HIPAA Business Associate Agreement (BAA) & Practice Guide

1. Preamble & Parties

This Business Associate Agreement ("BAA") is entered into by and between the healthcare entity subscribing to ClinicVerify services ("Covered Entity") and ClinicVerify Inc. ("Business Associate"), collectively referred to as the "Parties."

WHEREAS, Covered Entity is a Covered Entity under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and the Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Parts 160 and 164 (collectively, the "HIPAA Rules");

WHEREAS, Business Associate provides SaaS platform services involving patient intake, card OCR, and real-time EDI 270/271 eligibility verification, which require the creation, receipt, maintenance, or transmission of Protected Health Information ("PHI") or Electronic Protected Health Information ("ePHI") on behalf of Covered Entity;

2. Definitions

• Catch-all Definitions: Terms used, but not otherwise defined, in this BAA shall have the same meaning as those terms defined in the HIPAA Rules (45 C.F.R. § 160.103 and Part 164).
• Protected Health Information (PHI): Shall have the same meaning as given in 45 C.F.R. § 160.103, limited to information created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity.

3. Obligations & Activities of Business Associate

Business Associate agrees to:

• Permitted Uses: Not use or disclose PHI other than as permitted or required by this BAA or the underlying SaaS Terms of Service, or as required by federal or state law.
• Safeguards: Implement appropriate administrative, physical, and technical safeguards complying with Subpart C of 45 C.F.R. Part 164 (HIPAA Security Rule) to prevent use or disclosure of ePHI other than as provided for by this BAA.
• Encryption Standard: Enforce AES-256 bit encryption for ePHI stored at rest and TLS 1.3 encryption for ePHI in transit across external networks.
• Subcontractors: Ensure that any subcontractors or agents that create, receive, maintain, or transmit ePHI on behalf of Business Associate agree in writing to the same restrictions and conditions that apply to Business Associate under this BAA.
• Reporting Breach / Security Incidents: Report to Covered Entity any Security Incident or Breach of Unsecured PHI without unreasonable delay and in no event later than ten (10) business days after discovery, in accordance with 45 C.F.R. § 164.410.
• Individual Rights: Assist Covered Entity in making available PHI necessary to fulfill Covered Entity's obligations under 45 C.F.R. § 164.524 (Access) and § 164.526 (Amendment).
• Audit & Inspection: Make internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services (HHS) for determining compliance.

4. Permitted Uses & Disclosures by Business Associate

Except as otherwise limited in this BAA, Business Associate may:

• Use or disclose PHI to perform eligibility checking services and OCR parsing specified in the underlying SaaS Agreement.
• Use PHI for the proper management and administration of Business Associate or to carry out its legal responsibilities.
• Perform data aggregation services relating to the healthcare operations of Covered Entity if authorized.

5. Obligations of Covered Entity

Covered Entity agrees to:

• Notify Business Associate of any limitations in its notice of privacy practices under 45 C.F.R. § 164.520 to the extent that such limitation may affect Business Associate's use or disclosure of PHI.
• Obtain all necessary patient consents and authorizations prior to uploading patient card images or initiating eligibility requests.
• Not request Business Associate to use or disclose PHI in any manner that would not be permissible under the Privacy Rule if done by Covered Entity.

6. Term & Termination

• Term: This BAA shall take effect upon account registration and remain in effect until all PHI provided by Covered Entity is destroyed or returned.
• Termination for Cause: Upon Covered Entity's knowledge of a material breach by Business Associate, Covered Entity shall provide thirty (30) days written notice to cure. Failure to cure results in immediate termination.
• Effect of Termination: Upon termination, Business Associate shall return or destroy all PHI created or received on behalf of Covered Entity. Insurance card images are automatically purged according to configured retention settings.

7. Frequently Asked Questions (BAA & HIPAA)

8. Contact & Execution Support

For questions or custom BAA countersignatures, contact our Compliance Office via our support desk or review our Privacy Policy and Terms of Service: