Business Associate Agreement

1. Purpose and Background

The Covered Entity engages the Business Associate to transport sealed dental materials — including lab cases, impressions, appliances, and sealed records — between the Covered Entity, dental laboratories, and other authorized destinations.

In performing these services the Business Associate may encounter Protected Health Information (“PHI”), including on exterior container labels and accompanying paperwork. Because that access is integrated into the ordinary course of the courier’s work rather than incidental, the Business Associate acknowledges that it acts as a business associate under HIPAA and not as a mere conduit.

2. Definitions

Terms used but not otherwise defined in this Agreement have the meanings given to them in the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Parts 160 and 164.

• “PHI” means Protected Health Information as defined at 45 C.F.R. § 160.103, limited to information the Business Associate creates, receives, maintains, or transmits on behalf of the Covered Entity.
• “ePHI” means PHI transmitted or maintained in electronic form.
• “Breach” and “Unsecured PHI” have the meanings given at 45 C.F.R. § 164.402.

3. Permitted Uses and Disclosures

The Business Associate may use and disclose PHI only as necessary to perform the courier services described in the Service Agreement, or as Required by Law. The Business Associate will not use or disclose PHI for any other purpose, and specifically will not:

• sell PHI, or use or disclose it for marketing, advertising, or fundraising;
• open, inspect, copy, photograph, or read the contents of any sealed container or record in transit;
• use or disclose PHI in a manner that would violate HIPAA if done by the Covered Entity.

The Business Associate will limit its uses, disclosures, and requests to the minimum necessary to accomplish the intended purpose, consistent with 45 C.F.R. § 164.502(b).

4. Obligations of the Business Associate

The Business Associate agrees to:

• implement and maintain administrative, physical, and technical safeguards, including written policies, that reasonably and appropriately protect the confidentiality, integrity, and availability of PHI and comply with the HIPAA Security Rule with respect to ePHI;
• transport all materials in sealed, labeled containers and keep them sealed and secured in the vehicle at all times, never left unattended in an unsecured vehicle;
• maintain a written chain-of-custody record for every pickup and delivery, capturing the date, times, courier identity, releasing and receiving individuals, container count, and seal condition;
• provide HIPAA privacy and security training to every driver and employee before that person handles any materials, refresh that training annually, and retain written records of all training;
• restrict access to PHI and to chain-of-custody records to workforce members who require it to perform the services, and bind each such person to these same restrictions;
• require any subcontractor that creates, receives, maintains, or transmits PHI on behalf of the Business Associate to agree in writing to restrictions and conditions at least as protective as those in this Agreement;
• report to the Covered Entity any use or disclosure of PHI not permitted by this Agreement, and any Security Incident involving ePHI, promptly upon becoming aware of it;
• report any Breach of Unsecured PHI to the Covered Entity without unreasonable delay and in no case later than five (5) business days after discovery, providing the identity of each individual whose PHI was involved and all other information reasonably required for the Covered Entity to meet its notification obligations under 45 C.F.R. § 164.404;
• mitigate, to the extent practicable, any harmful effect of a use or disclosure of PHI in violation of this Agreement;
• make PHI in its possession available to the Covered Entity as necessary to satisfy the Covered Entity’s obligations regarding individual access, amendment, and accounting of disclosures under 45 C.F.R. §§ 164.524, 164.526, and 164.528, within fifteen (15) business days of a written request;
• make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance;
• retain chain-of-custody and compliance documentation for six (6) years from the date of creation or the date last in effect, whichever is later, as required by 45 C.F.R. § 164.316(b)(2).

5. Obligations of the Covered Entity

The Covered Entity agrees to:

• seal and clearly label all materials before they are released to the courier, so that no PHI is visible from the exterior beyond what is necessary for routing;
• release materials only to an identified representative of the Business Associate;
• refrain from entering patient names, dates of birth, chart numbers, or other patient health information into any request form, notes field, or software provided by the Business Associate;
• notify the Business Associate of any limitation in its notice of privacy practices, any change in or revocation of an individual’s authorization, or any restriction on the use or disclosure of PHI, to the extent it affects the Business Associate’s performance.

6. No Access to Contents

The parties acknowledge that the Business Associate does not require access to the contents of any sealed container in order to perform the services. The Business Associate will not open sealed containers except where necessary to respond to a spill, damage, or public-health hazard, or where Required by Law. Any such opening will be documented in the exception section of the chain-of-custody record and reported to the Covered Entity within twenty-four (24) hours.

7. Term and Termination

Term. This Agreement takes effect on the Effective Date and continues until the Service Agreement terminates or until terminated under this Section.

Termination for cause. The Covered Entity may terminate this Agreement and the Service Agreement immediately if it determines that the Business Associate has materially breached this Agreement and the breach is not cured within thirty (30) days of written notice.

Effect of termination. Upon termination, the Business Associate will return or destroy all PHI it maintains on behalf of the Covered Entity and retain no copies, except where return or destruction is infeasible. Where infeasible, the Business Associate will extend the protections of this Agreement to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as it retains the PHI.

Survival. The obligations of the Business Associate under this Section survive termination of this Agreement.

8. General Provisions

Regulatory references. A reference in this Agreement to a section of the HIPAA Rules means that section as in effect or as amended.

Amendment. The parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with the HIPAA Rules. Amendments must be in writing and signed by both parties.

Interpretation. Any ambiguity in this Agreement will be resolved in favor of a meaning that permits compliance with the HIPAA Rules.

No third-party beneficiaries. Nothing in this Agreement confers any rights on any person other than the parties and their respective successors and assigns.

Governing law. This Agreement is governed by the laws of the State of Ohio, except to the extent preempted by federal law.

Independent contractor. Nothing in this Agreement creates an employment, partnership, or joint venture relationship between the parties.