Business Associate Agreement (Template)

Standard HIPAA BAA Mindbill executes with every Customer handling PHI. Customer-specific fields (entity name, effective date) are filled in during onboarding.

v3.0 · Effective Jan 1, 202645 CFR 164.504(e) compliant

Request an executable copy

We'll send a DocuSign-ready BAA for signature during onboarding.

Request via email

1. Definitions

Capitalized terms not defined here have the meanings set forth in HIPAA (45 CFR Parts 160 and 164). "PHI" means Protected Health Information. "Business Associate" or "BA" means Mindbill, Inc. "Covered Entity" or "CE" means the Customer.

2. Permitted Uses & Disclosures

BA may use and disclose PHI to perform Services on behalf of CE, including bill submission, EDI routing, response ingestion, second-review generation, audit-complaint preparation, and reporting. BA may also use PHI for BA's proper management, data aggregation services per 45 CFR 164.504(e)(2)(i)(B), and as required by law.

3. Safeguards

BA implements administrative, physical, and technical safeguards required by 45 CFR Part 164, Subparts C (Security) and E (Privacy), including: encryption at rest (AES-256) and in transit (TLS 1.3), role-based access control, audit logging with 7-year retention, annual SOC 2 Type II audit, JIT production access with MFA, and incident-response procedures.

4. Subcontractors

BA enters BAAs with all subcontractors who access PHI (AWS, Carisk Intelligent Clearinghouse, Jopari Solutions, Data Dimensions). Current list at /security. BA notifies CE of new subcontractors ≥30 days before access is granted.

5. Breach Notification

BA notifies CE without unreasonable delay and no later than 60 days after discovery of any Breach of Unsecured PHI, per 45 CFR 164.410. Notification includes: identification of each affected individual, description of PHI involved, mitigation steps taken, and a recommended next-step plan for CE.

6. Individual Rights

BA supports CE's compliance with HIPAA individual rights: access (164.524), amendment (164.526), accounting of disclosures (164.528), and restriction (164.522). BA's Customer-facing audit log + export API satisfies these.

7. Termination

On termination, BA returns or destroys all PHI received from CE within 60 days. If destruction is infeasible (e.g., audit-log immutability), BA extends Subpart E protections indefinitely and limits further use to those purposes.

8. Regulatory References

This BAA satisfies the requirements of 45 CFR 164.504(e). Both parties acknowledge HIPAA, HITECH Act of 2009, and California Confidentiality of Medical Information Act (CMIA) apply. Conflict resolution favors the most-restrictive standard.

Custom BAA modifications (e.g., enterprise-specific indemnity, custom breach-notification windows) negotiated separately. Email legal@mindbill.org with redlines.