HIPAA Business Associate Agreement
Effective Date: April 1, 2025
This Business Associate Agreement (“Agreement”) is entered into by and between [Covered Entity Name] (“Covered Entity”). Ostiarius, PLLC d/b/a/ Aranafy (“Business Associate”) to comply with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health (“HITECH”) Act, and their implementing regulations.
1. DEFINITIONS
For purposes of this Agreement:
- Business Associate: Aranafy, which performs functions or activities on behalf of the Covered Entity that involve the use or disclosure of Protected Health Information (PHI).
- Covered Entity: A health care provider, health plan, or health care clearinghouse that is subject to HIPAA regulations.
- Protected Health Information (PHI): Individually identifiable health information maintained or transmitted in any form or medium, as defined under HIPAA.
- Security Rule: The HIPAA Security Standards for the Protection of Electronic PHI (e-PHI) set forth at 45 CFR Part 160 and Part 164, Subparts A and C.
- Privacy Rule: The HIPAA Standards for Privacy of Individually Identifiable Health Information at 45 CFR Part 160 and Part 164, Subparts A and E.
- Breach: Has the definition given to it under HIPAA.
- HITECH Act: means the Health Information Technology for Economic and Clinical Health Act enacted in the United States Congress, which is Title XIII of the American Recovery & Reinvestment Act, and the regulations thereunder, as amended.
- Required by Law: has the definition given to it under HIPAA. “Security Incident” has the definition given to it under HIPAA.
2. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE
2.1 Permitted Uses and Disclosures – Business Associate agrees to use and disclose PHI solely for the purpose of providing services to Covered Entity and as permitted by this Agreement or required by law.
2.2 Safeguards – Business Associate shall implement administrative, physical, and technical safeguards to prevent unauthorized access, use, or disclosure of PHI as required under the Security Rule.
2.3 Reporting of Breaches – Business Associate shall notify Covered Entity of any unauthorized access, use, or disclosure of PHI, including breaches, within five (5) business days of discovery.
2.4 Mitigation – Business Associate shall mitigate any harmful effects of an unauthorized use or disclosure of PHI.
2.5 Subcontractors – Business Associate shall ensure that any subcontractors with access to PHI agree to the same restrictions and conditions required by this Agreement.
2.6 Access to PHI – Business Associate shall make PHI available to the Covered Entity or individual as required under the Privacy Rule.
2.7 Amendments to PHI – Business Associate shall accommodate any amendments to PHI requested by the Covered Entity.
2.8 Accounting of Disclosures – Business Associate shall document disclosures of PHI and provide an accounting upon request.
3. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE
3.1 Legal Compliance – Business Associate may use or disclose PHI as required by law.
3.2 Internal Operations – Business Associate may use PHI for its own proper management, administration, and legal responsibilities, provided that such use or disclosure is required by law or secured through confidentiality agreements.
4. OBLIGATIONS OF COVERED ENTITY
4.1 Notice of Privacy Practices – Covered Entity shall provide Business Associate with its Notice of Privacy Practices if applicable.
4.2 Permissible Requests – Covered Entity shall not request Business Associate to use or disclose PHI in a manner that would violate HIPAA.
4.3 Restrictions on PHI – Covered Entity shall notify Business Associate of any restrictions on the use or disclosure of PHI agreed to with an individual that would affect Business Associate’s use or disclosure.
5. TERM AND TERMINATION
5.1 Term – This Agreement shall remain in effect until terminated by either party.
5.2 Termination for Cause – If Business Associate materially breaches this Agreement, Covered Entity may terminate the Agreement upon written notice.
5.3 Return or Destruction of PHI – Upon termination, Business Associate shall return or destroy all PHI received from Covered Entity, unless infeasible, in which case protections under this Agreement shall continue.
6. MISCELLANEOUS
6.1 Amendment – This Agreement may be amended as necessary to comply with HIPAA regulations. Such amendments will provide to the Covered Entity and if the Covered Entity does not agree to the amendment, Business Associate may terminate this Agreement.
6.2 Governing Law – This Agreement shall be governed by the laws of Idaho.
6.3 Severability – If any provision of this Agreement is found invalid, the remainder shall remain in full force and effect.
6.4 No Third-Party Beneficiaries – Nothing in this Agreement is intended to confer rights on any third party.
IN WITNESS WHEREOF, the parties have executed this Business Associate Agreement as of the Effective Date.