Business Associate Agreement (BAA - HIPAA)

Notice

This is a template applicable to U.S. clients subject to HIPAA. The signed version constitutes the legally binding document. This page is published for transparency and reference. The operative copy is maintained internally in docs/legal/es/BAA_HIPAA_PLANTILLA.md.

1. Definitions

Capitalized terms have the meanings ascribed in HIPAA (45 CFR Parts 160, 162, 164), HITECH and their implementing rules: PHI, ePHI, Breach, Unsecured PHI, Required by Law, Security Incident.

2. Permitted uses and disclosures

Business Associate (REMUV) may use and disclose PHI only to perform the services described in the underlying agreement; for its proper management and administration; to provide data aggregation services when authorized; or as Required by Law.

3. Safeguards

• Encryption at rest: SQLCipher AES-256-CBC.
• Encryption in transit: TLS 1.2+.
• Role-based access control + mandatory 2FA (Email-OTP) for administrative roles.
• Comprehensive audit logs.
• ECDSA P-256 + SHA-256 digital signatures on clinical notes.
• Encrypted nightly backups (3-2-1).
• Workstation security policy for BA personnel.

4. Subcontractors

BA ensures any subcontractor handling PHI signs an equivalent BAA. Current critical subcontractors are documented in the signed BAA exhibit (hosting, transactional email, CDN, error tracking).

5. Reporting

• Security Incident: report to Covered Entity within 72 hours.
• Breach of Unsecured PHI: report within 48 hours.
• Unsuccessful security events: aggregated quarterly report.

6. Individual rights

BA supports CE in fulfilling individual rights of Access (45 CFR 164.524), Amendment (164.526), and Accounting of Disclosures (164.528) via export endpoints and the audit log.

7. Minimum necessary

BA requests, uses and discloses only the minimum amount of PHI necessary.

8. Term and termination

This BAA remains in effect for the duration of the underlying services agreement. Upon termination, PHI is returned or destroyed, except where retention is required by law (e.g. clinical records retention periods).

9. Miscellaneous

• Amendments as necessary to comply with HIPAA Rules.
• Ambiguities resolved in favor of HIPAA compliance.
• Governing law: state specified in the underlying agreement.

Full text and exhibits: see docs/legal/es/BAA_HIPAA_PLANTILLA.md for negotiation and execution.