Version 1.0-draft · Updated 2026-07-23 · Draft based on the HHS model — pending final legal review.
This Business Associate Agreement ("Agreement") is entered into between the customer organization that accepts it ("Covered Entity") and Ejoshi LLC, operator of Med Billing Pro ("Business Associate"), and governs Business Associate's creation, receipt, maintenance, or transmission of Protected Health Information on Covered Entity's behalf. It is required by, and will be interpreted consistently with, the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules (45 C.F.R. Parts 160 and 164) (the "HIPAA Rules").
Capitalized terms used but not defined here have the meanings given in the HIPAA Rules. "Protected Health Information" or "PHI" means individually identifiable health information that Business Associate creates, receives, maintains, or transmits for or on behalf of Covered Entity. "Electronic PHI" or "ePHI" has the meaning in 45 C.F.R. § 160.103.
Business Associate may use or disclose PHI only (a) to perform the services described in the Terms of Service and provide, support, and improve the Service for Covered Entity; (b) for the proper management and administration of Business Associate or to carry out its legal responsibilities; and (c) as Required by Law. Business Associate will not use or disclose PHI in any manner that would violate the HIPAA Rules if done by Covered Entity, except as permitted in (b) above. Business Associate may de-identify PHI in accordance with 45 C.F.R. § 164.514(a)–(c).
Business Associate will use appropriate administrative, physical, and technical safeguards, and comply with the Security Rule with respect to ePHI, to prevent use or disclosure of PHI other than as provided by this Agreement. These safeguards include encryption of PHI in transit and at rest, access controls limiting PHI to authorized personnel, and audit logging of access to PHI.
Business Associate will report to Covered Entity any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, any Security Incident, and any Breach of Unsecured PHI, without unreasonable delay and no later than the timeframe required to allow Covered Entity to meet its own notification obligations. For a Breach, the report will include, to the extent known, the individuals affected and the information required by 45 C.F.R. § 164.410.
Business Associate will ensure that any subcontractor that creates, receives, maintains, or transmits PHI on its behalf agrees in writing to restrictions and conditions at least as protective as those that apply to Business Associate under this Agreement, consistent with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2).
Business Associate will, to the extent it maintains PHI in a Designated Record Set: make PHI available to enable Covered Entity to meet access requests (§ 164.524); make PHI available for amendment and incorporate amendments (§ 164.526); and maintain and make available information needed for an accounting of disclosures (§ 164.528). Business Associate will forward to Covered Entity any request it receives directly from an individual.
Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of Health and Human Services for purposes of determining Covered Entity's compliance with the HIPAA Rules.
Covered Entity will notify Business Associate of any limitation in its Notice of Privacy Practices, any changes in or revocation of an individual's permission to use or disclose PHI, and any restriction on use or disclosure to which Covered Entity has agreed, to the extent any of these affect Business Associate's use or disclosure of PHI. Covered Entity will not request that Business Associate use or disclose PHI in any manner not permitted by the HIPAA Rules.
This Agreement is effective on acceptance and continues while Business Associate maintains PHI for Covered Entity. If either party knows of a material breach by the other, it will provide an opportunity to cure and, if the breach is not cured, may terminate. On termination, Business Associate will return or, if agreed and feasible, destroy all PHI it maintains and retain no copies; where return or destruction is not feasible, Business Associate will extend the protections of this Agreement to that PHI and limit further use or disclosure to the purposes that make return or destruction infeasible. This section survives termination.
The parties will take such action as is necessary to amend this Agreement from time to time to comply with the HIPAA Rules and other applicable law. Any ambiguity is resolved to permit compliance with the HIPAA Rules. In the event of a conflict between this Agreement and the Terms of Service regarding PHI, this Agreement controls. Terms not defined here have the meaning in the HIPAA Rules.