Terri Ross Consulting LLC
Business Associate Agreement
Quick Jump
This Business Associate Agreement (“Agreement”) is entered into between the Covered Entity identified below (“Covered Entity”) and Terri Ross Consulting LLC (“Business Associate”), collectively referred to as the “Parties.”
1. Definitions
The following terms have the meanings set forth below, as defined under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations:
- “Breach” means the acquisition, access, use, or disclosure of Protected Health Information in a manner not permitted under the HIPAA Privacy Rule.
- “Business Associate” means Terri Ross Consulting LLC, which performs functions or activities involving the use or disclosure of Protected Health Information on behalf of a Covered Entity.
- “Covered Entity” means the healthcare provider, health plan, or healthcare clearinghouse that signs this Agreement.
- “Protected Health Information” or “PHI” means individually identifiable health information transmitted or maintained in any form or medium.
- “Required by Law” means a mandate contained in law that compels an entity to make a use or disclosure of PHI.
- “Secretary” means the Secretary of the U.S. Department of Health and Human Services.
2. Obligations of Business Associate
2.1 Permitted Uses and Disclosures
Business Associate may use or disclose PHI only as necessary to perform services on behalf of Covered Entity, as required by law, or as otherwise permitted under this Agreement.
2.2 Safeguards
Business Associate shall implement appropriate administrative, physical, and technical safeguards to prevent the unauthorized use or disclosure of PHI, in accordance with the HIPAA Security Rule.
2.3 Subcontractors
Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree to the same restrictions and conditions that apply to Business Associate under this Agreement.
2.4 Reporting
Business Associate shall report to Covered Entity any use or disclosure of PHI not permitted by this Agreement, including any Breach of Unsecured PHI, without unreasonable delay and in no case later than sixty (60) calendar days following discovery.
2.5 Access and Amendment
Business Associate shall provide access to PHI in a designated record set to Covered Entity or to an individual as directed, and shall make any amendments to PHI as directed by Covered Entity.
2.6 Accounting of Disclosures
Business Associate shall maintain documentation of disclosures of PHI and provide such information to Covered Entity to enable Covered Entity to respond to an individual’s request for an accounting of disclosures.
2.7 Government Access
Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining Covered Entity’s compliance with HIPAA.
3. Obligations of Covered Entity
Covered Entity shall:
- Notify Business Associate of any limitation in the Notice of Privacy Practices that affects the use or disclosure of PHI
- Notify Business Associate of any changes in, or revocation of, permission by an individual to use or disclose PHI
- Notify Business Associate of any restriction to the use or disclosure of PHI
4. Term and Termination
4.1 Term and Termination
This Agreement shall be effective as of the date it is executed and shall remain in effect until terminated.
4.2 Termination for Clause
Either Party may terminate this Agreement immediately if the other Party materially breaches a provision of this Agreement and fails to cure such breach within thirty (30) days of written notice.
4.3 Effect of Termination
Upon termination, Business Associate shall return or destroy all PHI. If return or destruction is infeasible, Business Associate shall extend the protections of this Agreement to any retained PHI.
5. Miscellaneous
5.1 Regulatory References
Any reference in this Agreement to a HIPAA regulation means the regulation currently in effect or as amended.
5.2 Amendment
The Parties agree to amend this Agreement to the extent necessary to comply with changes in applicable law.
5.3 Survival
The obligations of Business Associate under Section 4.3 (Effect of Termination) shall survive termination of this Agreement.
5.4 Interpretation
This Agreement shall be interpreted as broadly as necessary to implement and comply with HIPAA.
