eTrepid HIPAA Business Associate Agreement (BAA) Standard Template

Governing Standard: 45 CFR Parts 160 & 164 (HIPAA / HITECH Omnibus Rule)

1. Recitals and Purpose

This Business Associate Agreement ("BAA") supplements the commercial service agreement between eTrepid Inc. ("Business Associate") and the contracting healthcare organization or covered entity ("Covered Entity").

Business Associate provides managed IT infrastructure, cybersecurity defense, backup operations, and cloud migration services. In performing these services, Business Associate may create, receive, maintain, or transmit Electronic Protected Health Information (ePHI). This BAA ensures compliance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the HITECH Act.

2. Obligations of Business Associate

2.1 Permitted Uses and Disclosures

Business Associate agrees to not use or disclose ePHI other than as permitted or required by the underlying service agreement or as required by law.

2.2 Appropriate Safeguards

Business Associate agrees to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI, in compliance with the HIPAA Security Rule (45 CFR §§ 164.308, 164.310, 164.312).

2.3 Reporting of Unauthorized Use or Breach

2.4 Subcontractor Compliance

Business Associate ensures that any subcontractors that create, receive, maintain, or transmit ePHI on its behalf agree in writing to the same restrictions and conditions that apply to Business Associate.

3. Term and Termination

Upon termination of the service agreement, Business Associate will, if feasible, return or destroy all ePHI received from Covered Entity. If return or destruction is infeasible, Business Associate extends the protections of this BAA to such ePHI and limits further uses and disclosures to those purposes that make return or destruction infeasible.