HIPAA Business Associate Agreement
You must sign the BAA before accessing the platform. This is required by federal law for any service that handles Protected Health Information (PHI).
BUSINESS ASSOCIATE AGREEMENT (BAA)
Effective Date: Upon electronic signature below.
This Business Associate Agreement ("Agreement") is entered into by and between NorthStar Medic ("Business Associate") and the undersigned Covered Entity ("Covered Entity") pursuant to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the HITECH Act, and their implementing regulations at 45 CFR Parts 160 and 164.
1. DEFINITIONS. Terms used but not otherwise defined in this Agreement shall have the same meaning as those terms in the HIPAA Rules (45 CFR Parts 160-164).
2. OBLIGATIONS OF BUSINESS ASSOCIATE.
(a) Business Associate shall not use or disclose Protected Health Information ("PHI") other than as permitted or required by this Agreement or as Required by Law.
(b) Business Associate shall use appropriate administrative, physical, and technical safeguards to prevent unauthorized use or disclosure of PHI, including implementing requirements of the Security Rule (45 CFR Part 164, Subpart C).
(c) Business Associate shall report to Covered Entity any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, including breaches of Unsecured PHI as required by 45 CFR 164.410.
(d) Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI agree to the same restrictions and conditions (45 CFR 164.502(e)(1)(ii)).
(e) Business Associate shall make available PHI in accordance with 45 CFR 164.524 to satisfy Covered Entity's obligations regarding individual access rights.
3. PERMITTED USES AND DISCLOSURES.
(a) Business Associate may use and disclose PHI solely for: (i) performing AI-powered claim recovery analysis and appeal generation; (ii) automated dispatch of appeal letters via fax, mail, or electronic submission; (iii) AI-assisted negotiation of settlements with payers; and (iv) data management and reporting as requested by Covered Entity.
(b) Business Associate may de-identify PHI in accordance with 45 CFR 164.514(a)-(c).
4. PERFORMANCE-BASED COMPENSATION.
Covered Entity agrees to a 30% contingency fee on all successfully recovered claim revenue processed through the platform. Business Associate shall generate invoices automatically upon confirmed payment from payers.
5. TERM AND TERMINATION.
(a) This Agreement shall be effective upon electronic signature and shall remain in effect until all PHI is destroyed or returned.
(b) Either party may terminate this Agreement if the other party materially breaches any provision.
(c) Upon termination, Business Associate shall return or destroy all PHI received, or if not feasible, extend protections indefinitely.
6. BREACH NOTIFICATION.
Business Associate shall notify Covered Entity of a breach of Unsecured PHI without unreasonable delay and in no case later than 30 calendar days after discovery of the breach.
7. MISCELLANEOUS.
(a) This Agreement shall be governed by federal law where applicable, and otherwise by the laws of the State of Florida.
(b) This Agreement represents the complete agreement between the parties relating to the protection of PHI.
(c) Any ambiguity in this Agreement shall be interpreted to comply with HIPAA regulations.
Your signature, IP address, and timestamp are recorded for HIPAA compliance.