Business Associate Agreement

Business Associate Agreement (BAA)

Version: 2026-03-29

Effective Date: Date of electronic signature during onboarding.

This Business Associate Agreement ("Agreement") is entered into by and between the health care provider, organization, or covered entity accepting this Agreement ("Covered Entity") and HIPAABank, LLC d/b/a MedEx ("Business Associate").

This Agreement is incorporated into and supplements the parties' services relationship for MedEx services. The parties agree as follows:

1. Purpose

Covered Entity may disclose Protected Health Information ("PHI") to Business Associate so Business Associate can perform services on behalf of Covered Entity. This Agreement establishes each party's responsibilities under HIPAA and the HITECH Act.

2. Definitions

Capitalized terms not defined here have the meanings set forth in 45 CFR Parts 160 and 164. For purposes of this Agreement:

  • Breach has the meaning in 45 CFR 164.402.
  • Designated Record Set has the meaning in 45 CFR 164.501.
  • Electronic Protected Health Information (ePHI) has the meaning in 45 CFR 160.103.
  • HIPAA Rules means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.
  • PHI means Protected Health Information received from, created for, or received on behalf of Covered Entity.
  • Required by Law has the meaning in 45 CFR 164.103.

3. Permitted Uses and Disclosures

  1. Business Associate may use and disclose PHI only as necessary to perform services for Covered Entity, as permitted by this Agreement, or as Required by Law.
  2. Business Associate may use PHI for proper management and administration of Business Associate and to carry out legal responsibilities, provided disclosures are permitted by HIPAA and subject to reasonable protections.
  3. Business Associate will apply the minimum necessary standard to uses, disclosures, and requests for PHI when required by HIPAA.

4. Business Associate Safeguards and Duties

  1. Business Associate will implement administrative, physical, and technical safeguards reasonably and appropriately designed to protect the confidentiality, integrity, and availability of PHI/ePHI in accordance with applicable HIPAA requirements.
  2. Business Associate will not use or disclose PHI in a manner that would violate the HIPAA Rules if done by Covered Entity, except as expressly permitted for Business Associate under the HIPAA Rules.
  3. Business Associate will maintain policies and procedures and workforce controls appropriate to the services provided.
  4. Business Associate will mitigate, to the extent practicable, harmful effects of impermissible uses or disclosures of PHI known to Business Associate.

5. Reporting and Breach Notification

  1. Business Associate will report to Covered Entity any use or disclosure of PHI not provided for by this Agreement.
  2. Business Associate will report any Security Incident of which it becomes aware, consistent with HIPAA requirements and industry practice.
  3. Business Associate will report Breaches of Unsecured PHI without unreasonable delay and in no event later than the period required by applicable law, including information reasonably needed for Covered Entity's breach assessment and notification obligations under 45 CFR Part 164 Subpart D.

6. Subcontractors

If Business Associate uses subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate, Business Associate will ensure such subcontractors agree in writing to restrictions, conditions, and safeguards at least as protective as those that apply to Business Associate under this Agreement and the HIPAA Rules.

7. Individual Rights Support

  1. To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate will make PHI available to Covered Entity as needed to meet obligations under 45 CFR 164.524.
  2. Business Associate will make PHI available for amendment and incorporate amendments as directed by Covered Entity, as required by 45 CFR 164.526.
  3. Business Associate will maintain and provide information needed by Covered Entity to respond to requests for an accounting of disclosures under 45 CFR 164.528, as applicable.

8. Access by HHS

Business Associate will make its internal practices, books, and records related to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services as required for determining Covered Entity's and Business Associate's compliance with the HIPAA Rules.

9. Covered Entity Obligations

  1. Covered Entity will not request Business Associate to use or disclose PHI in any manner not permitted by law.
  2. Covered Entity is responsible for obtaining any required patient consents or authorizations for communications initiated on Covered Entity's behalf, unless otherwise expressly agreed in writing.
  3. Covered Entity will notify Business Associate of any limitations in Covered Entity's Notice of Privacy Practices or restrictions requested by individuals to the extent such limitations/restrictions affect Business Associate's permitted activities.

10. Term and Termination

  1. This Agreement remains in effect while Business Associate provides services involving PHI to Covered Entity.
  2. Either party may terminate this Agreement for material breach if the breaching party fails to cure within a reasonable period after written notice, unless immediate termination is required by law.
  3. Upon termination, Business Associate will return or destroy PHI where feasible. If return or destruction is infeasible, Business Associate will continue to protect PHI and limit further uses/disclosures to those purposes that make return or destruction infeasible, for as long as PHI is retained.

11. Regulatory References and Amendments

  1. References to the HIPAA Rules include all current and future amendments.
  2. The parties agree to take actions reasonably necessary to amend this Agreement to comply with applicable law.

12. Survival

Business Associate's obligations regarding PHI survive termination of this Agreement as required by law.

13. Order of Precedence

If there is a conflict between this Agreement and another agreement between the parties regarding PHI, this Agreement controls with respect to HIPAA-related obligations.

Electronic Signature. By electronically signing during onboarding, each party represented that it was authorized to enter into this Agreement and became legally bound by its terms.