Business Associate Agreement
Signed at onboarding for any plan that handles PHI. We update it when HIPAA changes — you don't have to chase us.
Plain-language summary
Under HIPAA, a "Business Associate" is anyone who handles Protected Health Information (PHI) for a covered entity (you). The BAA is the contract that says: we'll only use PHI to provide the Service, we'll secure it, we'll tell you fast if anything goes wrong, and we'll return or destroy it when our relationship ends. We sign one with every customer that handles PHI. There's no extra fee.
1. Definitions
Capitalized terms have the meanings given in 45 C.F.R. §§ 160.103 and 164.501. "PHI" means Protected Health Information. "Service" means the Oncominder platform.
2. Permitted uses and disclosures
We will use and disclose PHI only:
- To provide the Service to Customer.
- For our proper management and administration.
- To carry out our legal responsibilities.
- As permitted or required by HIPAA and applicable law.
3. Safeguards
We implement administrative, physical, and technical safeguards that meet or exceed the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C). Specifics — encryption, access controls, audit logs, anomaly detection — are described on the security page.
4. Subcontractors
Any subcontractor that creates, receives, maintains, or transmits PHI on our behalf is bound by terms at least as restrictive as this BAA. Our current subprocessor list is available in the trust center, with 30 days' notice for changes.
5. Reporting
We will report any Use or Disclosure of PHI not permitted by this BAA, including any Breach of Unsecured PHI, to Customer within 24 hours of discovery, with regular updates as the investigation progresses.
6. Access, amendment, and accounting
We will provide PHI in a designated record set within five business days of Customer's written request, and we will support amendments and accountings of disclosures as required by 45 C.F.R. §§ 164.524, 164.526, and 164.528.
7. Term and termination
This BAA is effective for as long as Oncominder maintains PHI on behalf of Customer. On termination, we will return or destroy all PHI within 60 days. If return or destruction is infeasible, we will extend the protections of this BAA to the PHI for as long as we retain it.
8. Counterparts and signature
This BAA may be signed electronically and in counterparts. The signed version is delivered as part of onboarding for any plan that handles PHI.