Business Associate Agreement

Capitalized terms such as Business Associate, Covered Entity, Protected Health Information (PHI), Electronic PHI, Breach, Security Incident and Unsecured PHI have the meanings given in HIPAA and the HITECH Act and their implementing regulations at 45 C.F.R. Parts 160 and 164.

AminoLiance (Business Associate) may use and disclose PHI only to provide the Service to the practice (Covered Entity), as required by law, and for its proper management and administration as permitted by 45 C.F.R. § 164.504(e).

Business Associate will not use or disclose PHI in any way that would violate the Privacy Rule if done by Covered Entity, and will limit uses and disclosures to the minimum necessary.

Business Associate will use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 C.F.R. Part 164 with respect to Electronic PHI, to prevent use or disclosure other than as this agreement provides.

Business Associate will report to Covered Entity any use or disclosure of PHI not provided for by this agreement, including Breaches of Unsecured PHI as required by 45 C.F.R. § 164.410, and any Security Incident of which it becomes aware, without unreasonable delay and in no case later than [X] days after discovery.

Business Associate will ensure that any subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions, conditions and requirements, in accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2).

Business Associate will make PHI available to Covered Entity as needed for Covered Entity to meet its obligations for access (§ 164.524), amendment (§ 164.526) and an accounting of disclosures (§ 164.528).

Business Associate will make its internal practices, books and records relating to PHI available to the Secretary of Health and Human Services for determining compliance with HIPAA.

This agreement lasts as long as Business Associate holds PHI for Covered Entity. Either party may terminate for the other's material breach that is not cured within [30] days.

On termination, Business Associate will return or destroy all PHI. Where that is infeasible, it will extend these protections to the PHI and limit further uses to the purposes that make return or destruction infeasible.

Covered Entity will notify Business Associate of any limitation in its notice of privacy practices, any change in or revocation of an individual's permission, and any restriction it agrees to, to the extent these affect Business Associate's use or disclosure of PHI.