AristologBack to App

Business Associate Agreement

Version 1.0 — Last updated: February 20, 2026

This Business Associate Agreement ("BAA") is entered into between the healthcare organization ("Covered Entity") and Aristolog ("Business Associate") and supplements the Terms of Service.

1. Definitions

Terms used but not defined in this BAA shall have the same meaning as those terms in the HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E), the HIPAA Security Rule (45 CFR Part 160 and Part 164, Subparts A and C), and the HITECH Act (42 U.S.C. §17921 et seq.).

  • "Protected Health Information" (PHI) means individually identifiable health information transmitted or maintained in any form or medium, as defined in 45 CFR §160.103.
  • "Electronic Protected Health Information" (ePHI) means PHI that is transmitted or maintained in electronic media.

2. Obligations of Business Associate

Business Associate agrees to:

  • Not use or disclose PHI other than as permitted or required by this BAA or as required by law.
  • Use appropriate administrative, physical, and technical safeguards to prevent unauthorized use or disclosure of PHI, including implementing requirements of the HIPAA Security Rule with respect to ePHI.
  • Report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which it becomes aware, including any Security Incident or Breach of Unsecured PHI.
  • In accordance with 45 CFR §164.502(e)(1)(ii) and §164.308(b)(2), ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions and conditions.
  • Make available PHI in a Designated Record Set to Covered Entity or the individual as required under 45 CFR §164.524.
  • Make PHI available for amendment and incorporate any amendments to PHI as required under 45 CFR §164.526.
  • Maintain and make available the information required to provide an accounting of disclosures as required under 45 CFR §164.528.
  • Make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance with HIPAA.

3. Permitted Uses and Disclosures

Business Associate may use or disclose PHI only to:

  • Perform functions, activities, or services for or on behalf of Covered Entity as specified in the Terms of Service, provided that such use or disclosure would not violate HIPAA if done by Covered Entity.
  • Carry out the legal responsibilities of the Business Associate under this BAA.

Business Associate may de-identify PHI in accordance with 45 CFR §164.514(a)-(c). Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities, and may disclose PHI for such purposes if the disclosure is required by law or the Business Associate obtains reasonable assurances that the information will be held confidentially.

4. Breach Notification

Business Associate shall report to Covered Entity any Breach of Unsecured PHI without unreasonable delay and in no case later than thirty (30) calendar days after discovery of such Breach. The notification shall include, to the extent possible: the nature and extent of the PHI involved, the identification of each individual whose information was or is reasonably believed to have been accessed, and any steps the Business Associate recommends to mitigate harm.

5. Security Measures

Business Associate implements the following safeguards to protect ePHI:

  • Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
  • Role-based access controls and authentication
  • Comprehensive audit logging of all PHI access
  • Regular security assessments and vulnerability testing
  • Employee training on HIPAA compliance and data security
  • Incident response procedures

6. Term and Termination

This BAA shall be effective upon execution and shall terminate when all PHI provided by Covered Entity to Business Associate is destroyed or returned, or if not feasible, protections are extended to such information.

Upon termination, Business Associate shall return or destroy all PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity. If return or destruction is not feasible, Business Associate shall extend the protections of this BAA to such PHI and limit further uses and disclosures to those purposes that make the return or destruction infeasible.

7. Miscellaneous

  • Amendment. This BAA may not be modified except by written agreement signed by both parties. The parties agree to negotiate in good faith any amendments necessary to comply with changes in HIPAA regulations.
  • Survival. The obligations of the Business Associate under Sections 2 and 6 shall survive termination of this BAA.
  • Interpretation. Any ambiguity in this BAA shall be interpreted to permit compliance with HIPAA.

8. Contact

For questions about this Business Associate Agreement, contact us at [email protected].