HIPAA
Business Associate Agreement
You are the covered entity. ROI Venture Capital, doing business as Watchline, is the business associate. This is signed before Avery sits on overflow — before patient calls, names, or insurance details hit the line. Based on the HHS sample BAA provisions.
01
Definitions
Breach, Disclosure, Protected Health Information (PHI), Security Incident, and Use have the meanings in 45 CFR Parts 160 and 164. “ROI Venture Capital” includes its workforce and subcontractors under the same rules. Watchline is the service name.
02
Permitted uses
ROI Venture Capital may use and disclose PHI only to answer the practice phone, book visits, verify insurance at a high level, send reminders the practice authorizes, and as required by law. Minimum necessary. No marketing. No sale of PHI. No diagnosis. No invented benefits.
03
Safeguards
ROI Venture Capital will apply administrative, physical, and technical safeguards appropriate to a voice front desk, and will comply with the Security Rule (45 CFR Part 164 Subpart C) for electronic PHI.
04
Breach
Unauthorized use or disclosure, including a breach of unsecured PHI, is reported to the practice without unreasonable delay and no later than 60 days, with the facts needed for the practice to meet 45 CFR 164.410.
05
Subcontractors
Cloud hosting, telephony, and speech/model providers who create, receive, maintain, or transmit PHI for ROI Venture Capital will be under BAAs with the same restrictions. The chain exists before overflow goes live.
06
Access, amendment, accounting
ROI Venture Capital will make available PHI in a designated record set, apply amendments the practice directs, and provide disclosure information so the practice can meet 45 CFR 164.524, 164.526, and 164.528.
07
HHS
Internal practices, books, and records relating to PHI will be made available to the Secretary of HHS to determine HIPAA compliance.
08
Term
Effective when the practice accepts. Either party may terminate for a material breach if it is not cured. On termination ROI Venture Capital will return or destroy PHI, or if return is not feasible will keep Security Rule safeguards until it can. These duties survive.
Sample language adapted from HHS. Not legal advice. Have counsel read it. Downstream BAAs (host, telephony, model) are executed in those vendors’ dashboards before a live patient line.