Business Associate Agreement (BAA)
Version 2026 (10.28.2026), Revision 2
1. Parties, services, and effective date
This BAA is between the customer identified below (“Customer”) and the CareServ contracting legal entity identified below (“CareServ”), in consideration of their services relationship and mutual promises. CareServ acts as Customer’s business associate, or as its business associate subcontractor when Customer is itself a business associate. Complete the exact legal entity names, not only facility or trade names. Additional customer legal entities must each sign or expressly join through an authorized written joinder.
This BAA takes effect on the date of the last signature below. It covers protected health information (“PHI”) CareServ creates, receives, maintains, or transmits on Customer’s behalf in performing the identified services, including PHI already held on that date. It does not backdate signatures or excuse earlier noncompliance. The services agreement defines purchased services; this BAA governs their handling of PHI.
2. Definitions and permitted activities
“HIPAA Rules” means the applicable Privacy, Security, Breach Notification, and Enforcement Rules in 45 CFR Parts 160 and 164, implementing HIPAA and HITECH, as amended. PHI includes electronic PHI. Terms including breach, unsecured PHI, designated record set, security incident, required by law, and Secretary have their meanings under those rules.
CareServ may use or disclose PHI only to perform the identified services, as this BAA expressly permits, or as required by law. CareServ will not use or disclose PHI in a way that would violate the Privacy Rule if done by Customer, except the limited management and administration permission below. Uses, disclosures, and requests must satisfy applicable minimum-necessary requirements. Customer will communicate applicable minimum-necessary policies and lawful restrictions to CareServ.
CareServ may use PHI for its proper management and administration or legal responsibilities. Disclosure for those purposes is permitted only when required by law or after obtaining reasonable assurances that the recipient will keep the information confidential, use or further disclose it only for the stated purpose or as required by law, and notify CareServ of any confidentiality breach of which it becomes aware. This permission does not dispense with a required subcontractor BAA.
This BAA grants no permission to sell PHI, use it for independent advertising, train general-purpose artificial-intelligence models on it, or use it for CareServ’s independent product development. Data aggregation or de-identification for another purpose requires a separate written authorization consistent with applicable law; the services agreement alone does not override these restrictions.
3. Safeguards and subcontractors
CareServ will use appropriate administrative, physical, and technical safeguards to prevent unauthorized use or disclosure and comply with the HIPAA Security Rule for electronic PHI. CareServ will limit workforce access to authorized functions, provide appropriate workforce training, and apply its security and incident-response procedures to the covered services.
Before allowing a subcontractor to create, receive, maintain, or transmit PHI on CareServ’s behalf, CareServ will obtain a written agreement imposing the same applicable restrictions, conditions, and requirements, including Security Rule safeguards. CareServ will take reasonable steps to cure a known material subcontractor violation or end it; if unsuccessful, CareServ will terminate the arrangement when feasible and take other steps required by law.
4. Incident and breach reporting
CareServ will report to Customer any use or disclosure not permitted by this BAA, any breach of unsecured PHI, and any security incident of which CareServ becomes aware. Except for the unsuccessful activity described below, CareServ will provide initial notice without unreasonable delay after discovery and provide material updates as information becomes available. For a breach of unsecured PHI, notice will comply with 45 CFR 164.410 and in no event exceed its 60-calendar-day outer limit, subject only to a legally permitted delay under 45 CFR 164.412. This outer limit is not a routine waiting period. Any shorter applicable legal deadline or expressly accepted customer-specific reporting deadline controls. CareServ will not wait for a completed investigation when doing so would unreasonably delay notice. Discovery includes when the event was known, or through reasonable diligence should have been known, to CareServ as specified in 45 CFR 164.410.
Notice will identify, to the extent known, affected individuals; the event and discovery dates; the nature of the event and information involved; containment and mitigation actions; and information Customer needs for required notifications. CareServ will supply the information required by 45 CFR 164.410, cooperate reasonably in investigation and risk assessment, preserve relevant evidence, and mitigate known harmful effects to the extent practicable. Customer controls notices to individuals, regulators, and media unless law requires CareServ to notify directly or the parties assign notification duties in writing. Neither party may delay a legally required notice.
The parties acknowledge that routine unsuccessful attempts, such as blocked scans or failed logins, may occur. This paragraph constitutes standing notice of those attempts only when they cause no unauthorized access, use, disclosure, modification, destruction, or interference with information-system operations. CareServ will provide available summaries on request. Suspected successful compromise or actual interference is not covered by this standing notice.
5. Records, individual rights, and oversight
To the extent CareServ holds PHI in a designated record set, CareServ will make it available to Customer as needed for access under 45 CFR 164.524, including electronic copies when required; implement amendments directed or agreed to by Customer under 45 CFR 164.526; and maintain and furnish disclosure-accounting information needed under 45 CFR 164.528. CareServ will act on Customer requests promptly and in sufficient time for Customer to meet applicable legal deadlines. Customer will promptly communicate the request, its receipt date, the applicable deadline, and information reasonably needed to fulfill it; CareServ will promptly identify missing information without using that process to delay a required response. Requests received directly from individuals will be forwarded to Customer without unreasonable delay and in time to preserve applicable individual rights. CareServ will not independently decide them unless authorized or required by law. These duties do not depend on negotiating a fee or resolving a payment dispute.
When performing a Customer obligation under the Privacy Rule, CareServ will comply with the requirements applicable to that obligation. CareServ will make its relevant internal practices, books, and records available to the Secretary for determining compliance with the HIPAA Rules. This BAA does not require waiver of a legally recognized privilege.
CareServ will not withhold Customer’s PHI or access needed for HIPAA obligations as leverage in a payment or contract dispute. Lawful billing remedies do not excuse these duties.
6. Customer responsibilities and additional protections
Customer will provide lawful instructions, identify the services and systems involving PHI, and promptly notify CareServ of relevant privacy-notice limitations, changes or revocations of individual permissions, and agreed or legally required restrictions. Customer will not request an impermissible use or disclosure. When Customer is a business associate, it will identify any additional upstream obligations requiring a written amendment before CareServ undertakes the affected activity.
Each party remains responsible for applicable federal and state privacy, security, and breach-notification law. This BAA does not supply a patient consent or authorization. Customer will identify specially protected information, including records subject to 42 CFR Part 2, before the relevant service begins so the parties can establish any additional required agreement, consent, or safeguards. Neither party may use this provision to avoid protections already required by law.
7. Term, termination, and PHI disposition
This BAA continues while CareServ performs covered services or retains covered PHI. If Customer determines CareServ has materially violated this BAA, Customer will give written notice describing the violation in reasonable detail. For a curable violation, CareServ will have up to thirty calendar days after receipt to cure it or end the violation, or a shorter reasonable period when necessary to comply with law or prevent material ongoing harm to PHI. CareServ must promptly begin corrective action; the cure period does not postpone reporting, mitigation, safeguards, or individual rights. Customer may terminate this BAA and the affected services if cure is not possible, CareServ does not cure or end the violation within the permitted period, or immediate termination is required by law or reasonably necessary to prevent material ongoing harm that cannot be addressed through a less disruptive lawful measure. The parties will coordinate a lawful transition to protect PHI and continuity of access. Termination alone does not establish either party’s entitlement to damages or an early-termination charge.
At termination, CareServ will return PHI to Customer or, with Customer’s written agreement, destroy it, including copies held by subcontractors, where feasible. The parties will promptly establish a secure transfer and disposition plan. CareServ will not retain copies except where return or destruction is infeasible, including an applicable legal retention obligation. CareServ will document and notify Customer of the reason, the information retained, and the expected disposition process. Retained PHI remains subject to this BAA; further uses and disclosures are limited to the purposes making return or destruction infeasible. CareServ will return or destroy it when that condition ends. Backup retention does not authorize active reuse. On request, CareServ will confirm completed disposition in writing.
8. Commercial protections and relationship to other agreements
Priority and required performance. This BAA controls conflicts concerning PHI privacy, security, reporting, access, and disposition. Monetary limitations allocate financial risk between the parties; they do not excuse required performance, authorize withholding PHI, or restrict governmental enforcement. This BAA creates no independent duty to defend or indemnify Customer and no guarantee that every security incident can be prevented.
Contractual damages and aggregate limit. Any lawful aggregate liability cap and damages exclusions in the services agreement identified in Section 1, including Master Service Terms actually accepted as part of that agreement, expressly apply to monetary claims arising from this BAA. A reference to a website alone does not establish acceptance of separate commercial terms. BAA claims and service-agreement claims share the applicable aggregate cap; signing this BAA does not create a separate or additional cap. An expressly negotiated, signed provision specifically addressing BAA liability takes priority.
If the identified services agreement contains no agreed aggregate cap, then, to the extent permitted by law, CareServ’s aggregate monetary liability to Customer arising from this BAA, in contract, tort (including ordinary negligence), or otherwise, will not exceed the total fees paid or payable to CareServ for the services covered by this BAA during the twelve months immediately before the first event giving rise to liability. Related events are treated as one event. If the services have been provided for less than twelve months, the calculation uses that actual period. This fallback creates no cap for unrelated service-agreement claims. It is an express term of this signed BAA and does not depend on acceptance of separate website terms.
Absent a different expressly negotiated, signed provision specifically addressing BAA damages, and to the extent permitted by law, CareServ is not liable to Customer under this BAA for indirect, special, consequential, exemplary, or punitive damages, or lost profits or revenue. Reasonable, documented, legally required incident investigation, notification, and mitigation costs attributable to CareServ’s breach are treated as direct damages, subject to the applicable lawful aggregate cap and the allocation below; they are not excluded merely because a third-party vendor performs the work.
Mandatory exceptions. Neither this BAA nor an incorporated limitation excludes or limits liability for fraud, willful misconduct, gross negligence, or any liability that applicable law prohibits excluding or limiting. These provisions do not limit government investigations, enforcement, penalties, or remedies, or waive mandatory privacy, security, reporting, access, return, or destruction duties. They do not restrict relief necessary to enforce those duties. No provision transfers a party’s statutory responsibility to the other party.
Incident-response costs. Each party will perform and initially bear the cost of its own required investigation, reporting, mitigation, and cooperation, without waiting for a determination of fault or insurance coverage. As between the parties, reasonable and documented necessary response costs may be recovered from the other party only to the extent caused by that party’s breach of this BAA, negligence, or willful misconduct, subject to applicable law and the applicable lawful liability limitations. Shared fault is allocated proportionately; there is no double recovery. Customer remains responsible for optional services it orders and for its own unrelated compliance improvements. CareServ will not charge Customer for CareServ’s own required compliance work or remediation of CareServ-caused noncompliance. No customer-directed vendor engagement, settlement, or discretionary expense automatically binds CareServ without its written agreement; this does not prevent reasonable emergency action or legally required action or reimbursement otherwise recoverable under this paragraph.
Ordinary assistance and offboarding costs. Routine assistance already included in the purchased services carries no additional charge. For extraordinary export, custom conversion, extended transition support, or other work outside that scope, Customer is responsible only for reasonable charges disclosed and agreed in writing before the additional work, where legally permissible. CareServ bears the cost of correcting its own noncompliance. Neither missing fee agreement nor unpaid charges permit withholding PHI, delaying legally required assistance, or failing to return or destroy PHI as required. Reasonable required work must proceed while commercial disputes are resolved separately.
An existing executed BAA between these same parties remains in force unless the parties expressly identify it for replacement in a signed amendment. This generic form is intended for relationships without an executed BAA or for an expressly agreed replacement. Website revisions do not amend an executed copy. Amendments require both parties’ written agreement; the parties will cooperate in changes needed to comply with law. Interpret this BAA to permit compliance with HIPAA. Unenforceability of one provision does not invalidate the remainder. The services agreement’s governing-law provisions apply subject to mandatory applicable law. No third-party beneficiary rights are created.
9. Notices and execution
Complete operational privacy/security contacts for both parties before signing. Notices may be delivered to these contacts by secure written means; urgent incidents should also be escalated by telephone. Each party must promptly update its contact details and monitor its designated channels. If a contact cannot be reached, use the services agreement’s notice and escalation contacts without delaying required reporting. Do not send PHI through unsecured email.
Each signer represents authority to bind the identified legal entity. The parties may sign counterparts and use legally valid electronic signatures. Retain the full executed version, including attachments and the signature audit record when applicable. Signing an ordinary quote that does not expressly execute this BAA does not execute it.