Business Associate Agreement

This Business Associate Agreement (“BAA”) is entered into between AiroDental LLC (“Business Associate”) and the dental practice or other customer identified in the applicable account or enrollment record (“Covered Entity”). It is part of and supplements the Master Services Agreement (the “Agreement”) and sets the terms under which Business Associate may create, receive, maintain, or transmit Protected Health Information on behalf of Covered Entity. For matters governed by HIPAA, this BAA controls over the Agreement. Terms used but not defined here have the meanings in HIPAA.

1. Definitions

“HIPAA” means the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, including the Privacy, Security, and Breach Notification Rules, as amended by the HITECH Act. “Protected Health Information” or “PHI” means individually identifiable health information that Business Associate creates, receives, maintains, or transmits for Covered Entity. “Electronic PHI,” “Breach,” “Security Incident,” “Subcontractor,” and “Required by Law” have the meanings given in HIPAA.

2. Permitted Uses and Disclosures

Business Associate may use and disclose PHI only as permitted by this BAA, the Agreement, or as Required by Law. Business Associate may use and disclose PHI to perform the services described in the Agreement, to provide, secure, support, and improve those services, for the proper management and administration of Business Associate, and to carry out its legal responsibilities, provided that any disclosure is Required by Law or the recipient agrees to protect the PHI and to notify Business Associate of any breach. Business Associate may de-identify PHI in accordance with HIPAA and use aggregated or de-identified data that does not identify any individual.

3. Obligations of Business Associate

• Not use or disclose PHI other than as permitted by this BAA or Required by Law.
• Use appropriate administrative, physical, and technical safeguards, and comply with the Security Rule with respect to Electronic PHI, to prevent use or disclosure of PHI other than as provided by this BAA.
• Limit its use, disclosure, and requests of PHI to the minimum necessary.
• Report to Covered Entity any use or disclosure of PHI not permitted by this BAA, any Security Incident, and any Breach of unsecured PHI of which it becomes aware, without unreasonable delay and as described in Section 5.
• Mitigate, to the extent practicable, any harmful effect of a use or disclosure of PHI in violation of this BAA that is known to Business Associate.

4. Subcontractors

Business Associate will ensure that any subcontractor that creates, receives, maintains, or transmits PHI on its behalf agrees in writing to restrictions and conditions at least as protective as those in this BAA. The subprocessors that may receive PHI are identified on the Subprocessors page, which Business Associate keeps current.

5. Breach and Security Incident Notification

Business Associate will notify Covered Entity of a Breach of unsecured PHI without unreasonable delay and no later than 30 days after discovery. The notice will include, to the extent known, the nature of the event, the PHI involved, the individuals affected, and the steps taken to investigate, mitigate, and prevent recurrence. The parties acknowledge this Section as notice of the ongoing occurrence of unsuccessful Security Incidents, such as routine attempted access that results in no unauthorized access, use, disclosure, modification, or destruction of PHI, for which no further notice is required.

6. Individual Rights

To the extent Business Associate maintains PHI in a Designated Record Set, it will: make PHI available to enable Covered Entity to meet its access obligations; make PHI available for amendment and incorporate amendments as directed by Covered Entity; and maintain and make available the information required for Covered Entity to provide an accounting of disclosures. If an individual makes such a request directly to Business Associate, Business Associate will forward it to Covered Entity, which remains responsible for responding.

7. Availability of Records to HHS

Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining Covered Entity’s compliance with HIPAA, subject to applicable legal protections for confidential information.

8. Obligations of Covered Entity

Covered Entity will obtain any consents, authorizations, and notices required for Business Associate to use and disclose PHI as contemplated. Covered Entity will not request Business Associate to use or disclose PHI in a manner that would violate HIPAA if done by Covered Entity, except where expressly permitted for a business associate. Covered Entity will notify Business Associate of any limitation in its notice of privacy practices, any change in or revocation of an individual’s permission, and any restriction on use or disclosure of PHI that affects Business Associate’s obligations. Covered Entity is responsible for not placing PHI into fields not intended to receive it, consistent with the security rules in the Payment Services Policy.

9. Term and Termination

This BAA is effective on the effective date above and continues while Business Associate holds PHI of Covered Entity or until terminated. If either party materially breaches this BAA, the other may provide notice and an opportunity to cure, and may terminate if the breach is not cured within a reasonable period. On termination, Business Associate will return or destroy all PHI it maintains for Covered Entity where feasible, and will extend the protections of this BAA to any PHI that cannot feasibly be returned or destroyed and limit further use or disclosure of that PHI to the purposes that make return or destruction infeasible.

10. Miscellaneous

This BAA will be interpreted to permit compliance with HIPAA. The parties agree to amend this BAA as necessary to comply with changes in law. In the event of a conflict, the interpretation that allows compliance with HIPAA controls. There are no third-party beneficiaries. Except as provided here, the terms of the Agreement, including its limitation of liability, continue to apply.

11. Contact

Questions about this BAA or to report a concern involving PHI:

AiroDental LLC, Privacy Team
6516 Hackberry Trail, Edmond, OK 73034, United States
[email protected]