LLC
  Signed in advance by Ken Armstrong, Principal

  CUSTOMER: [CUSTOMER LEGAL NAME]
  Signed electronically by the person recorded with this Agreement, on the date
  recorded with it.

---
NOTICE: This is a standard agreement provided by Business Associate. It is not legal
advice. Customer may have its own counsel review it before signing, or may provide
its own business associate agreement for Business Associate to review instead.