Business Associate Agreement
Version 2026-10b ยท Preview copy for review
Parties
This Business Associate Agreement ("Agreement") is between [Your agency] ("Covered Entity") and PriorAuth Pilot ("Business Associate"). It applies to Business Associate's services that help Covered Entity prepare, submit and track prior authorization requests (the "Services").
1. Definitions
Terms used but not defined in this Agreement have the meanings given in the HIPAA Rules (45 C.F.R. Parts 160 and 164), including Breach, Protected Health Information ("PHI"), Security Incident, Subcontractor and Unsecured PHI.
2. Permitted uses and disclosures
Business Associate may use and disclose PHI only to provide the Services, as required by law, or for its proper management and administration as allowed by 45 C.F.R. 164.504(e)(4). Business Associate will not use or disclose PHI in a way that would violate the HIPAA Rules if done by Covered Entity, and will limit PHI to the minimum necessary.
Business Associate will not sell PHI, use PHI for marketing, or use PHI to train artificial intelligence models. PHI is processed by AI services only to produce drafts for Covered Entity's staff to review.
3. Safeguards
Business Associate will use administrative, physical and technical safeguards that comply with Subpart C of 45 C.F.R. Part 164 to protect electronic PHI, including encryption in transit and at rest, role-based access, two-step sign-in, and activity logs.
4. Reporting
Business Associate will report to Covered Entity any use or disclosure of PHI not provided for by this Agreement, any Security Incident of which it becomes aware, and any Breach of Unsecured PHI without unreasonable delay and no later than 30 calendar days after discovery, with the information required by 45 C.F.R. 164.410. Unsuccessful attempts such as pings, port scans and blocked sign-in attempts are reported by this notice and need no further report.
5. Subcontractors
Business Associate will ensure that any Subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions and conditions that apply to Business Associate under this Agreement.
Business Associate's Subcontractors include Amazon Web Services, for hosting, the database, document storage and AI processing through Amazon Bedrock, under its Business Associate Addendum; Stedi, for Medicaid eligibility checks; and Notifyre and Sinch, for fax delivery, only if Covered Entity uses a fax add-on. The current list of Subcontractors is kept at priorauthpilot.com/security.html.
6. Individual rights
Within 15 business days of a request, Business Associate will make PHI available to Covered Entity so Covered Entity can meet its obligations for access (164.524), amendment (164.526) and an accounting of disclosures (164.528). Business Associate will refer any request it receives directly from an individual to Covered Entity.
7. Compliance and records
To the extent Business Associate carries out an obligation of Covered Entity under Subpart E, it will comply with the requirements that apply to Covered Entity. Business Associate will make its internal practices, books and records relating to PHI available to the Secretary of Health and Human Services to determine compliance.
8. Term and termination
This Agreement starts when signed and continues while Business Associate holds PHI for Covered Entity. If either party materially breaches this Agreement and does not cure the breach within 30 days of written notice, the other party may terminate the Agreement and the Services.
When the Services end, Business Associate will, at Covered Entity's choice, return or destroy all PHI within 60 days, after Covered Entity has had the chance to export its records. If return or destruction is not feasible (for example, encrypted backups that expire on a schedule), the protections of this Agreement continue for as long as the PHI is kept.
9. General
This Agreement is governed by the laws of the Commonwealth of Kentucky, except where federal law controls. Any ambiguity is resolved to permit compliance with the HIPAA Rules. If the HIPAA Rules change, the parties will amend this Agreement as needed. This Agreement may be signed electronically, and an electronic signature has the same effect as a handwritten one.