This Business Associate Addendum ("BAA") applies only when expressly incorporated into a written agreement between a HIPAA Covered Entity and Evident Technologies LLC for a workspace authorized in writing for Protected Health Information ("PHI") handling.
This BAA does not authorize PHI use in public, demo, trial, self-serve, waitlist, or non-PHI workspaces. For enterprise engagements, the governing service agreement is the executed MSA, Order Form, or other written agreement that incorporates this BAA.
For standard memberships or public-access workflows, this BAA does not apply unless Evident Technologies LLC has expressly provisioned a PHI-authorized workspace and a signed BAA or written PHI authorization is in place.
1. Applicability
This BAA applies only to PHI uploaded, transmitted, received, maintained, or processed through services expressly authorized in writing for PHI handling. Evident ICU is not configured or authorized for PHI handling for all users, all workspaces, or all workflows.
Do not upload PHI to demo, public-access, trial, self-serve, waitlist, or non-PHI workflows. Those workflows are not authorized for PHI unless a PHI-authorized workspace and a signed BAA or written PHI authorization are in place.
2. Definitions
"PHI" means Protected Health Information as defined by HIPAA, including electronic PHI, that is created, received, maintained, transmitted, uploaded, or processed by Business Associate on behalf of Covered Entity.
"Covered Entity," "Business Associate," "electronic PHI," "Security Incident," and "Unsecured Protected Health Information" have the meanings given to those terms under HIPAA and its implementing regulations.
3. Permitted uses and disclosures
Business Associate may use and disclose PHI only as necessary to perform contracted services and as permitted by HIPAA and this BAA.
4. Safeguards
Business Associate will implement administrative, physical, and technical safeguards reasonably designed to protect PHI from unauthorized use or disclosure.
5. Workforce and subcontractors
- Workforce access to PHI must be role-restricted and confidentiality-bound.
- Subcontractors receiving PHI must be bound by written obligations no less protective than this BAA.
6. Incident and breach reporting
Business Associate will report to Covered Entity any use or disclosure of PHI not provided for by this BAA, including Security Incidents and Breaches of Unsecured Protected Health Information, without unreasonable delay and as required by HIPAA and the governing service agreement.
7. HHS access
To the extent required by HIPAA, Business Associate will make available to the Secretary of the U.S. Department of Health and Human Services its internal practices, books, and records relating to the use and disclosure of PHI received from, created by, or received by Business Associate on behalf of Covered Entity.
8. Access, amendment, accounting support
To the extent required and feasible, Business Associate will support Covered Entity requests for access, amendment, and accounting of disclosures.
9. Return or destruction
Upon termination, Business Associate will return or destroy PHI when feasible, or continue required protections for retained PHI if destruction is infeasible.
10. Restrictions and minimum necessary
Business Associate will apply minimum-necessary principles and honor documented restrictions to the extent required by law.
11. No legal services
Business Associate provides technical processing services only and does not provide legal counsel, medical advice, or regulatory legal interpretation.
12. Liability and precedence
Liability framework follows the governing service agreement unless prohibited by applicable law. If conflict exists on PHI-handling obligations, this order controls: (1) this BAA, (2) governing service agreement, (3) applicable schedules under documentation .
13. Termination for material BAA breach
Covered Entity may terminate if Business Associate materially breaches this BAA and fails to cure within the required period.