Legal
Business Associate Agreement
This is the standard Business Associate Agreement (BAA) Mosara ABA offers customer practices. For customers who put protected health information (PHI) into the Service, it is part of and incorporated into our Terms of Service (Section 6). To sign it or get a countersigned copy, contact us at [email protected].
Contents
This Business Associate Agreement (the “BAA”) is between the customer identified below (“Covered Entity” or “Customer”) and Mosara ABA (“Business Associate” or “Mosara ABA”).
Background. Covered Entity uses the Mosara ABA service (the “Service”) under the Mosara ABA Terms of Service or an order form (together, the “Agreement”). In providing the Service, Business Associate may create, receive, maintain or transmit Protected Health Information on behalf of Covered Entity. This BAA sets out how Business Associate will protect that information, as required by HIPAA.
How this BAA takes effect. This BAA takes effect on the date Covered Entity accepts it, either by signing below or by accepting it electronically in the Service. Covered Entity may not put PHI into the Service until this BAA is in effect and Business Associate has confirmed in writing that Covered Entity’s account is enabled for PHI.
1. Definitions
1.1 General. Terms used but not defined in this BAA, such as Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information and Use, have the meanings given in HIPAA.
1.2 Specific terms.
- “HIPAA” means the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health (HITECH) Act, and their implementing regulations at 45 C.F.R. Parts 160 and 164, as amended.
- “Privacy Rule” and “Security Rule” mean the standards at 45 C.F.R. Part 160 and Part 164, Subparts A and E, and Part 164, Subpart C, respectively.
- “Protected Health Information” or “PHI” has the meaning given at 45 C.F.R. § 160.103, limited to information that Business Associate creates, receives, maintains or transmits on behalf of Covered Entity through the Service. It includes electronic PHI.
2. What Business Associate will do
Business Associate will:
2.1 Limit use and disclosure. Not use or disclose PHI other than as permitted or required by this BAA or as Required by Law.
2.2 Safeguard PHI. Use appropriate administrative, physical and technical safeguards, and comply with the Security Rule with respect to electronic PHI, to prevent use or disclosure of PHI other than as this BAA provides.
2.3 Report problems. Report to Covered Entity: (a) any use or disclosure of PHI not provided for by this BAA of which it becomes aware; (b) any Security Incident of which it becomes aware; and (c) any Breach of Unsecured PHI, as required by 45 C.F.R. § 164.410.
2.4 Timing and content of Breach notices. Notify Covered Entity of a Breach of Unsecured PHI without unreasonable delay and in no case later than 10 calendar days after discovery of the Breach. The notice will include, to the extent known, the identity of each affected Individual, a description of what happened, the types of PHI involved, the date of the Breach and of its discovery, the steps Business Associate is taking to investigate and mitigate it, and any other information Covered Entity reasonably needs to meet its own notification obligations. Business Associate will supplement the notice as more information becomes available.
2.5 Unsuccessful Security Incidents. The parties agree that this Section is notice that unsuccessful attempts to access the Service occur regularly, such as pings, port scans, blocked sign-in attempts and denial-of-service attempts that do not result in unauthorized access to PHI. No further notice of such unsuccessful attempts is required.
2.6 Mitigate. Mitigate, to the extent practicable, any harmful effect known to Business Associate of a use or disclosure of PHI in violation of this BAA.
2.7 Subcontractors. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractor that creates, receives, maintains or transmits PHI on behalf of Business Associate agrees in writing to the same restrictions, conditions and requirements that apply to Business Associate under this BAA. Business Associate’s Subcontractors that may handle PHI include its cloud hosting provider and its AI model provider. A current list is available on request.
2.8 Access. Within 10 business days of a request from Covered Entity, make PHI in a Designated Record Set available to Covered Entity so that it can meet its obligations under 45 C.F.R. § 164.524. Covered Entity can generally do this itself through the Service’s export features. If an Individual asks Business Associate directly, Business Associate will forward the request to Covered Entity within 5 business days.
2.9 Amendment. Within 10 business days of a request from Covered Entity, make any amendment to PHI in a Designated Record Set that Covered Entity directs or agrees to under 45 C.F.R. § 164.526, or give Covered Entity the means to make it in the Service.
2.10 Accounting of disclosures. Keep the information required to provide an accounting of disclosures under 45 C.F.R. § 164.528 and provide it to Covered Entity within 10 business days of a request. If an Individual asks Business Associate directly, Business Associate will forward the request to Covered Entity.
2.11 Covered Entity’s Privacy Rule duties. To the extent Business Associate carries out any of Covered Entity’s obligations under the Privacy Rule, comply with the requirements of the Privacy Rule that apply to Covered Entity in performing those obligations.
2.12 Government access. Make its internal practices, books and records relating to PHI available to the Secretary for purposes of determining compliance with HIPAA.
2.13 Minimum necessary. Request, use and disclose only the minimum necessary PHI to accomplish the intended purpose, as required by HIPAA.
2.14 Location of PHI. Store and process PHI only in the United States, and not allow PHI to be accessed from outside the United States, unless Covered Entity agrees in writing.
2.15 Training and personnel. Ensure that its workforce members who have access to PHI are trained on HIPAA and bound by confidentiality obligations, and limit access to PHI to those who need it to provide the Service or support.
3. How Business Associate may use and disclose PHI
3.1 To provide the Service. Business Associate may use and disclose PHI as necessary to provide the Service to Covered Entity under the Agreement, including support that Covered Entity requests.
3.2 Management and administration. Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities. It may disclose PHI for those purposes only if the disclosure is Required by Law, or if Business Associate first obtains reasonable written assurances from the recipient that the PHI will be held confidentially, used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the recipient will notify Business Associate of any instance of which it is aware in which the confidentiality of the PHI has been breached.
3.3 De-identification. Business Associate may de-identify PHI in accordance with 45 C.F.R. § 164.514(a) through (c) and may use de-identified information to operate, secure and improve the Service. De-identified information is not PHI.
3.4 Data aggregation. Business Associate may provide Data Aggregation services relating to Covered Entity’s Health Care Operations only if Covered Entity requests them in writing.
3.5 Reporting violations of law. Business Associate may use PHI to report violations of law to appropriate federal and state authorities, consistent with 45 C.F.R. § 164.502(j)(1).
3.6 What Business Associate will not do. Business Associate will not: (a) sell PHI; (b) use or disclose PHI for marketing or advertising; (c) use PHI to train or improve artificial intelligence or machine-learning models, whether its own or a third party’s; or (d) use or disclose PHI in any manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except as Sections 3.2 through 3.5 allow.
4. What Covered Entity will do
Covered Entity will:
4.1 Notices and restrictions. Notify Business Associate of any limitation in its Notice of Privacy Practices, any change in or revocation of an Individual’s permission, and any restriction on the use or disclosure of PHI that Covered Entity has agreed to, to the extent it may affect Business Associate’s use or disclosure of PHI.
4.2 Permissible requests only. Not ask Business Associate to use or disclose PHI in any manner that would not be permissible under the Privacy Rule if done by Covered Entity, except as Sections 3.2 through 3.5 allow.
4.3 Its own setup. Put PHI into the Service only after this BAA is in effect and its account is enabled for PHI; provide only the PHI needed to use the Service; configure user roles, access and settings appropriately; use the security features the Service provides, including multi-factor authentication; and send PHI to Business Associate only through the Service, not through email, demo requests or other channels not intended for PHI.
4.4 Its own obligations. Remain responsible for its obligations as a covered entity, including obtaining any required authorizations and consents, giving required notices, and notifying Individuals, the Secretary and the media of Breaches as HIPAA and state law require.
5. Term and termination
5.1 Term. This BAA remains in effect for as long as the Agreement is in effect, and afterward until all PHI has been returned or destroyed as described in Section 5.4.
5.2 Termination for breach. If either party learns that the other has materially breached this BAA, it will give written notice, and the other party will have 30 days to cure the breach. If the breach is not cured, the non-breaching party may terminate this BAA and the Agreement.
5.3 Effect of termination. Termination of this BAA ends Covered Entity’s right to put PHI into the Service.
5.4 Return or destruction of PHI. For 30 days after the Agreement ends, Covered Entity may export its PHI using the Service’s export features or by request. After that, Business Associate will destroy all PHI in the live Service within 30 days, and copies in backups will be deleted or overwritten within 90 days after that. Business Associate will confirm destruction in writing on request. If returning or destroying any PHI is not feasible, or the law requires Business Associate to keep it, Business Associate will extend the protections of this BAA to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as it keeps the PHI.
6. General
6.1 Legal references. A reference to a section of HIPAA means that section as in effect or as amended.
6.2 Changes in the law. The parties will amend this BAA as needed for either party to comply with changes in HIPAA or other applicable law. Business Associate may update this BAA to reflect such changes by giving Covered Entity at least 30 days’ written notice, provided the update does not reduce the protection of PHI.
6.3 Interpretation. Any ambiguity in this BAA will be resolved to permit compliance with HIPAA.
6.4 Order of precedence. If this BAA conflicts with the Agreement regarding PHI, this BAA controls. In all other respects, the Agreement, including its limitation of liability, governs.
6.5 No third-party beneficiaries. Nothing in this BAA gives any rights to anyone other than the parties and their permitted successors and assigns.
6.6 Survival. Business Associate’s obligations under Section 5.4 and any other provision that by its nature should survive will survive termination.
6.7 Governing law. This BAA is governed by federal law, including HIPAA, and, to the extent not preempted, the laws of the State of Florida. Venue is as stated in the Agreement (Miami-Dade County, Florida).
6.8 Notices. Notices under this BAA go to Covered Entity’s account owner email address on file and to Business Associate at [email protected]. Breach notices to Covered Entity will also be made by telephone or another prompt method where practical.
6.9 Signatures. This BAA may be accepted electronically in the Service or signed in counterparts, including by electronic signature, each of which is an original.
Signatures
Covered Entity
Practice legal name: ______________________________
Signature: ______________________________
Name and title: ______________________________
Date: ______________________________
Business Associate: Mosara ABA
Signature: ______________________________
Name and title: ______________________________
Date: ______________________________
Questions? [email protected]