Draft — not yet reviewed by counsel
Business Associate Agreement
Last updated: September 2026
1. Purpose
This Business Associate Agreement (“BAA”) governs the handling of Protected Health Information (“PHI”, 45 CFR §160.103) between your clinic (the “Covered Entity”) and TheraThere (the “Business Associate”) when you use the TheraThere scheduling service. It forms part of, and is incorporated into, the Terms of Service.
2. Permitted uses and disclosures
The Business Associate may use and disclose PHI only as necessary to provide the Service (scheduling, notifications, exports you request), as required by law, or as otherwise permitted by 45 CFR §§164.502(e), 164.504(e) and 164.308. The Business Associate will not use or disclose PHI for any other purpose, will not sell PHI, and will use appropriate safeguards — including encryption in transit and at rest, tenant isolation, audit logging and access controls — to prevent unauthorised use or disclosure.
3. Subcontractors
The Business Associate will ensure that any subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees to the same restrictions and conditions that apply to the Business Associate under this BAA (45 CFR §164.502(e)(1)(ii)).
4. Breach notification
The Business Associate will report to the Covered Entity any use or disclosure of PHI not permitted by this BAA, any security incident of which it becomes aware, and any Breach of Unsecured PHI, without unreasonable delay and in no case later than thirty (30) days after discovery, including the information required by 45 CFR §164.410.
5. Individual rights
The Business Associate will make PHI available as needed for the Covered Entity to meet its obligations under 45 CFR §164.524 (access), §164.526 (amendment) and §164.528 (accounting of disclosures), to the extent the Business Associate holds such PHI in a designated record set.
6. Termination
On termination of the Service, the Business Associate will, at the Covered Entity's direction, return the clinic's data (in a machine-readable export) and then destroy all PHI it still holds within thirty (30) days. Where return or destruction is infeasible, the protections of this BAA continue to apply to the retained PHI for as long as it is retained (45 CFR §164.504(e)(2)(ii)(J)).
7. Placeholder notice
This document is a working draft intended to reflect the parties' intended HIPAA business-associate relationship. It will be replaced by a counsel-reviewed version before general availability; material changes will be announced in advance.