PXCMail Sign in Start free trial
Policies

Business Associate Agreement

Signed electronically during signup by customers that are covered entities or business associates under HIPAA. Published so your compliance officer or counsel can review it first. Draft for attorney review

This Business Associate Agreement (“BAA”) is entered into between the customer identified in the signup record (“Covered Entity”, which includes a business associate that uses the Service on behalf of a covered entity) and PacinfraX Corporation, 19900 MacArthur Boulevard, Suite 915, Irvine, California 92612 (“Business Associate”), and is effective on the date Covered Entity accepts it (“Effective Date”). It supplements the Terms of Service (“Agreement”) and governs Protected Health Information processed by the PXCMail service.

1. Definitions

Capitalized terms not defined here have the meanings in the HIPAA Rules (45 CFR Parts 160 and 164). “PHI” means protected health information received from or on behalf of Covered Entity. “Services” means the services described in the Agreement.

2. Permitted uses and disclosures

2.1 Business Associate may use and disclose PHI only as necessary to perform the Services, as permitted by this BAA, or as Required by Law. The Services include receiving, transmitting, scanning for sensitive content, encrypting, storing, archiving, indexing, backing up and producing audit records of email and related data.

2.2 Business Associate may use PHI for its proper management and administration and to carry out its legal responsibilities, and may disclose PHI for those purposes if the disclosure is Required by Law or Business Associate obtains reasonable assurances from the recipient that the PHI will be held confidentially, used or further disclosed only as Required by Law or for the purpose of the disclosure, and that the recipient will notify Business Associate of any breach of confidentiality.

2.3 Business Associate may de-identify PHI in accordance with 45 CFR 164.514(b) and use de-identified data for operating and improving the Services. Business Associate will not use PHI to train artificial-intelligence or machine-learning models, for marketing, or for sale.

2.4 Business Associate will not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, except as permitted in 2.2 and 2.3.

3. Obligations of Business Associate

  • Safeguards. Implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of electronic PHI as required by Subpart C of 45 CFR Part 164, including those described in the Trust Center at pxcmail.com/trust: encryption in transit and at rest, multi-factor authentication, access logging, workforce training, risk analysis, contingency planning and incident response.
  • Reporting. Report to Covered Entity any use or disclosure of PHI not permitted by this BAA, any Security Incident, and any Breach of Unsecured PHI, without unreasonable delay and in no case later than 72 hours after discovery, including to the extent known the identification of individuals affected, a description of what happened, the PHI involved, steps individuals should take, what Business Associate is doing, and contact information. Unsuccessful Security Incidents (pings, port scans, denied login attempts, blocked malware) that do not result in unauthorized access are reported in aggregate on request. For Breaches, Business Associate will cooperate in Covered Entity’s notifications to individuals, HHS and the media, and will bear the reasonable costs of notification where the Breach was caused by Business Associate’s breach of this BAA.
  • Subcontractors. Ensure, in accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), that any subcontractor that creates, receives, maintains or transmits PHI on behalf of Business Associate agrees in writing to the same restrictions, conditions and requirements. Current subcontractors are listed at pxcmail.com/trust/subprocessors; Business Associate gives 30 days’ notice before adding one that handles PHI.
  • Access. Within 10 business days of request, make PHI in a Designated Record Set available to Covered Entity so that Covered Entity can meet its obligations under 45 CFR 164.524.
  • Amendment. Within 10 business days of request, make PHI in a Designated Record Set available for amendment and incorporate amendments as directed under 45 CFR 164.526.
  • Accounting. Maintain and, within 10 business days of request, provide the information required for Covered Entity to respond to a request for an accounting of disclosures under 45 CFR 164.528.
  • Covered Entity obligations. To the extent Business Associate carries out any obligation of Covered Entity under Subpart E, comply with the requirements that apply to Covered Entity in performing that obligation.
  • Books and records. Make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary of HHS for determining Covered Entity’s compliance with the HIPAA Rules.
  • Minimum necessary. Request, use and disclose only the minimum PHI necessary to accomplish the intended purpose.
  • Personnel and location. Store and process PHI only in the United States; permit access to PHI content only by workforce members located in the United States who have completed HIPAA training and background checks; log every such access.
  • Annual verification. Provide Covered Entity, at least annually, written verification that Business Associate has deployed the technical safeguards required by the Security Rule.
  • Individual requests. Forward to Covered Entity within 5 business days any request from an individual regarding PHI received directly by Business Associate.

4. Obligations of Covered Entity

Covered Entity will: notify Business Associate of any limitation in its notice of privacy practices, any changes in or revocation of an individual’s permission, and any restriction on use or disclosure agreed to under 45 CFR 164.522, to the extent they affect Business Associate’s use or disclosure; not request Business Associate to use or disclose PHI in a manner not permissible under the HIPAA Rules if done by Covered Entity; configure the Services (policies, retention, user access) appropriately for its obligations; maintain multi-factor authentication and device policies made available by the Services; and be responsible for obtaining any required authorizations and for its own workforce’s handling of PHI.

5. 42 CFR Part 2

Where Covered Entity is a Part 2 program and enables the Part 2 profile, Business Associate acknowledges that it receives records subject to 42 CFR Part 2, will not redisclose them except as permitted by Part 2 and this BAA, and will apply the redisclosure notice to outbound messages as configured by Covered Entity. This BAA serves as the qualified service organization agreement for purposes of 42 CFR 2.11 and 2.12(c)(4).

6. Term and termination

6.1 This BAA is effective on the Effective Date and continues until all PHI is returned or destroyed under Section 6.3, or, if return or destruction is infeasible, until the Agreement ends and protections are extended under 6.3.

6.2 Either party may terminate this BAA and the Agreement if the other party has materially breached this BAA and failed to cure within 30 days of written notice, or immediately if cure is not possible. If Covered Entity terminates under this Section, prepaid fees for the remaining term are refunded.

6.3 On termination, Business Associate will return to Covered Entity, or at Covered Entity’s instruction destroy, all PHI that it maintains in any form, and retain no copies, within 30 days, and provide a certificate of destruction. PHI under a legal hold placed by Covered Entity is retained until Covered Entity releases it. If return or destruction is infeasible, Business Associate will extend the protections of this BAA to that PHI, limit further uses and disclosures to the purposes that make return or destruction infeasible, and notify Covered Entity of the conditions.

7. Miscellaneous

7.1 Regulatory references. A reference to a section of the HIPAA Rules means the section as in effect or as amended.

7.2 Amendment. The parties will amend this BAA as necessary to comply with changes in the HIPAA Rules; Business Associate may publish an updated BAA with 30 days’ notice, and Covered Entity’s continued use of the Services after the effective date is acceptance, except that Covered Entity may terminate under 6.2 if it reasonably objects.

7.3 Interpretation. Any ambiguity is resolved to permit compliance with the HIPAA Rules. In case of conflict with the Agreement, this BAA controls for PHI.

7.4 No third-party beneficiaries. Nothing in this BAA confers rights on any person other than the parties, except individuals’ rights under the HIPAA Rules.

7.5 Survival. Sections 3 (as to PHI retained), 6.3 and 7 survive termination.

7.6 Notices. To Business Associate: PacinfraX Corporation, Attn: Privacy Officer, 19900 MacArthur Boulevard, Suite 915, Irvine, CA 92612; [email protected]. To Covered Entity: the account owner and the Security Officer named in the signup record.

Accepted electronically by the authorized representative of Covered Entity named in the signup record, and countersigned by PacinfraX Corporation. A countersigned PDF is available in the console.