Legal
Business Associate Agreement
The agreement we sign with every office before any protected health information is processed.
Placeholder, not a legal document yet
This page is a structural outline only. Nothing on it is in force, and none of it has been reviewed by counsel. It is excluded from search engines until the final text is approved.
Owner: Counsel
How to get the BAA
Request process, who signs, and the turnaround. Consider offering the PDF for download here.
Definitions
Aligned to 45 CFR ยง160.103.
Permitted uses and disclosures
What we may do with PHI and the minimum-necessary standard.
Safeguards
Our obligations under the Security Rule.
Subcontractors
Flow-down obligations to our own sub-processors.
Reporting
Security incidents and breach reporting timelines.
Return or destruction on termination
What happens to PHI when the agreement ends.