Legal
This Business Associate Agreement (“BAA”) is entered into between Hatch West, LLC dba Balance (“Balance” or “Business Associate”) and the entity accepting this BAA (“Client”) and supplements the Balance Terms of Service or other services agreement between the parties (the “Services Agreement”). This BAA is effective when Client accepts it (the “Effective Date”). Client and its Authorized Users must not submit PHI to the Covered Services before this BAA is in effect.
Client may be a HIPAA Covered Entity or a Business Associate of another Covered Entity. When Client is a Business Associate, references in this BAA to obligations owed to a Covered Entity will apply as appropriate to the upstream Covered Entity and Balance will act as Client’s Business Associate subcontractor. The parties intend this BAA to satisfy 45 C.F.R. §§ 164.502(e), 164.504(e), and 164.308(b), as applicable.
1. Definitions
Capitalized terms not otherwise defined in this BAA have the meanings given in the HIPAA Rules or the Services Agreement. “HIPAA Rules” means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Parts 160 and 164, as amended. “Covered Services” means the Balance Services through which Balance creates, receives, maintains, or transmits PHI on behalf of Client. “Breach,” “Business Associate,” “Covered Entity,” “Designated Record Set,” “Electronic Protected Health Information” or “ePHI,” “Individual,” “Protected Health Information” or “PHI,” “Required by Law,” “Secretary,” “Security Incident,” “Subcontractor,” and “Unsecured Protected Health Information” have the meanings assigned by the HIPAA Rules.
2. Applicability and Roles
This BAA applies only to PHI that Balance creates, receives, maintains, or transmits on behalf of Client through the Covered Services. If Client is a Covered Entity, Balance is Client’s Business Associate. If Client is itself a Business Associate, Balance is a Business Associate subcontractor to the extent it performs functions involving PHI on behalf of Client or the applicable Covered Entity.
A Billing Company Client may not use Balance for PHI relating to a Practice Client unless the Practice Client has completed Balance’s required direct onboarding and any legally required BAA or other arrangement is in effect. Nothing in this BAA makes a Billing Company Client the owner of a Practice Client’s PHI or patient receivables.
3. Permitted Uses and Disclosures by Balance
Balance may use or disclose PHI only as permitted by this BAA and the Services Agreement, as necessary to provide the Covered Services, or as Required by Law. Balance will not use or disclose PHI in a manner that would violate the HIPAA Privacy Rule if done by Client, except for uses and disclosures permitted for Balance’s proper management and administration or legal responsibilities as described below.
Balance may use PHI for its proper management and administration and to carry out its legal responsibilities. Balance may disclose PHI for those purposes only if Required by Law or if Balance obtains reasonable assurances from the recipient that the PHI will remain confidential, will be used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and the recipient will notify Balance of any breach of confidentiality of which it becomes aware.
Balance may use PHI to provide data-aggregation services relating to the healthcare operations of Client to the extent permitted by HIPAA. Balance may also de-identify PHI in accordance with 45 C.F.R. § 164.514. Once information has been properly de-identified and is no longer PHI, Balance may use it as permitted by the Services Agreement and Applicable Law.
Except for rights expressly granted in this BAA and the Services Agreement to provide the Covered Services, Balance’s receipt or stewardship of PHI does not transfer ownership of PHI to Balance. This does not limit Balance’s rights in information that has been properly de-identified so that it is no longer PHI.
Balance will not use PHI for advertising or marketing and will not use PHI to train general-purpose artificial-intelligence models.
4. Balance Obligations
4.1 Safeguards and Security Rule
Balance will use appropriate safeguards to prevent use or disclosure of PHI other than as provided by this BAA and will comply with the applicable requirements of Subpart C of 45 C.F.R. Part 164 with respect to ePHI.
4.2 Reporting Impermissible Uses, Disclosures, Breaches, and Security Incidents
Balance will report to Client any use or disclosure of PHI not permitted by this BAA of which Balance becomes aware and any Security Incident of which Balance becomes aware, subject to the unsuccessful-attempt provision below. Balance will notify Client of a Breach of Unsecured PHI without unreasonable delay and in no event later than 30 calendar days after Balance discovers the Breach.
To the extent reasonably available, a Breach notice will identify the individuals affected; the types of information involved; the known circumstances; steps Balance has taken or plans to take to investigate, mitigate harm, and prevent recurrence; and information reasonably necessary for Client to satisfy its notification obligations. Balance will supplement the notice as additional relevant information becomes available.
The parties acknowledge that unsuccessful attempts at unauthorized access, use, disclosure, modification, or destruction of information, or unsuccessful interference with system operations, occur routinely. This paragraph constitutes notice of unsuccessful Security Incidents such as pings, port scans, unsuccessful log-in attempts, denial-of-service attempts that do not result in unauthorized access, and similar events, and Balance need not separately report them unless required by law or they result in a material security event.
4.3 Mitigation and Response
Balance will take reasonable steps to mitigate, to the extent practicable, any harmful effect known to Balance resulting from a use or disclosure of PHI by Balance or its Subcontractors in violation of this BAA, and will identify, respond to, mitigate, and document Security Incidents as required by the HIPAA Rules.
4.4 Subcontractors
In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Balance will ensure that Subcontractors that create, receive, maintain, or transmit PHI on Balance’s behalf agree in writing to the same restrictions, conditions, and requirements that apply to Balance with respect to that PHI. Balance remains responsible for performance of its obligations under this BAA notwithstanding its use of Subcontractors.
4.5 Access
To the extent Balance maintains PHI in a Designated Record Set, Balance will make PHI available to Client as reasonably necessary for Client to satisfy its obligations under 45 C.F.R. § 164.524, taking into account Client’s applicable response deadlines. Unless otherwise agreed, Balance may satisfy this obligation by making the relevant PHI available through the Covered Services or a reasonable export. If Balance receives a request directly from an Individual or personal representative relating to PHI maintained on Client’s behalf, Balance will forward or direct the request to Client reasonably promptly and, where practicable, within ten (10) business days, and will not make an independent determination regarding access unless instructed by Client or Required by Law.
4.6 Amendment
To the extent required by 45 C.F.R. § 164.526 and applicable to PHI maintained by Balance in a Designated Record Set, Balance will make amendments or take other measures as directed or agreed to by Client within a reasonable time that permits Client to meet its applicable obligations. Client is responsible for determining whether an amendment is required. If Balance receives an amendment request directly from an Individual or personal representative, Balance will forward or direct the request to Client reasonably promptly and will not independently determine whether an amendment should be made unless Required by Law.
4.7 Accounting of Disclosures
Balance will document and make available to Client information about disclosures of PHI as necessary for Client to satisfy its obligations under 45 C.F.R. § 164.528, to the extent those obligations apply to Balance.
If Balance receives a request for an accounting of disclosures directly from an Individual or personal representative, Balance will forward or direct the request to Client reasonably promptly. Client or the applicable Covered Entity remains responsible for determining and providing the accounting, except to the extent Applicable Law directly requires Balance to respond.
4.8 HHS Access
Balance will make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received on behalf of, Client available to the Secretary for purposes of determining compliance with the HIPAA Rules, as Required by Law and subject to applicable legal privileges.
4.9 Minimum Necessary
Balance will make reasonable efforts to limit its uses, disclosures, and requests for PHI to the minimum necessary to accomplish the intended purpose, to the extent the minimum-necessary standard applies under HIPAA.
5. Client Obligations
Client will not request that Balance use or disclose PHI in a manner that would violate the HIPAA Rules if done by Client, except to the extent HIPAA permits a Business Associate to use or disclose PHI for its own management and administration, legal responsibilities, or data aggregation as provided in this BAA.
Client will notify Balance of limitations in Client’s notice of privacy practices, changes in or revocation of an Individual’s permission, and restrictions under 45 C.F.R. § 164.522, in each case to the extent the limitation, change, revocation, or restriction may affect Balance’s use or disclosure of PHI.
Client represents that it has the authority and any legally required consent or authorization to disclose PHI to Balance and to instruct Balance to process PHI for the Covered Services. Client remains responsible for its HIPAA obligations as a Covered Entity or Business Associate, including responding to Individual rights requests except to the extent this BAA expressly assigns assistance to Balance.
6. Term and Termination
This BAA remains in effect for as long as Balance maintains PHI on behalf of Client in connection with the Covered Services. If either party knows of a pattern of activity or practice by the other party that constitutes a material breach of this BAA, the non-breaching party will take reasonable steps to cure the breach or end the violation. If those steps are unsuccessful and termination is feasible, the non-breaching party may terminate the affected Covered Services or this BAA as required by HIPAA.
If continued use of the Services would require Balance to maintain or process PHI after this BAA terminates, Client must cease submitting PHI and discontinue the affected Covered Services unless another legally sufficient arrangement is in effect.
7. Return or Destruction of PHI
Upon termination of the Covered Services, Balance will return or destroy PHI received from Client, or created, maintained, or received by Balance on Client’s behalf, if feasible and as required by HIPAA. If return or destruction is not feasible, or if Balance must retain PHI for legal, backup, security, or proper management and administration purposes permitted by HIPAA, Balance will retain only the PHI reasonably necessary for that purpose, continue to protect it under this BAA, and limit further uses and disclosures to the purposes that make return or destruction infeasible.
8. General
The Services Agreement’s provisions concerning confidentiality, limitation of liability, dispute resolution, governing law, notices, assignment, and general contract terms apply to this BAA except to the extent inconsistent with the HIPAA Rules. The liability limitations in the Services Agreement apply to this BAA to the maximum extent permitted by law.
If this BAA conflicts with the Services Agreement regarding PHI or HIPAA obligations, this BAA controls. Otherwise, the Services Agreement remains in full force. Any ambiguity will be interpreted to permit the parties to comply with the HIPAA Rules. References to a regulatory section include successor provisions.
The obligations in Sections 4, 7, and any other provisions that by their nature must survive will continue for as long as Balance retains PHI.