This Business Associate Agreement (“BAA”) is between Telemedcore (“Business Associate”), 2108 N ST STE N, Sacramento, CA 95816, and the subscribing practice (“Covered Entity”). It applies on every production plan.
Telemedcore may create, receive, maintain, transmit, use, and disclose Protected Health Information ("PHI") only to provide the Telemedcore services for Covered Entity. This BAA is intended to satisfy 45 CFR §164.502(e) and the required business-associate contract terms in 45 CFR §164.504(e)(2).
Telemedcore may use or disclose PHI only as necessary to perform the services, as required by law, or as otherwise permitted by this BAA. Telemedcore may use PHI for proper management and administration and to carry out legal responsibilities only when the disclosure is required by law or the recipient gives written assurances that the PHI will remain confidential, be used only for the stated purpose, and be reported if improperly used or disclosed. Telemedcore will not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, except as expressly permitted for proper management, administration, data aggregation, or legal responsibilities.
Telemedcore will not use or further disclose PHI other than as permitted or required by this BAA or as required by law. Telemedcore will notify Covered Entity if Telemedcore becomes aware of a use or disclosure not provided for by this BAA.
Telemedcore will use appropriate administrative, physical, and technical safeguards to prevent use or disclosure of PHI other than as provided by this BAA. For electronic PHI, Telemedcore will comply with applicable HIPAA Security Rule requirements, including the technical safeguards in 45 CFR §164.312 for access control, audit control, integrity, authentication, and transmission security.
Telemedcore will report to Covered Entity any breach of unsecured PHI as defined by 45 CFR §164.402 without unreasonable delay and in no case later than sixty (60) calendar days after discovery, consistent with 45 CFR §164.410. Reports will include, to the extent known, affected individuals, the nature of PHI involved, mitigation steps, and information reasonably needed for Covered Entity's notification obligations. Telemedcore will report successful security incidents involving PHI. Routine unsuccessful attempts that do not compromise PHI may be reported in aggregate or periodic summary unless they materially increase risk.
Telemedcore will ensure any subcontractor that creates, receives, maintains, or transmits PHI on behalf of Telemedcore agrees in writing to the same restrictions, conditions, and safeguards that apply to Telemedcore. Subcontractor agreements will comply with 45 CFR §164.314 for electronic PHI and will require support for accounting-of-disclosures obligations under 45 CFR §164.528.
Telemedcore will make PHI in a designated record set available to Covered Entity as necessary for Covered Entity to meet its obligations under 45 CFR §164.524. Telemedcore will make PHI available for amendment and incorporate approved amendments as necessary for Covered Entity to meet its obligations under 45 CFR §164.526. Telemedcore will document PHI disclosures and related information as necessary for Covered Entity to respond to requests for an accounting of disclosures under 45 CFR §164.528.
Telemedcore will make its internal practices, books, and records relating to PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining HIPAA compliance.
Upon termination, Telemedcore will return or destroy PHI received from, created by, or received on behalf of Covered Entity if feasible. If return or destruction is not feasible, Telemedcore will extend this BAA's protections to retained PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible.
Covered Entity may require Telemedcore to cure a material breach of this BAA. If cure is not possible or is not completed within a reasonable time, Covered Entity may terminate the applicable services or this BAA as HIPAA permits. If termination is not feasible, the non-breaching party may report the problem to the Secretary of the U.S. Department of Health and Human Services.
Telemedcore will apply minimum-necessary principles under 45 CFR §164.502(b) and 45 CFR §164.514(d), except where HIPAA does not require minimum necessary. Telemedcore may de-identify PHI only in accordance with 45 CFR §164.514 and will not represent that de-identified data can be re-identified through deterministic keys.
For PHI, privacy, security, and breach matters, this BAA controls over the Order Form, Master Services Agreement, statements of work, and policies. The Security and Data Protection Exhibit, Service Level Exhibit, and Acceptable Use Policy are incorporated by reference to the extent applicable and must not narrow this BAA.
This BAA does not cover simulation practices used by education programs. Simulation practices hold synthetic patients only, and the simulation terms prohibit entering real patient information.
For the distinction between production and simulation practices, see Section 6 of our Terms of Use.
Every production practice accepts this BAA in the product before it stores patient information. Institutions and practices that need a countersigned copy, or want to negotiate terms on an Enterprise plan, can ask for one:
Telemedcore
Email: contact@telemedcore.com
Subject Line: “BAA Request”
Please include your practice name, NPI number, and the email address of the authorized signatory.