HIPAA BUSINESS ASSOCIATE AGREEMENT
This HIPAA Business Associate Agreement (the "Agreement") is entered into as of [Effective Date] (the "Effective Date"), by and between:
[Party A], a corporation ("Covered Entity"), and
[Party B], a corporation ("Business Associate").
The Covered Entity will share protected health information with the Business Associate so the Business Associate can perform the underlying agreement, and the Business Associate accepts the limits in this Agreement.
1. Underlying Agreement. The Parties are entering this Agreement in connection with [underlying agreement] (the "Underlying Agreement"). If this Agreement and the Underlying Agreement conflict on protected health information, this Agreement controls.
2. Permitted Uses. The Business Associate may use and disclose protected health information only to perform the Underlying Agreement, and for its own management and legal duties that cannot be done without the information. The Business Associate will not use or disclose the information in a way the Covered Entity is not allowed to, and will not sell it or use it for the Business Associate's own marketing.
3. Safeguards. The Business Associate will use administrative, physical, and technical safeguards that reasonably protect the information, and will limit access to people who need it for the work.
4. Breach Notice. The Business Associate will notify the Covered Entity of a breach of unsecured protected health information without unreasonable delay and within the time HIPAA requires. The notice will describe what happened, the kinds of information involved, and what the Business Associate is doing in response, as far as the Business Associate knows.
5. Further Subcontractors. The Business Associate will not let another person or company handle the protected health information unless that person or company first agrees in writing to limits at least as strict as this Agreement.
6. Access, Amendment, and Accounting. The Business Associate will help the Covered Entity answer a person's request for access, an amendment, or an accounting of disclosures, in the time and manner HIPAA requires of the Covered Entity.
7. Records for HHS. The Business Associate will make its practices, books, and records about the protected health information available to the U.S. Department of Health and Human Services for a review that office is authorized to conduct.
8. Return or Destruction. When this Agreement ends, the Business Associate will return or destroy the protected health information it still holds, if that is feasible. If it is not feasible, the Business Associate will keep protecting the information and use it only for the reason return or destruction cannot be done.
9. Termination. The Covered Entity may end this Agreement if the Business Associate materially breaches it and does not cure the breach within a reasonable time after written notice. If the breach cannot be cured, the Covered Entity may end this Agreement immediately.
10. Survival. Duties that must continue after this Agreement ends do survive. That includes the limits on protected health information the Business Associate still holds, and the duty to make records available to HHS.
11. Governing Law. This Agreement is governed by the laws of Delaware, without regard to conflict of laws principles. Any legal suit, action, or proceeding relating to this Agreement must be instituted in the state or federal courts located in Delaware, and each Party irrevocably submits to the exclusive jurisdiction of those courts.
12. General. This Agreement covers protected health information handled under the Underlying Agreement. It may be amended only in a writing signed by the Parties, and it may be signed in counterparts, including electronic copies. If a part is unenforceable, the rest stays in effect.
IN WITNESS WHEREOF, the Parties have executed this Agreement as of the Effective Date.
Covered Entity: [Party A]
By: ________________________________
Name: [Signatory]
Title: [Title]
Business Associate: [Party B]
By: ________________________________
Name: [Signatory]
Title: [Title]
