HIPAA Business Associate Agreement (BAA)

Recitals

1. Covered Entity is a healthcare provider subject to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), and their implementing regulations (45 CFR Parts 160 and 164).

2. Business Associate provides specialized back-office practice care, patient lifecycle management, and revenue cycle support services to Covered Entity.

3. In performing these services, Business Associate may create, receive, maintain, or transmit Protected Health Information ("PHI") on behalf of Covered Entity.

Section 1. Permitted Uses and Disclosures

1.1 Scope of Work & Service Tiers: Business Associate shall perform services solely as defined in the master service agreement and proforma. Services encompass Tier 1 Clinical Practice Care (inbox triage, 2-hour SLA inquiry response, 5-minute logistical screening calls, two-touch session confirmations, pre-session intake paperwork loops, cancellation recovery, and dormant patient re-engagement) and Tier 2 Revenue Cycle Management (manual benefits eligibility verification, clearinghouse claim monitoring via Availity, CPT modifier error rebuilding, prior authorization oversight, and aged A/R collection).

1.3 Role-Based Access Control (RBAC): Business Associate shall access Covered Entity’s EHR strictly via assigned "Practice Manager - Billing", "Practice Administrator", or "Scheduler / Front Desk" credentials. Business Associate is programmatically barred from opening, viewing, or accessing private psychotherapy progress notes or clinical case notes, with the Clinician role toggled OFF per Zero-Export RBAC parameters pursuant to 45 CFR § 164.502 Minimum Necessary Standard.

Section 2. Obligations and Assurances of Business Associate

• 2.1 Safeguards: Business Associate shall implement administrative, physical, and technical safeguards complying with the HIPAA Security Rule (45 CFR §§ 164.308, 164.310, and 164.312) to protect the confidentiality, integrity, and availability of electronic PHI (ePHI).
• 2.2 Sovereign Routing & Encrypted Channels: Business Associate shall execute all EHR portal sessions via a dedicated US-based static VPN matching Covered Entity’s state jurisdiction to prevent security geoblocks or unauthorized network inspection. All patient telephonic and SMS touches shall run through encrypted, HIPAA-compliant VoIP channels (OpenPhone).
• 2.3 Reporting Security Incidents & Breaches: Business Associate shall report to Covered Entity any suspected security incident, unauthorized use or disclosure of PHI, or data breach within twenty-four (24) hours of becoming aware of such incident.
• 2.4 Subcontractors & Workforce: Business Associate shall ensure that any downstream workforce members or subcontractors who access PHI agree in writing to the same restrictions and conditions that apply to Business Associate under this Agreement.
• 2.5 No Clinical Intervention & Emergency Escalation Protocol: Business Associate shall never conduct clinical assessments, offer treatment advice, or alter clinical treatment plans. Any patient message or inquiry expressing acute distress, self-harm, or safety "red-flag" sentinel keywords (e.g., hopeless, hurt myself, end it, suicide, pills, crisis) shall immediately bypass standard queues. Business Associate shall execute the Emergency Escalation Protocol: operator flags the message within 5 minutes, sends an urgent SMS alert directly to Covered Entity’s emergency cell line with patient details, and triggers an automated trauma-informed client safety response containing 988 Lifeline details.

Section 3. Term and Termination

3.1 Term: This Agreement shall take effect on the date of execution and shall remain in effect until terminated or until all services provided by Business Associate cease.

3.2 Termination for Cause: Covered Entity may immediately terminate this Agreement and any underlying service agreement if Covered Entity determines that Business Associate has violated a material term of this Agreement.

Section 4. Execution & Bilateral Signatures

The parties hereto have executed this Business Associate Agreement as of the date specified below: