Data agreements
Health data agreement
In the libraryThe door has this paper. Type its name at the composer. It offers to start from it.
The paper a company asks for when the work touches health information belonging to somebody else's patients. It sets out what you may do with that data, how you look after it, and what happens when the work ends. It is a United States framework document, required in defined circumstances, and it usually sits alongside a services agreement rather than replacing one.
- Printed on the page as
- Business Associate Agreement
- Where it can live
- Any of the 184 governing laws
Who uses one
- Vendors serving clinics, hospitals, insurers and health technology companies.
- Software and services businesses whose systems touch patient information.
- Subcontractors of a company that already signed one upstream.
What you are deciding
- What health information is involved, and why
- What you may do with it, and what you may not
- What safeguards are in place
- Which subcontractors may see it, and on what terms
- What happens when there is an incident, and how quickly
- How individuals get access to their own records
- What happens to the data when the work ends
Blanks you leave stay blank and wait in the room. Nothing is filled in from a guess.
The sections a draft usually has
- 1The agreement it attaches to
- 2Definitions
- 3Permitted uses and disclosures
- 4Safeguards
- 5Subcontractors
- 6Reporting of incidents
- 7Individual access and amendment
- 8Return or destruction at the end
- 9Term and termination
A general outline, not a required one. What turns up in a draft follows what you described. A contract is written in the order a contract is read.
What people call it
Type any of these at the door. It offers this paper. The matching happens in your own browser, on a wordlist you could read. No model runs before you sign in.
- baa
- business associate agreement
- health data agreement
- hipaa agreement
- hipaa addendum
Questions people ask
- When is a business associate agreement needed?
- It arises under United States health privacy rules where a service provider handles protected health information for a covered organisation. Whether a particular arrangement is caught is a question for a lawyer who knows the framework.
- Does it replace a data processing addendum?
- Not usually. It covers a specific category of information under a specific framework, and companies operating internationally often carry both papers.
- Do subcontractors need one too?
- Commonly the obligations flow down, so a subcontractor handling the same information signs an equivalent paper with the party that engaged it.
General answers about the document. Not advice about your situation. Not written about any one country.
Where it lives
A contract names the legal system it is governed by. That is a separate decision from which paper it is. You pick it at the door, from any of the 184 units in Governing law, including England and Wales, Delaware, California and New York.
Say what you agreed in one sentence. When what you describe is health data agreement, the door offers this paper. One press takes it. One press refuses it.
Start it at the door →Related kinds