Elera Health
Business Associate Agreement
This is Elera Health's standard HIPAA Business Associate Agreement. An executed agreement identifies the Covered Entity and records the applicable signature details.
Covered Entity: The health care provider or organization entering into the agreement
Business Associate: Elera Health, Inc., a Delaware corporation
1. Purpose
Covered Entity engages Business Associate to provide referral coordination, patient scheduling, insurance verification, and related administrative services. In performing these services, Business Associate may receive, create, maintain, or transmit Protected Health Information. This Agreement governs the use and disclosure of such information in accordance with HIPAA and applicable federal and state laws.
2. Definitions
Capitalized terms not otherwise defined herein shall have the meanings set forth in HIPAA, including Protected Health Information or PHI, Business Associate, Covered Entity, Breach, and Security Incident.
3. Permitted Uses and Disclosures
Business Associate may use and disclose PHI solely to perform referral coordination and related administrative services for Covered Entity; match patients to appropriate providers based on clinical criteria, insurance coverage, and availability; communicate with patients for scheduling and care coordination; disclose PHI to treating providers for treatment; and comply with applicable law. Business Associate shall not use or disclose PHI for any purpose not permitted under this Agreement or HIPAA.
4. Safeguards
Business Associate shall implement appropriate administrative, technical, and physical safeguards to protect PHI; comply with the HIPAA Security Rule; maintain encryption for data at rest and in transit where appropriate; limit access to authorized workforce members; and maintain written privacy and security policies.
5. Subcontractors
Business Associate shall ensure that any subcontractor that receives PHI agrees in writing to the same restrictions and safeguards that apply to Business Associate under this Agreement.
6. Reporting
Business Associate shall report any use or disclosure of PHI not permitted by this Agreement, any Breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery, and any Security Incident of which it becomes aware.
7. Access and Amendment
To the extent required by HIPAA, Business Associate shall provide access to PHI as necessary for Covered Entity to comply with access requests and incorporate amendments to PHI when directed by Covered Entity.
8. Accounting of Disclosures
Business Associate shall document disclosures of PHI as required to allow Covered Entity to fulfill its accounting obligations under HIPAA.
9. Term and Termination
This Agreement remains effective while Business Associate provides services involving PHI. Covered Entity may terminate if Business Associate materially breaches its obligations and fails to cure within 30 days of written notice. Upon termination, Business Associate shall return or securely destroy PHI, if feasible.
10. Regulatory References
HIPAA means the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, including the Privacy Rule and Security Rule, as amended. Any ambiguity shall be interpreted to permit compliance with HIPAA.
11. Miscellaneous
This Agreement constitutes the entire understanding between the parties regarding PHI and may be executed electronically and in counterparts.