Our HIPAA business associate agreement

Who and what

This agreement is between the client (the “Covered Entity”) and Elaria Agentic, LLC (“Elaria”). It applies whenever Elaria receives, creates or keeps protected health information (“PHI”) for the client. Words like PHI and breach mean what HIPAA says they mean.

Elaria promises to

1. Use or share PHI only to do the agreed work or as the law requires, only the minimum needed, and never in a way the HIPAA Privacy Rule wouldn’t allow the client to.
2. Protect PHI with the safeguards the HIPAA Security Rule requires.
3. Tell the client within 5 business days of learning of any misuse, security incident or breach of unsecured PHI, with the details HIPAA requires (45 CFR 164.410).
4. Make any subcontractor that touches PHI agree in writing to these same promises.
5. Help the client respond when a patient asks to see, correct or get an accounting of their information, and make any corrections the client directs.
6. Follow the HIPAA Privacy Rule whenever it carries out any of the client’s Privacy Rule duties.
7. Make its internal practices, books and records about PHI available to the U.S. Department of Health and Human Services if asked.
8. Return or destroy all PHI when the work ends. If that isn’t possible, keep protecting it and use it only for the reason it couldn’t be returned.

The client promises to

1. Share only the minimum PHI needed for the work.
2. Tell Elaria about any patient restrictions or changes to its privacy notice that affect the work.
3. Not ask Elaria to use PHI in any way HIPAA wouldn’t allow the client to use it.

Ending it

This agreement lasts as long as Elaria works for the client. Either side may end it if the other breaks it and doesn’t fix the problem within 30 days, or right away if the problem can’t be fixed. Promise 8 and the duty to protect PHI continue after it ends. If HIPAA changes, this agreement is read to comply with the new rules.

Signing

It is signed electronically, together with our Client Agreement, when you submit a request, and a signed copy is emailed to you. It applies only if you share patient information with us. If your organization requires its own BAA, sign that one with us instead and it replaces this.