Legal
Business Associate Agreement
This Business Associate Agreement ("BAA") is entered into between the healthcare provider or practice identified in the applicable account or order form ("Covered Entity") and Telasight, Inc. ("Business Associate"). It applies to Business Associate's provision of the Telasight Platform (the "Services").
1. Definitions
Capitalized terms not defined here have the meanings given in HIPAA, the HITECH Act, and their implementing regulations at 45 CFR Parts 160 and 164 (together, "HIPAA"). "PHI" means protected health information that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity. "De-identified Data" means information de-identified in accordance with 45 CFR 164.514(a)–(b); it is not PHI. "Aggregated Data" has the meaning given in the Telasight Terms of Service.
2. Permitted uses and disclosures
Business Associate may use and disclose PHI only:
- (a) to perform the Services for Covered Entity;
- (b) for Business Associate's proper management and administration or to carry out its legal responsibilities, as permitted by 45 CFR 164.504(e)(4);
- (c) to provide data aggregation services relating to Covered Entity's health care operations, if requested;
- (d) to create De-identified Data in accordance with 45 CFR 164.514, and Aggregated Data from it. De-identified Data and Aggregated Data are not PHI, are not subject to this BAA, and may be used by Business Associate as set out in the Telasight Terms of Service;
- (e) as required by law.
Business Associate will limit uses, disclosures, and requests to the minimum necessary.
3. Safeguards
- Business Associate will use appropriate administrative, physical, and technical safeguards, and comply with Subpart C of 45 CFR Part 164 (the Security Rule) for electronic PHI, to prevent uses or disclosures not permitted by this BAA.
- Business Associate will not use PHI to train artificial-intelligence models, and will not permit its subcontractors to do so. This restriction does not apply to De-identified Data or Aggregated Data.
4. Reporting
Business Associate will report to Covered Entity:
- (a) any use or disclosure of PHI not provided for by this BAA;
- (b) any Security Incident of which it becomes aware. The parties agree that unsuccessful attempts (such as pings, port scans, or blocked log-in attempts) need no further notice;
- (c) any Breach of Unsecured PHI, as required by 45 CFR 164.410, without unreasonable delay and no later than ten (10) business days after discovery. The report will include the information required by 45 CFR 164.410(c) as it becomes available.
5. Subcontractors
Business Associate will ensure that any subcontractor that creates, receives, maintains, or transmits PHI on its behalf agrees in writing to the same restrictions and conditions that apply to Business Associate (45 CFR 164.502(e)(1)(ii) and 164.308(b)). This includes cloud hosting and AI model providers.
6. Individual rights
To the extent Business Associate maintains PHI in a Designated Record Set, it will, within fifteen (15) days of a request from Covered Entity:
- (a) make PHI available for access under 45 CFR 164.524;
- (b) make amendments as directed under 45 CFR 164.526.
Business Associate will also document disclosures and provide the information needed for an accounting of disclosures under 45 CFR 164.528.
7. Covered Entity's obligations
To the extent Business Associate carries out an obligation of Covered Entity under Subpart E of 45 CFR Part 164, it will comply with the requirements that apply to Covered Entity in performing that obligation.
8. Access by HHS
Business Associate will make its internal practices, books, and records relating to PHI available to the Secretary of HHS for determining compliance with HIPAA.
9. Covered Entity's responsibilities
Covered Entity will:
- (a) notify Business Associate of any limitation in its notice of privacy practices, restriction agreed to under 45 CFR 164.522, or change in an individual's permission, to the extent it affects Business Associate's use or disclosure of PHI;
- (b) not request any use or disclosure that would violate HIPAA if done by Covered Entity.
10. Term and termination
- This BAA remains in effect while Business Associate provides the Services.
- If either party learns of a pattern of activity or practice by the other that is a material breach of this BAA, it may give notice and an opportunity to cure within 30 days. If the breach is not cured, it may terminate this BAA and the Services.
11. Return or destruction
- Upon termination, Business Associate will return or destroy all PHI it maintains in any form, within thirty (30) days, and retain no copies. This does not apply to De-identified Data or Aggregated Data, which are not PHI.
- If return or destruction is infeasible, Business Associate will extend this BAA's protections to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible.
12. Miscellaneous
- This BAA will be interpreted to permit compliance with HIPAA. Any ambiguity is resolved in favor of compliance.
- It will be amended as needed to comply with changes in HIPAA.
- If this BAA conflicts with any other agreement between the parties regarding PHI, this BAA controls.
- Nothing in this BAA creates rights for third parties.
- Survival: obligations under Sections 4, 6, 8, and 11 survive termination.
Accepted by Covered Entity through electronic acceptance during account onboarding, or:
Covered Entity: Name/Title: Date:
Telasight, Inc.: Name/Title: Date: