Business Associate Agreement

This BAA is between the dental practice that accepts the Practice Agreement ("Covered Entity") and DentalMember ("Business Associate"). Capitalized terms not defined here have the meanings given in the HIPAA Rules (45 C.F.R. Parts 160 and 164), including "Protected Health Information" ("PHI"), which here means PHI that Business Associate creates, receives, maintains or transmits on behalf of Covered Entity.

1. Permitted uses and disclosures

• Business Associate may use and disclose PHI only to provide the DentalMember services described in the Practice Agreement, as required by law, or as otherwise permitted by this BAA.
• Business Associate may use PHI for its proper management and administration and to carry out its legal responsibilities, and may disclose PHI for those purposes if required by law or if it obtains reasonable assurances that the recipient will keep it confidential and report any breach.
• Business Associate may de-identify PHI in accordance with 45 C.F.R. § 164.514(b) and use de-identified information to operate and improve its services.
• Business Associate will request, use and disclose only the minimum necessary PHI, and will not use or disclose PHI in a way that would violate the Privacy Rule if done by Covered Entity. Business Associate will not sell PHI or use it for marketing.

2. Safeguards

Business Associate will use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 C.F.R. Part 164 (the Security Rule) for electronic PHI, to prevent use or disclosure of PHI other than as permitted by this BAA.

3. Reporting

• Business Associate will report to Covered Entity any use or disclosure of PHI not permitted by this BAA, and any Security Incident, of which it becomes aware, within 10 business days of discovery.
• Business Associate will report any Breach of Unsecured PHI without unreasonable delay and in no case later than 30 calendar days after discovery, with the information required by 45 C.F.R. § 164.410, so that Covered Entity can meet its notification obligations.
• Unsuccessful attempts that do not result in unauthorized access, such as blocked log-in attempts, pings and port scans, are reported in aggregate on request and need no individual notice.

4. Subcontractors

Business Associate will ensure that any subcontractor that creates, receives, maintains or transmits PHI on its behalf (for example, hosting and database providers) agrees in writing to the same restrictions and conditions that apply to Business Associate under this BAA.

5. Individuals' rights

• Within 15 business days of a request from Covered Entity, Business Associate will make PHI available so that Covered Entity can meet its obligations to provide access (45 C.F.R. § 164.524), make amendments (§ 164.526) and provide an accounting of disclosures (§ 164.528).
• If an individual asks Business Associate directly, it will forward the request to Covered Entity promptly.
• To the extent Business Associate carries out an obligation of Covered Entity under the Privacy Rule, it will comply with the requirements that apply to Covered Entity in doing so.

6. Records

Business Associate will make its internal practices, books and records relating to PHI available to the Secretary of Health and Human Services for determining compliance with the HIPAA Rules.

7. Covered Entity's obligations

Covered Entity will notify Business Associate of any limitation in its Notice of Privacy Practices, any change or revocation of an individual's permission, or any restriction it agrees to, to the extent it affects Business Associate's use or disclosure of PHI. Covered Entity will not ask Business Associate to use or disclose PHI in a way not permitted by the Privacy Rule.

8. Term and termination

• This BAA lasts as long as the Practice Agreement and ends when all PHI has been returned or destroyed.
• If either party learns that the other has materially breached this BAA, it will give written notice and 30 days to cure. If the breach is not cured, it may terminate the Practice Agreement.
• On termination, Business Associate will return to Covered Entity, or destroy, all PHI it still holds, and keep no copies. If return or destruction is not feasible (for example, records the law requires it to keep), the protections of this BAA continue for as long as Business Associate holds that PHI, and further use is limited to the purposes that make return or destruction infeasible.

9. General

• This BAA will be interpreted to permit compliance with the HIPAA Rules, and amended as needed to keep up with changes to them. If it conflicts with the Practice Agreement, this BAA controls with respect to PHI.
• Nothing in this BAA gives any rights to anyone other than the parties.

Questions about this document? Email support@dentalmember.com.