Business Associate Agreement - Responsibilities for Protected Health Information (HIPAA/HITECH)

Sep 16, 2026

Upload by Skyler

Business Associate Agreement defines how a business associate must use, disclose, and safeguard Protected Health Information (PHI) received or created for Northern Arizona University on behalf of a covered entity. The agreement sets responsibilities under HIPAA Privacy, Security, and Breach Notification rules, including permitted purposes for services, restrictions on further use or disclosure, and requirements for subcontractors. It also requires appropriate administrative, physical, and technical safeguards for ePHI and timely written reporting of improper uses or disclosures, security incidents, and breaches to the covered entity.

LanguageEnglish

CategoryLetters

FormatPDF

Pages6

Reading Time2 min

AccessFree to download

Recitals

Agreement

Definitions

Uses and Disclosures of Protected Health Information

Safeguards for Protected Health Information

Reports of Improper Use or Disclosure of Protected Health Information, Security Incidents and Breaches

# BUSINESS ASSOCIATEAGREEMENT This Business Associate Agreement("Agreement")is entered into between the Arizona Board of Regentsfor and on behalf of Northern Arizona University("NAU”)("Covered Entity")and (“Business Associate”),with an effective dateof_ (“Effective Date”).This Agreement sets out the responsibilities and obligationsof Business Associate as a business associate of Covered Entity under the Health Insurance Portabilityand Accountability Act(“HIPAA”)and the Health Information Technology for Economic and Clinical HealthAct("HITECH Act"). # RECITALS: A.Business Associate and Covered Entity have entered into a written agreement titled (the "Written Agreement"),with an effective date of .Business Associate performs the services describedin Written Agreement("Services"). B.Covered Entity may make available to Business Associate Protected Health Information ofIndividuals in conjunction with Services.Business Associate will Use or Disclose such ProtectedHealth Information only in accordance with this Agreement. # AGREEMENT: Business Associate and Covered Entity agree to the terms and conditions of this Agreement in order tocomply with the rules on handling of Protected Health Information under the HIPAA Standards for Privacyof Individually Identifiable Health Information,45 C.F.R.Part 160 and Part 164,Subpart E(“PrivacyRule"),the HIPAA Security Standards,45 C.F.R.Part 160 and Part 164,Subpart C("Security Rule"),andthe HIPAA Breach Notification Regulations,45 C.F.R.Part 164,Subpart D("Breach Notification Rule"),allas amended from time to time. # 1. DEFINITIONS a.Terms Defined in Regulation:Unless otherwise provided in this Agreement,all capitalizedterms in this Agreement willhave the same meaning as provided under the Privacy Rule,theSecurity Rule and the Breach Notification Rule. b.Protected Health Information or PHI:Protected Health Information("PHI")means PHI thatis received or created on behalf of Covered Entity by Business Associate. # 2. USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION a.Performance of Services:Business Associate will Use or Disclose PHI only for thosepurposes necessary to perform Services,or as otherwise expressly permitted in thisAgreement or required by law,and will not further Use or Disclose such PHI. b.Subcontractors:Business Associate agrees that,when one of its subcontractors creates orreceives PHl on behalf of Business Associate,Business Associate first willenter into an agreement with such subcontractor that contains the same restrictions and conditions on theUse and Disclosure of PHl as contained in this Agreement. c.Business Associate Management,Administration and Legal Responsibilities:Business Associate may Use PHI for Business Associate's management and administration,or to carryout Business Associate's legal responsibilities.Business Associate may Disclose PHI to athird party for such purposes only if:(1)the Disclosure is required by law;or (2)BusinessAssociate secures written assurance from the receiving party that the receiving party will:(i)hold the PHI confidentially;(ii)Use or Disclose the PHl only as required by law or for thepurposes for which it was Disclosed to the recipient;and(ii)notify the Business Associate ofany other Use or Disclosure of PHI. d.Data Aggregation and De-ldentification:Business Associate may Use PHI to perform dataaggregation services as permitted by 45 C.F.R.§164.504(e)(2)(i)(B).Business Associatealso may de-identify PHl in accordance with 45 C.F.R.§164.514. e.Covered Entity Responsibilities:To the extent Business Associate is to carry out CoveredEntity's obligations under the Privacy Rule,Business Associate will comply with therequirements of the Privacy Rule that apply to Covered Entity's compliance with suchobligations. # 3. SAFEGUARDS FOR PROTECTED HEALTH INFORMATION a.Adequate Safeguards:Busin

FAQs

What responsibilities does the Business Associate have for PHI under the agreement?

The Business Associate may use or disclose PHI only for purposes necessary to perform the Services, as expressly permitted by the Agreement, or as required by law. Further use or disclosure beyond those limits is not allowed.

How must subcontractors be handled when they create or receive PHI?

The Business Associate must first enter into an agreement with the subcontractor that includes the same restrictions and conditions on use and disclosure of PHI as in this Agreement.

What safeguards and reporting are required for security incidents and breaches?

The Business Associate must implement appropriate safeguards to protect the confidentiality, integrity, and availability of ePHI and provide evidence upon request. It must report improper uses/disclosures and security incidents in writing within specified timelines, including successful unauthorized access or interference, and also provide aggregate information for unsuccessful attempts.

Sep 16, 2026

Upload by Skyler