Important: A signed BAA is required before transmitting any PHI to the FinVerified platform. Transmitting PHI without a signed BAA is a material breach of our Terms and HIPAA.
This Business Associate Agreement ("BAA") is entered into between the Covered Entity ("CE") or Business Associate ("BA") customer and FinVerified, Inc. ("FinVerified") to satisfy requirements under the Health Insurance Portability and Accountability Act ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and implementing regulations.
"Protected Health Information" ("PHI") has the meaning set forth at 45 CFR § 160.103. "Breach" means unauthorized acquisition, access, use, or disclosure of PHI that compromises the security or privacy of such information, as defined at 45 CFR § 164.402.
FinVerified may use and disclose PHI only: (a) as necessary to perform Services under the Terms; (b) as required by law; (c) to report violations of law to appropriate authorities; (d) for FinVerified's proper management and administration; and (e) to carry out legal responsibilities.
FinVerified will: (a) not use or disclose PHI except as permitted by this BAA or required by law; (b) use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 (Security Rule); (c) report Breaches of Unsecured PHI to CE as required by 45 CFR § 164.410; (d) ensure subcontractors agree to the same restrictions; (e) make PHI available for access and amendment as required by HIPAA; (f) make PHI available for accounting of disclosures; (g) make internal practices, books, and records available to HHS for compliance review; and (h) return or destroy PHI upon termination, if feasible.
CE will: (a) not request FinVerified to use or disclose PHI in a manner that would violate HIPAA if done by CE; (b) provide FinVerified with the Notice of Privacy Practices and any changes; and (c) notify FinVerified of any restrictions on uses or disclosures agreed to with individuals.
FinVerified will notify CE without undue delay (target: within 72 hours) upon discovery of a Breach of Unsecured PHI. Notification will include: (a) identification of each individual whose PHI was involved; (b) description of the Breach; (c) steps individuals should take to protect themselves; and (d) steps FinVerified is taking to investigate, mitigate, and prevent recurrence.
This BAA is effective upon CE's acceptance and continues for the term of the Service. Either party may terminate if the other materially breaches a provision of this BAA and does not cure within 30 days. CE may terminate immediately if FinVerified's continued violation would result in CE's violation of HIPAA.
This BAA is not effective until signed by both parties. To execute a BAA: email legal@finverified.ai with subject "BAA Request" and provide: (a) your organization name; (b) Covered Entity or Business Associate status; (c) signing authority name and title; and (d) return email address. We will send a DocuSign package within 2 business days.
FinVerified, Inc.
HIPAA/BAA inquiries: legal@finverified.ai — Subject: "BAA Request"
Privacy Officer: privacy@finverified.ai