Demo site with fictional data. Never enter real client information. Sample files
IntakeAlly

Draft for attorney review. Not yet in effect.

Business Associate Agreement

Effective date: [Effective date]

This Business Associate Agreement (the "BAA") is between [Company legal name] ("Business Associate") and the organization that subscribes to IntakeAlly and accepts this BAA ("Covered Entity"). It forms part of the Customer Agreement between the parties (the "Underlying Agreement").

Covered Entity uses IntakeAlly (the "Service") to prepare intake and assessment documents and manage related work. In doing so, Business Associate creates, receives, maintains, or transmits Client Information on Covered Entity's behalf. This BAA sets out how Business Associate will protect that information, as required by the Health Insurance Portability and Accountability Act of 1996, the HITECH Act, and their regulations at 45 CFR Parts 160 and 164 (together, "HIPAA"), and by California law.

1. Who this BAA covers

1.1 HIPAA covered entities. If Covered Entity is a "covered entity" under HIPAA, this BAA is a business associate agreement under 45 CFR 164.502(e), 164.504(e), 164.308(b), and 164.314(a).

1.2 Customers that are business associates. If Covered Entity is itself a business associate of another covered entity (for example, a vendor of a regional center), this BAA is a subcontractor business associate agreement under 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), and references to "Covered Entity" include Covered Entity acting in that capacity.

1.3 Customers that are not subject to HIPAA. Some customers are not HIPAA covered entities or business associates but hold medical information under the California Confidentiality of Medical Information Act (Civil Code §56 et seq., "CMIA") or regional center client records protected by Welfare and Institutions Code §4514. For those customers, Business Associate will handle all Client Information as if it were protected health information under HIPAA and will meet every obligation in this BAA. The term "Covered Entity" is used for convenience and does not mean the customer is a HIPAA covered entity.

2. Definitions

Terms used but not defined in this BAA have the meanings given in HIPAA, including "Breach," "Business Associate," "Covered Entity," "Data Aggregation," "Designated Record Set," "Individual," "Minimum Necessary," "Protected Health Information" ("PHI"), "Required by Law," "Secretary," "Security Incident," "Subcontractor," and "Unsecured Protected Health Information."

"Client Information" means all information, in any form, that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity through the Service and that relates to an individual Covered Entity serves or proposes to serve, including:

  • PHI, including electronic PHI;
  • "medical information" as defined in Civil Code §56.05;
  • information and records obtained in the course of providing intake, assessment, and services to persons with developmental disabilities that are confidential under Welfare and Institutions Code §4514, including regional center case numbers and records; and
  • any other information that identifies, or could reasonably be used to identify, such an individual or the individual's family members, guardians, or representatives.

In this BAA, obligations that HIPAA imposes on PHI apply to all Client Information.

3. Permitted uses and disclosures

3.1 Providing the Service. Business Associate may use and disclose Client Information only as necessary to provide the Service to Covered Entity under the Underlying Agreement and Covered Entity's instructions, including hosting, storing, processing, displaying, and generating documents, and AI-assisted reading and drafting performed within the Service.

3.2 Management and administration. Business Associate may use Client Information for its proper management and administration or to carry out its legal responsibilities. Business Associate may disclose Client Information for those purposes only if (a) the disclosure is Required by Law, or (b) Business Associate obtains reasonable written assurances from the recipient that the information will be held confidentially, used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the recipient will notify Business Associate of any instance in which the confidentiality of the information has been breached.

3.3 Required by Law. Business Associate may use or disclose Client Information as Required by Law, subject to Section 3.6 and to any stricter requirements of the CMIA and W&I Code §4514.

3.4 No de-identification or data aggregation. Business Associate will not de-identify Client Information, or use it to provide Data Aggregation services, unless Covered Entity agrees in writing.

3.5 Limits. Business Associate will not use or disclose Client Information in any manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, except as permitted by Section 3.2.

3.6 Legal demands. If Business Associate receives a subpoena, court order, or other legal demand for Client Information, it will, unless prohibited by law, notify Covered Entity promptly so that Covered Entity may respond or seek protection, and will disclose only what the law requires.

4. Obligations of Business Associate

4.1 No other use or disclosure. Business Associate will not use or further disclose Client Information other than as permitted or required by this BAA or as Required by Law.

4.2 Safeguards. Business Associate will use appropriate administrative, physical, and technical safeguards, and will comply with Subpart C of 45 CFR Part 164 (the Security Rule) with respect to electronic Client Information, to prevent use or disclosure of Client Information other than as provided for by this BAA. These safeguards are summarized on Business Associate's Security page and in the Underlying Agreement.

4.3 Minimum necessary. Business Associate will limit its uses, disclosures, and requests of Client Information to the minimum necessary to accomplish the intended purpose, in accordance with 45 CFR 164.502(b) and 164.514(d). Business Associate will limit its personnel's access to Client Information to those who need it to provide or support the Service.

4.4 No sale of PHI. Business Associate will not directly or indirectly receive remuneration in exchange for Client Information, and will not sell Client Information.

4.5 No marketing. Business Associate will not use or disclose Client Information for marketing or fundraising, or for advertising of any kind.

4.6 No training of AI models. Business Associate will not use Client Information to train artificial intelligence models, and will use AI services to process Client Information only under a business associate agreement that prohibits the provider from using it to train models.

4.7 United States only. Business Associate will store and process Client Information only within the United States, and will require its Subcontractors to do the same. [Counsel: decide whether to also restrict access by Business Associate personnel from outside the United States.]

4.8 Mitigation. Business Associate will mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure of Client Information in violation of this BAA.

4.9 Workforce. Business Associate will train its workforce members who have access to Client Information on their obligations, require them to sign confidentiality agreements, and apply sanctions for violations.

5. Reporting and breach notification

5.1 What Business Associate will report. Business Associate will report to Covered Entity:

  • any use or disclosure of Client Information not provided for by this BAA of which it becomes aware;
  • any Security Incident of which it becomes aware, subject to Section 5.4; and
  • any Breach of Unsecured Protected Health Information, as required by 45 CFR 164.410, and any breach of Client Information that would require notice under the CMIA, W&I Code §4514, or Civil Code §1798.82.

5.2 Timing. Business Associate will make these reports without unreasonable delay, and in no case later than five (5) business days after discovery. [Counsel: confirm timing. Civil Code §1798.82(b) requires a business that maintains data it does not own to notify the owner "immediately following discovery"; consider an initial notice within a shorter period (for example, 48 hours) followed by the details below.] A Breach is treated as discovered as of the first day on which it is known to Business Associate, or by exercising reasonable diligence would have been known to any person, other than the person committing the Breach, who is a workforce member or agent of Business Associate, as provided in 45 CFR 164.410(a)(2).

5.3 Content of the report. As required by 45 CFR 164.410(c), the report will include, to the extent possible, the identification of each Individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired, used, or disclosed during the Breach. Business Associate will also provide, at the time of the report or promptly afterward as information becomes available, any other available information that Covered Entity needs to notify Individuals under 45 CFR 164.404(c), including:

  • a brief description of what happened, including the date of the Breach and the date of discovery, if known;
  • a description of the types of Client Information involved (such as full name, date of birth, diagnosis, case number, or other types);
  • any steps Individuals should take to protect themselves from potential harm;
  • a description of what Business Associate is doing to investigate, mitigate harm, and protect against further Breaches; and
  • contact information for Business Associate's representative.

Business Associate will supplement the report as new information becomes available.

5.4 Unsuccessful Security Incidents. The parties acknowledge that unsuccessful attempts at unauthorized access occur regularly, such as pings and other broadcast attacks on firewalls, port scans, unsuccessful log-on attempts, denial-of-service attacks that do not result in a server being taken offline, and malware such as worms or viruses that are blocked. This Section 5.4 serves as notice, and Covered Entity agrees that no further notice is required, of these unsuccessful Security Incidents, so long as they do not result in unauthorized access, use, disclosure, modification, or destruction of Client Information or interference with system operations.

5.5 Cooperation. Business Associate will cooperate with Covered Entity in investigating any Breach and in meeting Covered Entity's notification obligations under HIPAA (45 CFR 164.404 through 164.408), the CMIA, W&I Code §4514, Civil Code §1798.82, and any other applicable law. Unless the parties agree otherwise, Covered Entity will decide whether notice to Individuals, regulators, or the media is required and will make those notices. Business Associate will not notify Individuals or regulators directly about a Breach of Client Information without Covered Entity's approval unless the law requires it. [Counsel: decide whether Business Associate will reimburse reasonable notification and credit-monitoring costs for Breaches caused by Business Associate.]

6. Subcontractors

In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate will ensure that any Subcontractor that creates, receives, maintains, or transmits Client Information on its behalf agrees in writing to the same restrictions, conditions, and requirements that apply to Business Associate under this BAA, including compliance with the Security Rule and reporting of Security Incidents and Breaches. Business Associate's current Subcontractors are listed on its Subprocessors page. Business Associate will give Covered Entity notice of any new Subcontractor that will handle Client Information before it begins doing so.

7. Individual rights

7.1 Access. To the extent Business Associate maintains Client Information in a Designated Record Set, Business Associate will, within ten (10) business days of Covered Entity's request, make that information available to Covered Entity, in the form and format requested if readily producible, so that Covered Entity can meet its obligations under 45 CFR 164.524. Covered Entity can also use the Service's export features to obtain this information directly.

7.2 Amendment. To the extent Business Associate maintains Client Information in a Designated Record Set, Business Associate will, within ten (10) business days of Covered Entity's request, make amendments that Covered Entity directs or agrees to under 45 CFR 164.526, or otherwise act as necessary to satisfy Covered Entity's obligations under that section. Covered Entity can generally make amendments directly in the Service.

7.3 Accounting of disclosures. Business Associate will document disclosures of Client Information, and information related to those disclosures, as would be required for Covered Entity to respond to a request for an accounting of disclosures under 45 CFR 164.528. Within ten (10) business days of Covered Entity's request, Business Associate will provide that information to Covered Entity.

7.4 Requests made to Business Associate. If an Individual contacts Business Associate directly with a request for access, amendment, or an accounting, Business Associate will forward the request to Covered Entity within five (5) business days and will not respond to the Individual directly unless Covered Entity directs it to or the law requires it.

7.5 Restrictions and confidential communications. Business Associate will comply with any restriction on the use or disclosure of Client Information, or any confidential communications requirement, that Covered Entity has agreed to under 45 CFR 164.522 and tells Business Associate about in writing, to the extent it affects Business Associate's handling of Client Information.

[Counsel: confirm the 10-business-day response periods.]

8. Carrying out Covered Entity's obligations

To the extent Business Associate carries out any of Covered Entity's obligations under Subpart E of 45 CFR Part 164, Business Associate will comply with the requirements of Subpart E that apply to Covered Entity in the performance of those obligations.

9. Books and records

Business Associate will make its internal practices, books, and records relating to the use and disclosure of Client Information available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining Covered Entity's and Business Associate's compliance with HIPAA. Unless prohibited by law, Business Associate will promptly notify Covered Entity of any such request.

10. California law

10.1 CMIA. Business Associate will comply with the CMIA as it applies to providers of services that receive medical information, including by maintaining, preserving, storing, and disposing of medical information in a manner that preserves its confidentiality (Civil Code §56.101), and by not further disclosing medical information except as permitted by Civil Code §56.10 and this BAA.

10.2 W&I Code §4514. Business Associate acknowledges that information and records about persons with developmental disabilities obtained in the course of providing intake, assessment, and services are confidential under Welfare and Institutions Code §4514 and may be disclosed only as that section permits. Business Associate will use and disclose such records only to provide the Service to Covered Entity and as permitted by §4514, and will follow any stricter requirement in §4514 where it differs from HIPAA.

10.3 Breach notification. Business Associate will cooperate with Covered Entity's notification obligations under Civil Code §1798.82, as described in Section 5.

10.4 Stricter law controls. Where California law provides greater protection for Client Information than HIPAA, Business Associate will follow the more protective rule.

11. Obligations of Covered Entity

Covered Entity will:

  • notify Business Associate of any limitation in its notice of privacy practices, any change in or revocation of an Individual's permission, and any restriction agreed to under 45 CFR 164.522, to the extent it may affect Business Associate's use or disclosure of Client Information;
  • not ask Business Associate to use or disclose Client Information in any manner that would not be permitted under HIPAA, the CMIA, or W&I Code §4514 if done by Covered Entity;
  • obtain any consents, authorizations, or contractual permissions (including from regional centers) needed for Business Associate to process Client Information as this BAA describes;
  • give its workforce and independent coordinators only the access they need, using the roles in the Service; and
  • not upload or enter real Client Information into the Service until an administrator has accepted this BAA.

12. Term and termination

12.1 Term. This BAA takes effect when Covered Entity's administrator accepts it and continues until the Underlying Agreement ends and all Client Information has been returned or destroyed under Section 13.

12.2 Termination by Covered Entity. If Covered Entity determines that Business Associate has violated a material term of this BAA, Covered Entity will give Business Associate written notice and thirty (30) days to cure. If Business Associate does not cure the violation within that time, Covered Entity may terminate this BAA and the Underlying Agreement. If cure is not possible, Covered Entity may terminate immediately on written notice. [Counsel: confirm cure period.]

12.3 Termination by Business Associate. If Business Associate knows of a pattern of activity or practice of Covered Entity that constitutes a material breach of Covered Entity's obligations under this BAA, Business Associate will give written notice and thirty (30) days to cure, and may terminate this BAA and the Underlying Agreement if the breach is not cured.

12.4 Effect. Termination of this BAA terminates the Underlying Agreement as to any service that involves Client Information.

13. Return or destruction of Client Information

13.1 Export window. When the Underlying Agreement ends, Covered Entity may export its Client Information using the Service's export features for thirty (30) days. [Proposal for counsel.]

13.2 Destruction. After the export window, Business Associate will destroy all Client Information it maintains in any form, including Client Information held by its Subcontractors, and will retain no copies. Business Associate will delete Client Information from active systems within ninety (90) days after termination, and backup copies will be overwritten within thirty-five (35) days after that. [Proposal for counsel.] On request, Business Associate will certify destruction in writing.

13.3 Return on request. If Covered Entity asks in writing before the export window ends, Business Associate will return Client Information in a commonly used electronic format instead of, or in addition to, the export features.

13.4 Infeasibility. If returning or destroying any Client Information is not feasible (for example, because the law requires Business Associate to keep it), Business Associate will tell Covered Entity why, extend the protections of this BAA to that information, and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as Business Associate maintains it.

14. Indemnification

[Option for counsel: Each party will defend, indemnify, and hold harmless the other party from third-party claims, regulatory fines and penalties, and reasonable costs (including breach notification costs) to the extent arising from the indemnifying party's breach of this BAA. Consider whether this obligation is subject to, or excluded from, the limitation of liability in the Underlying Agreement.]

15. General

15.1 Survival. Business Associate's obligations under Sections 4, 5, 6, 9, 10, and 13, and any other obligation that by its nature should continue, survive termination for as long as Business Associate or its Subcontractors maintain any Client Information.

15.2 Interpretation. Any ambiguity in this BAA will be resolved in favor of a meaning that permits the parties to comply with HIPAA, the CMIA, and W&I Code §4514. References to a law or regulation mean that law or regulation as in effect or as amended.

15.3 Amendment for changes in law. The parties will take action to amend this BAA as necessary to comply with changes in HIPAA, the CMIA, W&I Code §4514, or other applicable law. Business Associate may update this BAA to reflect changes in law by giving Covered Entity at least thirty (30) days' written notice, provided the update does not reduce the protection of Client Information. Any other amendment must be agreed in writing, which may include electronic acceptance in the Service.

15.4 Conflicts. If this BAA conflicts with the Underlying Agreement regarding Client Information, this BAA controls.

15.5 Independent contractor. Business Associate is an independent contractor and is not an agent of Covered Entity.

15.6 No third-party beneficiaries. Nothing in this BAA gives any rights to anyone other than the parties.

15.7 Governing law. This BAA is governed by HIPAA and, to the extent not preempted, the laws of the State of California, consistent with the Underlying Agreement.

15.8 Notices. Reports under Section 5 will be sent to Covered Entity's account administrator by email and through the Service. Notices to Business Associate should be sent to support@example.com and by mail to [Company legal name], [Mailing address].

16. Electronic acceptance

Covered Entity accepts this BAA electronically when an administrator of its organization accepts it in the Service. The Service records the administrator's full name, title, organization, and the date and time of acceptance, together with the version of this BAA accepted. Each party agrees that this electronic acceptance has the same effect as a handwritten signature. Business Associate is bound by this BAA from the time of Covered Entity's acceptance. On request, Business Associate will provide a copy of the accepted BAA with the acceptance record.