BUSINESS AFFILIATE AGREEMENT
This Agreement is entered into by and between __________ (Health Care Provider) and __________ (Business Affiliate) to establish the terms and conditions under which “protected health information” (PHI), as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and Regulations enacted hereunder, created or received by the Business Affiliate on behalf of the Health Care Provider, may be used or disclosed. This Agreement commences on __________ (Date), and the obligations herein shall continue so long as the Business Affiliate uses, discloses, creates, or otherwise possesses any protected health information created or received on behalf of the Health Care Provider, until all such PHI is destroyed or returned pursuant to Paragraph 15 herein.
The Health Care Provider and Business Affiliate agree that the Business Affiliate may use and/or disclose PHI created or received on behalf of the Health Care Provider for the following purposes:
All permitted uses and disclosures must be within the scope of, and necessary to fulfill, the Business Affiliate’s obligations and responsibilities.
The Business Affiliate may use and disclose PHI created or received on behalf of the Health Care Provider if necessary for the management and administration of the Business Affiliate or to fulfill legal responsibilities, provided that any disclosure is:
The Business Affiliate agrees to maintain the security and privacy of all PHI in compliance with State and Federal laws, including HIPAA, and all other applicable laws.
The Business Affiliate agrees not to use or disclose PHI except as permitted by this Agreement, applicable law, or for managing internal business processes.
The Business Affiliate shall not disclose PHI to any member of its workforce without informing them of the privacy and security obligations under this Agreement. Appropriate disciplinary action will be taken for violations.
The Business Affiliate shall not disclose PHI to agents or subcontractors unless they agree in writing to abide by this Agreement and applicable State or Federal law.
The Business Affiliate agrees to implement safeguards to prevent unauthorized use or disclosure of PHI.
The Business Affiliate agrees to maintain records of all disclosures of PHI, detailing the date, recipient’s name and address, subject, description, and purpose. Records must be made available within five (5) working days of a request.
The Business Affiliate agrees to report any unauthorized use or disclosure of PHI, including the remedial action taken.
The Business Affiliate agrees to provide access to its internal practices, books, and records relating to the use and disclosure of PHI for HIPAA compliance purposes. Within thirty (30) days of a written request, the Business Affiliate shall provide access to PHI in the requested format.
The Business Affiliate agrees to amend PHI upon request by the Health Care Provider within thirty (30) days.
In the event of non-compliance, the Health Care Provider may:
The Health Care Provider may terminate this Agreement for material breach by the Business Affiliate, providing an opportunity to cure within ten (10) days. Failure to cure shall result in immediate termination.
Upon termination, the Business Affiliate must return or destroy all PHI. If return or destruction is not feasible, the Business Affiliate must continue to protect PHI in compliance with this Agreement and applicable law.
The Health Care Provider may amend this Agreement by providing ten (10) days’ written notice to ensure compliance with State and Federal law. The Business Affiliate may choose to discontinue the Agreement, but security and privacy obligations will survive discontinuation.
The Business Affiliate agrees to indemnify the Health Care Provider against any losses, claims, or liabilities arising from the Business Affiliate’s actions or omissions.
The Business Affiliate agrees to comply with the HIGH TECH RULES established in February 2010, including PHI protection, password protection, firewall implementation, and document shredding.
