Business Associate Agreement

ReadySetConnect

This Business Associate Agreement (“Agreement”) is entered into by and between you (“Business Associate”) and ReadySetConnect, Inc. (“Subcontractor”) as of the date you create an account with ReadySetConnect (“Effective Date”). This Agreement supplements and is incorporated into the Terms of Service between the parties.

RECITALS

WHEREAS, the Business Associate provides services to Covered Entities (e.g., clinics) and, in the course of providing such services, may use or disclose Protected Health Information (“PHI”) as defined in the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”);

WHEREAS, the Subcontractor (ReadySetConnect) provides practice management technology services to the Business Associate that involve the storage, transmission, or processing of PHI on behalf of the Business Associate;

WHEREAS, Business Associate and Subcontractor intend to comply with HIPAA, the HITECH Act, and related regulations, including the Privacy Rule, Security Rule, and Breach Notification Rule;

WHEREAS, Subcontractor provides a SaaS practice management platform that involves the storage, transmission, and processing of PHI on behalf of Business Associate;

WHEREAS, the parties intend this Agreement to comply with the HIPAA Rules, including requirements for subcontractor business associate agreements under 45 CFR § 164.504(e).

NOW, THEREFORE, the parties agree as follows:

1. Definitions

Capitalized terms not defined herein have the meanings set forth in the HIPAA Rules (45 CFR Parts 160 and 164, as amended).

Protected Health Information (PHI): Individually identifiable health information transmitted or maintained in any form or medium.
Breach: As defined in 45 CFR § 164.402.
Security Incident: As defined in 45 CFR § 164.304.
HIPAA Rules: Collectively, the Privacy Rule, Security Rule, Breach Notification Rule, and Enforcement Rule.
Designated Record Set: As defined in 45 CFR § 164.501, limited to records maintained by Subcontractor on behalf of Business Associate.
Security Incident and Breach: As defined in the HIPAA Rules.

Obligations of Subcontractor (Readysetconnect)

2.1 Permitted Uses and Disclosures: Subcontractor may use or disclose PHI solely to provide the SaaS services as described in the Terms of Service and as permitted under the HIPAA Rules. Subcontractor may also use PHI for its proper management and administration or to fulfill its legal responsibilities, provided such uses are consistent with the HIPAA Rules.
2.2 Limitations: Subcontractor shall not use or disclose PHI other than as permitted or required by this Agreement or as required by law. Subcontractor shall not use or disclose PHI in any manner that would violate the HIPAA Rules if done by Business Associate.
2.3 Safeguards: Subcontractor shall implement and maintain appropriate administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of PHI, including compliance with the HIPAA Security Rule for Electronic PHI. Subcontractor shall regularly review and update these safeguards consistent with industry standards for SaaS platforms.
2.4 Reporting of Incidents and Breaches: Subcontractor shall report to Business Associate without unreasonable delay and in no event later than ten (10) calendar days after discovery

Any Security Incident (summary of facts reasonably available).
Any Breach of Unsecured PHI.

The report shall include the information you listed (description, date, type of PHI, mitigation steps, etc.). Business Associate is responsible for any required notifications to individuals, Covered Entities, or regulators unless the parties mutually agree otherwise in writing. Subcontractor shall cooperate in good faith and mitigate harmful effects to the extent practicable.

2.5 Sub-subcontractors: Subcontractor shall ensure any downstream entity agrees in a written agreement to the same restrictions and conditions that apply to Subcontractor hereunder.
2.6–2.8 Access to PHI, Amendments, Accounting of Disclosures: These are good. Add reasonable timeframes, e.g.: “within a timeframe that allows Business Associate to meet its obligations under the HIPAA Rules, but in no event later than [15-30] days after request, unless otherwise agreed.”
For direct requests from Individuals: Subcontractor may forward them to Business Associate or respond as directed.
2.9 Government Access: Subcontractor shall make its internal practices, books, and records available to the Secretary of HHS for HIPAA compliance determination.
2.10 Minimum Necessary: Subcontractor shall limit its use and disclosure of PHI to the minimum necessary to perform its obligations.
2.11: Subcontractor may de-identify PHI in accordance with 45 CFR § 164.514(a)-(c) if permitted by the Terms of Service.

3. Obligations of Business Associate (you)?

3.1 Notice of Restrictions: Business Associate shall inform Subcontractor of any limitations, restrictions, or changes in PHI use or disclosure that may affect Subcontractor’s performance.
3.2 No Impermissible Requests: Business Associate shall not request Subcontractor to use or disclose PHI in a way that would violate HIPAA.
3.3 Business Associate shall promptly notify Subcontractor of any restrictions, changes, or limitations on the use/disclosure of PHI that could affect Subcontractor’s performance of the services.

4. Term and Termination

4.1 Term: This Agreement is effective as of the Effective Date and shall remain in effect until terminated by either party or upon termination of the Business Associate’s use of ReadySetConnect.
4.2 Termination for Cause: Either party may terminate if the other materially breaches and fails to cure within thirty (30) days of written notice (or immediately if cure is not feasible for PHI security issues).
4.3 Effect of Termination: Upon termination, at the direction of Business Associate, Subcontractor shall return or securely destroy PHI in its possession. If return or destruction is infeasible (e.g., due to backups or legal holds), Subcontractor shall notify Business Associate and continue to protect such PHI under the terms of this Agreement. Subcontractor may retain copies as required by law or for legitimate business records.

5. Miscellaneous

5.1 Regulatory References: References to HIPAA include all amendments and implementing regulations.
5.2 Amendments: This Agreement may be modified only in writing, signed by both parties.
5.3 Interpretation: Any ambiguity shall be interpreted to allow compliance with HIPAA.
5.4 Entire Agreement: This Agreement, together with the Terms of Service, constitutes the full agreement concerning PHI.
5.5 Governing Law: This Agreement shall be governed by the laws of the State of [your state, e.g., California/Delaware], without regard to conflict of laws principles.
5.6 Notices: All notices shall be in writing and sent to the address or contact information provided during registration.
5.7 Limitation of Liability: To the maximum extent permitted by law, Subcontractor’s liability under this Agreement shall be limited as set forth in the Terms of Service.
5.8 Survival: Provisions relating to PHI protection, confidentiality, and indemnification (if any) survive termination.
5.9 No Agency: Nothing in this Agreement creates an agency, partnership, or joint venture relationship.