Business Associate Agreement

1Parties and scope

This Business Associate Agreement (“BAA” or “Agreement”) is entered into by the parties below and implements the elements required by 45 CFR § 164.504(e), following the sample provisions published by HHS.

Where the customer is itself a business associate of a covered entity (for example, a laboratory working for clinics), this BAA operates as a subcontractor agreement under 45 CFR § 164.502(e)(1)(ii), and references to “Covered Entity” mean the customer.

This BAA supplements TrazaLab’s Terms of Service and Data Processing Agreement (DPA).

2Definitions

Catch-all definitions

The following terms used in this Agreement have the same meaning as in the HIPAA Rules:

Specific definitions

Business Associate

TrazaLab, with the meaning of “business associate” at 45 CFR § 160.103.

Covered Entity

The customer identified in Section 1, with the meaning of “covered entity” at 45 CFR § 160.103 or, where applicable, a business associate engaging TrazaLab as its subcontractor.

HIPAA Rules

The Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.

ePHI

PHI transmitted by or maintained in electronic media.

Service

The clinic–laboratory case-coordination platform described in the Terms of Service.

3Obligations of Business Associate

Business Associate agrees to:

1. Limit use and disclosure. Not use or disclose PHI other than as permitted or required by this Agreement or as required by law.
2. Apply safeguards. Use appropriate safeguards and, with respect to ePHI, comply with Subpart C of 45 CFR Part 164 (Security Rule) to prevent use or disclosure other than as provided for by this Agreement. 45 CFR §§ 164.308–164.316
3. Report impermissible uses or disclosures. Report to Covered Entity any use or disclosure of PHI not provided for by this Agreement of which it becomes aware.
4. Notify of breaches of unsecured PHI. Notify Covered Entity without unreasonable delay and in no case later than 60 calendar days after discovery, including, to the extent available, the identification of affected individuals and any other information Covered Entity needs for its own notifications. 45 CFR §§ 164.410, 164.404(c)
5. Report security incidents. Report any security incident of which it becomes aware. The parties acknowledge that unsuccessful, routine attempts (such as pings, port scans, or failed log-in attempts) that do not result in unauthorized access, use, or disclosure occur on an ongoing basis; this paragraph serves as notice of their existence, and no further report is required.
6. Mitigate. Mitigate, to the extent practicable, any harmful effect known to Business Associate of a use or disclosure of PHI in violation of this Agreement.
7. Bind subcontractors. Ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree in writing to the same restrictions, conditions, and requirements. Subprocessors are listed in Annex A of the DPA. 45 CFR §§ 164.502(e)(1)(ii), 164.308(b)(2)
8. Access. Make available PHI in a designated record set as necessary to satisfy Covered Entity’s access obligations. 45 CFR § 164.524
9. Amendment. Make any amendments to PHI in a designated record set as directed by Covered Entity. 45 CFR § 164.526
10. Accounting of disclosures. Maintain and make available the information required to provide an accounting of disclosures. 45 CFR § 164.528
11. Subpart E obligations. To the extent Business Associate carries out an obligation of Covered Entity under Subpart E of 45 CFR Part 164, comply with the requirements that apply to Covered Entity in performing that obligation.
12. Books and records. Make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining compliance with the HIPAA Rules.

4Permitted uses and disclosures

1. Providing the Service. Business Associate may use or disclose PHI as necessary to perform the Service set forth in the Terms of Service or underlying services agreement.
2. Required by law. Business Associate may use or disclose PHI as required by law.
3. Minimum necessary. Business Associate will request, use, and disclose only the minimum necessary, consistent with Covered Entity’s minimum-necessary policies and procedures. 45 CFR §§ 164.502(b), 164.514(d)
4. Subpart E limit. Business Associate may not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, except for the uses in paragraphs (e) and (f).
5. Own administration. Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities.
6. Disclosure for own administration. Business Associate may disclose PHI for the purposes in paragraph (e) only if the disclosure is required by law, or Business Associate obtains reasonable assurances from the recipient that the information will remain confidential, will be used or further disclosed only as required by law or for the purpose for which it was disclosed, and that the recipient will notify Business Associate of any instances of which it is aware in which confidentiality has been breached. 45 CFR § 164.504(e)(4)

5Obligations of Covered Entity

1. Notice of privacy practices. Notify Business Associate of any limitation in its notice of privacy practices to the extent it may affect Business Associate’s use or disclosure of PHI. 45 CFR § 164.520
2. Changes in permission. Notify Business Associate of any changes in, or revocation of, an individual’s permission to use or disclose their PHI, to the extent it may affect Business Associate.
3. Agreed restrictions. Notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or must comply with, to the extent it may affect Business Associate. 45 CFR § 164.522
4. Permissible requests. Not request Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E if done by Covered Entity, except for the administration uses in Section 4.
5. Account management. Manage its team’s access to the platform, revoke it when necessary, and upload only the PHI needed for the clinical purpose of the case.

6Term and termination

1. Term. This BAA is effective upon electronic acceptance at registration (or later signature) and remains in effect until the services agreement ends, unless terminated earlier under paragraph (b).
2. Termination for cause. If Covered Entity determines that Business Associate has violated a material term of this Agreement and Business Associate has not cured the violation within the reasonable time specified by Covered Entity, Covered Entity may terminate this BAA and the services agreement.
3. Obligations upon termination. Upon termination, Business Associate shall return to Covered Entity or destroy, if feasible, all PHI it still maintains and retain no copies. If return or destruction is infeasible, Business Associate shall extend the protections of this Agreement to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for so long as it maintains the PHI.
4. Survival. Business Associate’s obligations under paragraph (c) survive termination of this BAA.

7General provisions

1. Regulatory references. A reference in this Agreement to a section of the HIPAA Rules means the section as in effect or as amended.
2. Amendment. The parties agree to amend this Agreement as necessary to comply with the requirements of the HIPAA Rules and any other applicable law. TrazaLab will publish new versions on this page and give notice as provided in the Terms of Service.
3. Interpretation. Any ambiguity in this Agreement shall be resolved to permit compliance with the HIPAA Rules.
4. Order of precedence. If this BAA conflicts with the Terms of Service or the DPA with respect to PHI, this BAA controls.
5. Scope. This BAA does not constitute a third-party HIPAA certification and does not replace clinical judgment. Security practices align with the technical measures described in TrazaLab’s public documentation; Covered Entity remains responsible for its own compliance program.

8Acceptance and contact

Covered Entity accepts this BAA electronically when it creates its TrazaLab account, in the version published at that time. Notices under this Agreement and requests relating to PHI should be sent to [email protected].

Related documents

Version 2026-10-28 · supersedes version 2026-09-09.