Business Associate Agreement
Version 2026-10-11
Review with your counsel before signing.
This Business Associate Agreement ("Agreement") is entered into between Megvite ("Business Associate") and the practice named in the acceptance record ("Covered Entity"), each a "Party." It takes effect on the date the Covered Entity accepts it ("Effective Date"). Business Associate provides a telehealth platform to Covered Entity under the Megvite terms of service (the "Services Agreement"), and in doing so may create, receive, maintain or transmit Protected Health Information on Covered Entity's behalf. The Parties enter into this Agreement to meet the requirements of the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act, and their implementing regulations at 45 C.F.R. Parts 160 and 164 (together, "HIPAA").
1. Definitions
Capitalized terms used but not defined in this Agreement have the meanings given in HIPAA, including Breach, Data Aggregation, Designated Record Set, Disclosure, Electronic Protected Health Information, Health Care Operations, Individual, Minimum Necessary, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information and Use.
"Protected Health Information" or "PHI" has the meaning given in 45 C.F.R. 160.103, limited to information Business Associate creates, receives, maintains or transmits on behalf of Covered Entity.
2. Obligations of Business Associate
2.1 Business Associate will not Use or Disclose PHI other than as permitted or required by this Agreement or as Required by Law.
2.2 Business Associate will use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 C.F.R. Part 164 with respect to Electronic PHI, to prevent Use or Disclosure of PHI other than as provided by this Agreement.
2.3 Business Associate will report to Covered Entity any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, including Breaches of Unsecured PHI as required by 45 C.F.R. 164.410, and any Security Incident of which it becomes aware. Business Associate will report a Breach without unreasonable delay and in no case later than 30 calendar days after discovery, with the information Covered Entity needs to meet its notification obligations. The Parties agree that this paragraph is notice of the ongoing existence of unsuccessful Security Incidents, such as pings, port scans and blocked log-in attempts, for which no further report is required.
2.4 In accordance with 45 C.F.R. 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate will ensure that any Subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions, conditions and requirements that apply to Business Associate under this Agreement.
2.5 Within 15 business days of a request by Covered Entity, Business Associate will make PHI in a Designated Record Set available to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 C.F.R. 164.524, including in electronic form where the PHI is maintained electronically.
2.6 Within 15 business days of a request by Covered Entity, Business Associate will make any amendment to PHI in a Designated Record Set that Covered Entity directs or agrees to under 45 C.F.R. 164.526.
2.7 Business Associate will maintain and make available to Covered Entity the information required to provide an accounting of Disclosures under 45 C.F.R. 164.528.
2.8 To the extent Business Associate carries out an obligation of Covered Entity under Subpart E of 45 C.F.R. Part 164, Business Associate will comply with the requirements of Subpart E that apply to Covered Entity in the performance of that obligation.
2.9 Business Associate will make its internal practices, books and records relating to PHI available to the Secretary for purposes of determining compliance with HIPAA.
2.10 Business Associate will request, Use and Disclose only the Minimum Necessary PHI to accomplish the intended purpose.
3. Permitted Uses and Disclosures
3.1 Business Associate may Use and Disclose PHI as necessary to perform the Services described in the Services Agreement, provided that the Use or Disclosure would not violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity.
3.2 Business Associate may Use PHI for its proper management and administration or to carry out its legal responsibilities, and may Disclose PHI for those purposes if the Disclosure is Required by Law, or if Business Associate obtains reasonable assurances from the recipient that the PHI will remain confidential, will be Used or further Disclosed only as Required by Law or for the purpose for which it was Disclosed, and that the recipient will notify Business Associate of any instance in which the confidentiality of the PHI has been breached.
3.3 Business Associate may provide Data Aggregation services relating to the Health Care Operations of Covered Entity as permitted by 45 C.F.R. 164.504(e)(2)(i)(B).
3.4 Business Associate may de-identify PHI in accordance with 45 C.F.R. 164.514(a) through (c). De-identified information is not PHI.
3.5 Business Associate will not sell PHI and will not Use or Disclose PHI for marketing, except as permitted by HIPAA with Covered Entity's written authorization.
4. Obligations of Covered Entity
4.1 Covered Entity will notify Business Associate of any limitation in its notice of privacy practices, any change in or revocation of an Individual's permission, and any restriction on the Use or Disclosure of PHI it has agreed to under 45 C.F.R. 164.522, to the extent the limitation, change or restriction may affect Business Associate's Use or Disclosure of PHI.
4.2 Covered Entity will not ask Business Associate to Use or Disclose PHI in any manner that would not be permissible under Subpart E of 45 C.F.R. Part 164 if done by Covered Entity.
4.3 Covered Entity is responsible for obtaining any consents and authorizations it needs from Individuals, for the accuracy of the PHI it provides, and for the configuration of the Services by its own users, including user access, roles and sharing settings.
5. Term and Termination
5.1 This Agreement begins on the Effective Date and continues until the Services Agreement ends, unless terminated earlier under this section.
5.2 If either Party determines that the other has materially breached this Agreement, it will give written notice and an opportunity to cure the breach within 30 days. If the breach is not cured, the non-breaching Party may terminate this Agreement and the Services Agreement.
5.3 On termination, Business Associate will return to Covered Entity, or destroy, all PHI it maintains in any form, and will retain no copies. Covered Entity may export its records through the Services before termination. If return or destruction is infeasible, Business Associate will extend the protections of this Agreement to that PHI and limit further Uses and Disclosures to the purposes that make return or destruction infeasible, for as long as it maintains the PHI.
6. General Terms
6.1 A reference in this Agreement to a section of HIPAA means the section as in effect or as amended. The Parties will amend this Agreement as necessary for Covered Entity and Business Associate to comply with changes in HIPAA.
6.2 Any ambiguity in this Agreement will be resolved to permit compliance with HIPAA. If this Agreement conflicts with the Services Agreement on the protection of PHI, this Agreement controls.
6.3 The obligations of Business Associate under section 5.3 survive termination of this Agreement.
6.4 Nothing in this Agreement confers any rights, remedies or obligations on any person other than the Parties and their respective successors and permitted assigns.
6.5 This Agreement may be accepted electronically. An electronic acceptance by an authorized representative of Covered Entity, recorded with the representative's name, title, the date and time, and this Agreement's version, has the same effect as a handwritten signature.