purgo/legal/BAA-template.md

Zero-config PHI-scrubber for browser and Node.js

# BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement ("BAA") is entered into by and between:

**[COVERED ENTITY NAME]** ("Covered Entity"), with its principal place of business at [ADDRESS], and

**[YOUR COMPANY NAME]** ("Business Associate"), with its principal place of business at [ADDRESS].

## RECITALS

WHEREAS, Covered Entity is a covered entity under the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act of 2009, and their implementing regulations (collectively, "HIPAA");

WHEREAS, Business Associate provides certain services to Covered Entity that involve the use and/or disclosure of Protected Health Information ("PHI");

WHEREAS, Covered Entity and Business Associate desire to enter into this BAA to ensure compliance with HIPAA;

NOW, THEREFORE, in consideration of the mutual promises and covenants contained herein, the parties agree as follows:

## 1. DEFINITIONS

Terms used but not otherwise defined in this BAA shall have the same meaning as those terms in HIPAA.

## 2. OBLIGATIONS OF BUSINESS ASSOCIATE

2.1. **Use and Disclosure of PHI**. Business Associate agrees to not use or disclose PHI other than as permitted or required by this BAA or as required by law.

2.2. **Safeguards**. Business Associate agrees to use appropriate safeguards to prevent the use or disclosure of PHI other than as provided for by this BAA.

2.3. **Reporting**. Business Associate agrees to report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which it becomes aware, including breaches of unsecured PHI.

2.4. **Subcontractors**. Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree to the same restrictions and conditions that apply to Business Associate with respect to such information.

2.5. **Access to PHI**. Business Associate agrees to make available PHI to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 CFR 164.524.

2.6. **Amendment of PHI**. Business Associate agrees to make any amendment(s) to PHI as directed or agreed to by Covered Entity pursuant to 45 CFR 164.526.

2.7. **Accounting of Disclosures**. Business Associate agrees to maintain and make available information required to provide an accounting of disclosures to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 CFR 164.528.

2.8. **Compliance with Secretary**. Business Associate agrees to make its internal practices, books, and records available to the Secretary of the Department of Health and Human Services for purposes of determining compliance with HIPAA.

## 3. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE

3.1. **General Use and Disclosure**. Business Associate may only use or disclose PHI as necessary to perform the services set forth in the service agreement between the parties.

3.2. **Specific Use and Disclosure**. Business Associate may use PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate.

## 4. TERM AND TERMINATION

4.1. **Term**. This BAA shall be effective as of [EFFECTIVE DATE] and shall terminate when all PHI provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity.

4.2. **Termination for Cause**. Upon Covered Entity's knowledge of a material breach by Business Associate, Covered Entity shall provide an opportunity for Business Associate to cure the breach. If Business Associate does not cure the breach within 30 days, Covered Entity may terminate this BAA and the underlying service agreement.

4.3. **Effect of Termination**. Upon termination of this BAA, Business Associate shall return or destroy all PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity. If such return or destruction is not feasible, Business Associate shall extend the protections of this BAA to such PHI and limit further uses and disclosures to those purposes that make the return or destruction of the PHI infeasible.

## 5. MISCELLANEOUS

5.1. **Regulatory References**. A reference in this BAA to a section in HIPAA means the section as in effect or as amended.

5.2. **Amendment**. The parties agree to take such action as is necessary to amend this BAA from time to time as is necessary for compliance with HIPAA.

5.3. **Interpretation**. Any ambiguity in this BAA shall be interpreted to permit compliance with HIPAA.

5.4. **No Third-Party Beneficiaries**. Nothing in this BAA shall confer upon any person other than the parties and their respective successors or assigns, any rights, remedies, obligations, or liabilities whatsoever.

IN WITNESS WHEREOF, the parties have executed this BAA as of the date first written above.

**COVERED ENTITY:**

By: ________________________
Name: ______________________
Title: _______________________
Date: _______________________

**BUSINESS ASSOCIATE:**

By: ________________________
Name: ______________________
Title: _______________________
Date: _______________________