Business Associate Agreement — October 28, 2026 (Revision 1)
Version 2026 (10.28.2026)
1. Parties, services, and effective date
This BAA is between the customer identified below (“Customer”) and the CareServ contracting legal entity identified below (“CareServ”), in consideration of their services relationship and mutual promises. CareServ acts as Customer’s business associate, or as its business associate subcontractor when Customer is itself a business associate. Complete the exact legal entity names, not only facility or trade names. Additional customer legal entities must each sign or expressly join through an authorized written joinder.
This BAA takes effect on the date of the last signature below. It covers protected health information (“PHI”) CareServ creates, receives, maintains, or transmits on Customer’s behalf in performing the identified services, including PHI already held on that date. It does not backdate signatures or excuse earlier noncompliance. The services agreement defines purchased services; this BAA governs their handling of PHI.
2. Definitions and permitted activities
“HIPAA Rules” means the applicable Privacy, Security, Breach Notification, and Enforcement Rules in 45 CFR Parts 160 and 164, implementing HIPAA and HITECH, as amended. PHI includes electronic PHI. Terms including breach, unsecured PHI, designated record set, security incident, required by law, and Secretary have their meanings under those rules.
CareServ may use or disclose PHI only to perform the identified services, as this BAA expressly permits, or as required by law. CareServ will not use or disclose PHI in a way that would violate the Privacy Rule if done by Customer, except the limited management and administration permission below. Uses, disclosures, and requests must satisfy applicable minimum-necessary requirements. Customer will communicate applicable minimum-necessary policies and lawful restrictions to CareServ.
CareServ may use PHI for its proper management and administration or legal responsibilities. Disclosure for those purposes is permitted only when required by law or after obtaining reasonable assurances that the recipient will keep the information confidential, use or further disclose it only for the stated purpose or as required by law, and notify CareServ of any confidentiality breach of which it becomes aware. This permission does not dispense with a required subcontractor BAA.
This BAA grants no permission to sell PHI, use it for independent advertising, train general-purpose artificial-intelligence models on it, or use it for CareServ’s independent product development. Data aggregation or de-identification for another purpose requires a separate written authorization consistent with applicable law; the services agreement alone does not override these restrictions.
3. Safeguards and subcontractors
CareServ will use appropriate administrative, physical, and technical safeguards to prevent unauthorized use or disclosure and comply with the HIPAA Security Rule for electronic PHI. CareServ will limit workforce access to authorized functions, provide appropriate workforce training, and apply its security and incident-response procedures to the covered services.
Before allowing a subcontractor to create, receive, maintain, or transmit PHI on CareServ’s behalf, CareServ will obtain a written agreement imposing the same applicable restrictions, conditions, and requirements, including Security Rule safeguards. CareServ will take reasonable steps to cure a known material subcontractor violation or end it; if unsuccessful, CareServ will terminate the arrangement when feasible and take other steps required by law.
4. Incident and breach reporting
CareServ will report to Customer any use or disclosure not permitted by this BAA, any breach of unsecured PHI, and any security incident of which CareServ becomes aware. Except for the unsuccessful activity described below, initial notice will be without unreasonable delay and no later than five calendar days after discovery. CareServ will not wait for a completed investigation to provide initial notice and will provide material updates as information becomes available. Any shorter applicable legal deadline controls. Discovery includes when the event was known, or through reasonable diligence should have been known, to CareServ as specified in 45 CFR 164.410.
Notice will identify, to the extent known, affected individuals; the event and discovery dates; the nature of the event and information involved; containment and mitigation actions; and information Customer needs for required notifications. CareServ will supply the information required by 45 CFR 164.410, cooperate reasonably in investigation and risk assessment, preserve relevant evidence, and mitigate known harmful effects to the extent practicable. Customer controls notices to individuals, regulators, and media unless law requires CareServ to notify directly or the parties assign notification duties in writing. Neither party may delay a legally required notice.
The parties acknowledge that routine unsuccessful attempts, such as blocked scans or failed logins, may occur. This paragraph constitutes standing notice of those attempts only when they cause no unauthorized access, use, disclosure, modification, destruction, or interference with information-system operations. CareServ will provide available summaries on request. Suspected successful compromise or actual interference is not covered by this standing notice.
5. Records, individual rights, and oversight
To the extent CareServ holds PHI in a designated record set, CareServ will make it available to Customer as needed for access under 45 CFR 164.524, including electronic copies when required; implement amendments directed or agreed to by Customer under 45 CFR 164.526; and maintain and furnish disclosure-accounting information needed under 45 CFR 164.528. CareServ will respond to Customer requests within ten business days or sooner when reasonably necessary to meet an applicable legal deadline communicated by Customer. Direct individual requests will be forwarded to Customer within three business days; CareServ will not independently decide them unless authorized or required by law.
When performing a Customer obligation under the Privacy Rule, CareServ will comply with the requirements applicable to that obligation. CareServ will make its relevant internal practices, books, and records available to the Secretary for determining compliance with the HIPAA Rules. This BAA does not require waiver of a legally recognized privilege.
CareServ will not withhold Customer’s PHI or access needed for HIPAA obligations as leverage in a payment or contract dispute. Lawful billing remedies do not excuse these duties.
6. Customer responsibilities and additional protections
Customer will provide lawful instructions, identify the services and systems involving PHI, and promptly notify CareServ of relevant privacy-notice limitations, changes or revocations of individual permissions, and agreed or legally required restrictions. Customer will not request an impermissible use or disclosure. When Customer is a business associate, it will identify any additional upstream obligations requiring a written amendment before CareServ undertakes the affected activity.
Each party remains responsible for applicable federal and state privacy, security, and breach-notification law. This BAA does not supply a patient consent or authorization. Customer will identify specially protected information, including records subject to 42 CFR Part 2, before the relevant service begins so the parties can establish any additional required agreement, consent, or safeguards. Neither party may use this provision to avoid protections already required by law.
7. Term, termination, and PHI disposition
This BAA continues while CareServ performs covered services or retains covered PHI. Customer may terminate this BAA and the affected services if CareServ materially violates this BAA. Customer may allow a reasonable written cure period when cure is possible; no cure period is required when cure is impossible or delay would violate law. The parties will coordinate a lawful transition to protect PHI and continuity of access.
At termination, CareServ will return PHI to Customer or, with Customer’s written agreement, destroy it, including copies held by subcontractors, where feasible. The parties will promptly establish a secure transfer and disposition plan. CareServ will not retain copies except where return or destruction is infeasible, including an applicable legal retention obligation. CareServ will document and notify Customer of the reason, the information retained, and the expected disposition process. Retained PHI remains subject to this BAA; further uses and disclosures are limited to the purposes making return or destruction infeasible. CareServ will return or destroy it when that condition ends. Backup retention does not authorize active reuse. On request, CareServ will confirm completed disposition in writing.
8. Relationship to other agreements
This BAA controls conflicts concerning PHI privacy, security, reporting, access, and disposition. No service suspension, liability provision, or payment term excuses compliance with duties imposed by applicable law. Other mutually accepted commercial provisions remain effective to the extent consistent with this BAA and law. This BAA creates no independent indemnity or guarantee that every security incident can be prevented.
An existing executed BAA between these same parties remains in force unless the parties expressly identify it for replacement in a signed amendment. This generic form is intended for relationships without an executed BAA or for an expressly agreed replacement. Website revisions do not amend an executed copy. Amendments require both parties’ written agreement; the parties will cooperate in changes needed to comply with law. Interpret this BAA to permit compliance with HIPAA. Unenforceability of one provision does not invalidate the remainder. The services agreement’s governing-law provisions apply subject to mandatory applicable law. No third-party beneficiary rights are created.
9. Notices and execution
Complete operational privacy/security contacts for both parties before signing. Notices may be delivered to these contacts by secure written means; urgent incidents should also be escalated by telephone. Each party must promptly update its contact details and monitor its designated channels. If a contact cannot be reached, use the services agreement’s notice and escalation contacts without delaying required reporting. Do not send PHI through unsecured email.
Each signer represents authority to bind the identified legal entity. The parties may sign counterparts and use legally valid electronic signatures. Retain the full executed version, including attachments and the signature audit record when applicable. Signing an ordinary quote that does not expressly execute this BAA does not execute it.