Business Associate Agreement
This Business Associate Agreement is Exhibit B to the AiroDental Master Services and Subscription Agreement.
Exhibit B — HIPAA Business Associate Addendum (BAA)
This Exhibit B is the “Business Associate Agreement” between Customer (and each Covered Entity listed in Exhibit A) and AiroDental. If there is any conflict between Exhibit B and the main body, Exhibit B controls with respect to PHI.
1. Purpose; Scope
1.1 Purpose. This BAA ensures compliance with HIPAA, HITECH, and implementing regulations and governs AiroDental’s use and disclosure of PHI to provide the Services.
1.2 Relationship. Customer is a Covered Entity (or is signing on behalf of one or more Covered Entities) and AiroDental is a Business Associate.
2. Definitions
Capitalized terms not defined here have the meanings set forth in HIPAA and 45 CFR §160.103, including PHI, Breach, Security Incident, and Unsecured PHI.
3. Permitted Uses and Disclosures
3.1 Permitted uses. AiroDental may use PHI solely as necessary to provide the Services and as otherwise permitted by HIPAA, including proper management and administration, and to carry out AiroDental’s legal responsibilities.
3.2 Permitted disclosures. AiroDental may disclose PHI only: (a) as permitted by this BAA, (b) as required by law, or (c) to Subprocessors in accordance with Section 5.
3.3 Minimum necessary. AiroDental will apply the “minimum necessary” standard where applicable.
3.4 No sale of PHI. AiroDental will not sell PHI.
4. Safeguards
4.1 Safeguards. AiroDental will implement appropriate administrative, physical, and technical safeguards to protect PHI and comply with the Security Rule standards at 45 CFR §§164.308, 164.310, and 164.312.
4.2 Customer responsibilities. Customer is responsible for its administrative and operational HIPAA compliance, including policies, training, workstation security, user access governance, and obtaining any required patient consents.
5. Subprocessors
5.1 Subprocessors allowed. AiroDental may use Subprocessors to assist in providing Services, provided AiroDental obtains written assurances that Subprocessors will protect PHI with protections no less stringent than this BAA. Subprocessors may include integration, connector, and synchronization providers that access Customer Systems on AiroDental’s behalf.
6. Breach and Security Incident Reporting
6.1 Reporting. AiroDental will report to Customer any unauthorized use or disclosure of PHI, including Security Incidents and Breaches of Unsecured PHI, without unreasonable delay and in any event no later than five (5) business days after discovery.
6.2 Content of report. Reports will include, to the extent known, what happened, types of information involved, mitigation steps taken, and recommended next steps.
6.3 Cooperation. The Parties will cooperate in good faith on investigation and mitigation. Unless caused by AiroDental’s breach of this BAA, Customer remains responsible for required notifications to individuals and regulators.
7. Access, Amendment, and Accounting
7.1 Access. To the extent required by HIPAA, AiroDental will make PHI available for access requests.
7.2 Amendment. To the extent required, AiroDental will incorporate amendments directed by Customer.
7.3 Accounting. To the extent required, AiroDental will provide information for accounting of disclosures.
8. Return or Destruction of PHI
8.1 Return or destruction. Upon termination of the Services, AiroDental will return or destroy PHI where feasible. If infeasible, AiroDental will continue to protect PHI and limit further uses and disclosures to those that make return or destruction infeasible.
9. Term; Termination
9.1 Term. This BAA remains in effect for as long as AiroDental provides Services involving PHI.
9.2 Termination for cause. If Customer learns of a pattern of activity or practice by AiroDental that constitutes a material breach, Customer will provide notice and opportunity to cure. If cure is not possible, Customer may terminate the affected Services.
10. Assignment
AiroDental may assign this BAA to an affiliate or successor in connection with a merger, acquisition, reorganization, or sale of assets.
11. Indemnification; PHI Liability
11.1 AiroDental indemnity. To the extent permitted by law, AiroDental will indemnify Customer for third-party claims arising directly from AiroDental’s material breach of this BAA or gross negligence in handling PHI.
11.2 Customer indemnity. Customer will indemnify AiroDental for third-party claims arising from Customer’s failure to comply with HIPAA obligations that are Customer’s responsibility, including access controls, consents, and improper instructions, and from access to Customer Systems that Customer authorized under Section 4 of the main Agreement.
11.3 Control. This Section 11 applies in addition to the limitation of liability and other terms in the main Agreement, to the maximum extent permitted by law.
12. Miscellaneous
12.1 Governing law. Same as the main Agreement.
12.2 Survival. Sections related to PHI protection survive termination to the extent required to allow return, destruction, or continued protection.