HIPAA BAA Builder

Live Preview

HIPAA Business Associate Agreement (BAA)

Effective Date: 2025-09-11

Covered Entity: [Covered Entity Name] ([Covered Entity Address]) — Contact: [Covered Entity Contact], [Covered Entity Email]
Business Associate: OuterWave Logistics, LLC (Pittsboro, North Carolina) — Contact: Brian [Update], outerwavelogistics@gmail.com

1. Purpose
This Agreement is entered into pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations to ensure appropriate safeguards for Protected Health Information (PHI).

2. Definitions
PHI has the meaning given in 45 C.F.R. §160.103. Electronic PHI (ePHI) means PHI transmitted or maintained in electronic media.

3. Services
Courier and delivery services involving pickup, transport, and delivery of packages which may include PHI when expressly authorized.

4. Permitted Uses and Disclosures by Business Associate
Business Associate may use and disclose PHI only to perform the Services for Covered Entity, as permitted by this Agreement or as required by law.
Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities, provided any disclosure is required by law or made subject to written confidentiality obligations.
Business Associate will not perform data aggregation services unless separately authorized in writing by Covered Entity.
Minimum Necessary: Business Associate shall request, use, and disclose only the Minimum Necessary PHI required to accomplish the intended purpose.

5. Safeguards and Compliance
Business Associate shall implement administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of PHI/ePHI as required by 45 C.F.R. Parts 164 Subparts C and E.
Business Associate shall ensure that any subcontractor to whom it provides PHI agrees in writing to the same restrictions and conditions that apply to Business Associate (45 C.F.R. §§164.502(e)(1)(ii), 164.308(b)(2)).

6. Reporting Obligations
Business Associate shall report to Covered Entity any use or disclosure of PHI not provided for by this Agreement and any Security Incident involving ePHI without unreasonable delay and in no case later than 5 business day(s) after discovery.

7. Individual Rights and HHS Access
Business Associate shall facilitate access, amendment, and accounting of disclosures as required by 45 C.F.R. §§164.524, 164.526, and 164.528, and shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of HHS.

8. Term and Termination
This Agreement remains in effect while services are provided and may be terminated for cause as described herein.
Covered Entity may terminate this Agreement immediately upon knowledge of a material breach by Business Associate if the breach is not cured within 15 day(s) after written notice.
Upon termination, Business Associate shall return or destroy all PHI received from Covered Entity that Business Associate still maintains in any form. If return or destruction is infeasible, Business Associate shall continue to extend the protections of this Agreement to such PHI and limit further uses and disclosures to those purposes that make the return or destruction infeasible.

9. Miscellaneous
Governing Law: North Carolina. Venue: Chatham County, North Carolina.
No Third-Party Beneficiaries. This Agreement may be amended as necessary to comply with HIPAA.

10. Signatures

Covered Entity:
[Covered Entity Name]
By: ______________________________  Date: ____________
Title: Authorized Representative

Business Associate:
OuterWave Logistics, LLC
By: ______________________________  Date: ____________
Title: Owner/Manager