Business Associate Agreement

Parties and effective date

This Business Associate Agreement ("BAA") is entered into between the healthcare practice identified in the associated Sunshyn Billing execution record ("Covered Entity") and Rebecca Strout, an individual doing business as Dynamic Services ("Business Associate"). It becomes effective when an authorized practice owner accepts and electronically signs it in Sunshyn Billing.

This BAA supplements the Sunshyn Billing Terms of Service. If this BAA conflicts with the Terms concerning protected health information, this BAA controls.

Definitions

Terms including Breach, Designated Record Set, Electronic Protected Health Information, Individual, Protected Health Information ("PHI"), Required by Law, Secretary, Security Incident, Subcontractor, and Unsecured PHI have the meanings assigned by HIPAA, HITECH, and their implementing regulations. "HIPAA Rules" means 45 C.F.R. Parts 160 and 164, as amended.

Purpose and permitted uses

Business Associate may create, receive, maintain, transmit, use, and disclose PHI only as necessary to provide and administer Sunshyn Billing services requested by Covered Entity, including practice management, patient intake, clinical documentation tools, claim creation and transmission, eligibility, payment and ERA processing, records handling, reporting, support, security, backup, and related operations.

Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities only as permitted by 45 C.F.R. § 164.504(e), Required by Law, or with reasonable assurances from the recipient where HIPAA requires them. Business Associate will not sell PHI, use PHI for advertising, or use or disclose PHI in a manner that would violate the HIPAA Rules if done by Covered Entity.

Safeguards and minimum necessary

• Use appropriate administrative, physical, and technical safeguards to protect PHI
• Comply with applicable requirements of the HIPAA Security Rule for electronic PHI
• Apply the minimum-necessary standard where applicable
• Limit access to authorized workforce members and service providers with a legitimate need
• Maintain policies, risk-management measures, and documentation required of business associates

Reporting breaches, incidents, and improper disclosures

Business Associate will report to Covered Entity any use or disclosure of PHI not permitted by this BAA, any Breach of Unsecured PHI, and any material Security Incident of which it becomes aware, without unreasonable delay and within the time required by applicable law. Reports will include the information reasonably available to support Covered Entity's investigation and notification duties.

Routine unsuccessful security events, such as blocked scans, pings, or unsuccessful login attempts, do not require individual notice unless they result in unauthorized access, use, disclosure, modification, destruction, or material interference.

Subcontractors

Business Associate will ensure that subcontractors that create, receive, maintain, or transmit PHI on its behalf agree in writing to restrictions, conditions, safeguards, and Security Rule obligations that are no less protective than those applicable to Business Associate.

Individual rights and regulatory cooperation

To the extent applicable to PHI maintained by Business Associate, Business Associate will:

• Make PHI in a Designated Record Set available to Covered Entity for access requests
• Make PHI available for amendment and incorporate amendments directed by Covered Entity
• Document disclosures and provide information needed for an accounting of disclosures
• Make relevant internal practices, books, and records available to the Secretary of HHS
• Comply with Privacy Rule obligations that Covered Entity delegates to Business Associate

Covered Entity responsibilities

Covered Entity will use the Service and disclose PHI to Business Associate only as permitted by law, maintain appropriate workforce access and policies, notify Business Associate of relevant privacy-practice limitations or authorization changes, and not request Business Associate to use or disclose PHI in a way that would violate the HIPAA Rules.

Term and termination

This BAA remains in effect while Business Associate creates, receives, maintains, or transmits PHI for Covered Entity. Either party may terminate as allowed by the Terms. A party that knows of a material breach will provide an opportunity to cure where appropriate and may terminate if cure is unsuccessful.

At termination, Business Associate will return or destroy PHI where feasible. If return or destruction is infeasible, Business Associate will continue to protect the retained PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible. Obligations concerning retained PHI survive termination.

Interpretation and changes in law

This BAA will be interpreted to permit compliance with the HIPAA Rules. References to regulations include later amendments. The parties will amend this BAA when reasonably necessary to comply with changes in law. No provision authorizes either party to violate HIPAA or other applicable law.

Electronic execution

The signer represents that they are an authorized owner with authority to bind Covered Entity. Electronic acceptance, together with the recorded agreement version, signer identity, title, timestamp, practice, and audit information, constitutes execution of this BAA. Each party may retain and reproduce the agreement electronically.

Business Associate contact

Rebecca Strout, an individual doing business as Dynamic Services
3413 Paramore Hill Rd, Millen, GA 30442
rebecca.strout@sunshyncredentialing.com