Business Associate Agreement

HIPAA requires a covered entity to obtain satisfactory assurances, in writing, that a business associate will appropriately safeguard protected health information. Without an executed BAA, disclosing PHI to a billing vendor is itself an impermissible disclosure — regardless of how carefully that vendor handles the data.

This is a common and serious gap. Practices routinely share patient data with vendors under nothing more than a services agreement, which does not satisfy the requirement.

Permitted uses and disclosures of PHI, and the prohibition on any use beyond those purposes. Required administrative, physical and technical safeguards. Breach notification obligations and timelines. Obligations flowed down to subcontractors. Individual rights support, including access and amendment requests. Return or destruction of PHI at termination. Audit and documentation rights.

During onboarding, before any protected health information is transmitted to us. We will not begin working claims until the BAA is signed by both parties.

Practices are welcome to have counsel review our standard agreement, and we can work from your form where you have one. We would rather spend time on the agreement up front than discover a gap during an audit.

To request our Business Associate Agreement, contact info@vizora.co or call (307) 370-3902. We can usually provide it the same business day.