bcb1a10fe6
- New CoverageFlag enum: SUPPLY_LAPSED, VISIT_REQUIRED, TRANSFER_PENDING, RENEWAL_CRITICAL/ELEVATED/SOON, RESUPPLY_READY, ACTIVE - Doc state machine: 5-item payer-dependent status per patient (SWO, Visit, PECOS, PA, Diagnosis) with cascade chain - Confirm Visit endpoint: staff enters prescriber-confirmed date, persisted in Supabase confirmed_visits table, survives all future CSV imports - Supabase migration: 001_add_confirmed_visits.sql (run manually in SQL editor) - Frontend: Badge rebuilt for 8 flags, DocStatusBar 5-dot display, ConfirmVisitModal, expandable WorklistTable rows - Legal: LOI, NDA, BAA drafts at pitch/legal/ for Nixon Law Group review - Compliance docs: privacy policy, incident response, data handling - CSV generator: market_data.json + PA/NJ generator scripts - 15/15 tests passing Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
195 lines
11 KiB
Markdown
195 lines
11 KiB
Markdown
# BUSINESS ASSOCIATE AGREEMENT
|
|
|
|
**Effective Date:** June __, 2026
|
|
|
|
**Between:**
|
|
- **STTIL Solutions LLC** ("Business Associate"), a limited liability company, Kisa Fenn, Managing Member
|
|
- **Gaboro DME** ("Covered Entity"), Robert Robinson, Co-Founder and Managing Partner
|
|
|
|
Each a "Party" and together the "Parties."
|
|
|
|
---
|
|
|
|
## Recitals
|
|
|
|
Covered Entity is a durable medical equipment supplier subject to the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA"). Business Associate provides Signal, a documentation readiness platform, and in connection with that service may receive, create, maintain, or transmit data on behalf of Covered Entity that may constitute Protected Health Information ("PHI") as defined under HIPAA. The Parties enter into this Agreement to satisfy the Business Associate Agreement requirements of 45 C.F.R. Part 164, Subpart C.
|
|
|
|
---
|
|
|
|
## 1. Definitions
|
|
|
|
Terms used in this Agreement have the meanings assigned under HIPAA and its implementing regulations, including the HITECH Act amendments, as of the Effective Date.
|
|
|
|
**"Protected Health Information" or "PHI"** means individually identifiable health information created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity, in any form or medium.
|
|
|
|
**"Minimum Necessary"** means the least amount of PHI required to accomplish the intended purpose of a given use, disclosure, or request.
|
|
|
|
**"Security Incident"** means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.
|
|
|
|
---
|
|
|
|
## 2. Obligations of Business Associate
|
|
|
|
### 2.1 Permitted Uses and Disclosures
|
|
|
|
Business Associate may use or disclose PHI only:
|
|
|
|
(a) To perform the services described in the Pilot Letter of Intent between the Parties dated June __, 2026 ("LOI"), specifically: receiving de-identified order management data uploaded by Covered Entity, calculating documentation readiness status per patient, and returning a prioritized worklist to Covered Entity staff;
|
|
|
|
(b) As required by law; or
|
|
|
|
(c) For the proper management and administration of Business Associate's own operations, provided that any such disclosure is required by law or Business Associate obtains reasonable assurances that the information will be held in confidence and used or further disclosed only as required by law or for the purpose for which it was disclosed.
|
|
|
|
Business Associate will not use or disclose PHI in any manner that would violate HIPAA if done by Covered Entity directly.
|
|
|
|
### 2.2 Minimum Necessary
|
|
|
|
Business Associate will make reasonable efforts to use, disclose, and request only the minimum necessary PHI to accomplish the intended purpose.
|
|
|
|
### 2.3 Safeguards
|
|
|
|
Business Associate will implement and maintain appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of PHI it creates, receives, maintains, or transmits on behalf of Covered Entity, in accordance with 45 C.F.R. Part 164, Subpart C (Security Rule).
|
|
|
|
Business Associate's current safeguards include:
|
|
|
|
- HTTPS enforced on all data transmission surfaces
|
|
- SHA-256 hashing of patient_id before storage in any log or database record
|
|
- Supabase Row Level Security (RLS) restricting data access by organization
|
|
- Clerk JWT authentication required on all API endpoints
|
|
- No storage of patient names, dates of birth, Social Security numbers, addresses, or contact information at any time
|
|
- The patient identity crosswalk (supplier's internal patient_id to real patient identity) is maintained solely by Covered Entity staff and is never transmitted to or stored by Business Associate
|
|
|
|
### 2.4 Reporting
|
|
|
|
Business Associate will report to Covered Entity, without unreasonable delay and in no event later than 30 calendar days of discovery:
|
|
|
|
(a) Any use or disclosure of PHI not permitted by this Agreement of which Business Associate becomes aware;
|
|
|
|
(b) Any Security Incident of which Business Associate becomes aware, including breaches of Unsecured PHI as required by 45 C.F.R. Part 164, Subpart D;
|
|
|
|
(c) Any attempted but unsuccessful Security Incident of which Business Associate becomes aware, to the extent practicable.
|
|
|
|
Reports shall be made to Covered Entity's designated contact in writing.
|
|
|
|
### 2.5 Subcontractors
|
|
|
|
Business Associate will ensure that any subcontractor or agent to which it provides PHI on behalf of Covered Entity agrees to the same restrictions, conditions, and requirements that apply to Business Associate under this Agreement.
|
|
|
|
Business Associate's current subprocessors include:
|
|
|
|
| Subprocessor | Purpose | Data Touched |
|
|
|---|---|---|
|
|
| Supabase (via cloud.supabase.com) | PostgreSQL database hosting | Hashed patient_id, device_type, shipment_date, payer, doc status fields |
|
|
| Railway (via railway.app) | Backend API hosting | Processes upload requests in transit; does not persist PHI |
|
|
| Vercel (via vercel.com) | Frontend hosting | No PHI; serves static application only |
|
|
| Clerk (via clerk.com) | Staff authentication | No PHI; stores staff identity only |
|
|
|
|
Business Associate will notify Covered Entity of any material change to subprocessors that will touch PHI, and will obtain Covered Entity's written approval before adding any new subprocessor that will receive or process PHI.
|
|
|
|
### 2.6 Access to PHI
|
|
|
|
To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate will make such PHI available to Covered Entity as necessary to fulfill Covered Entity's obligations under 45 C.F.R. Section 164.524 within 15 business days of a written request.
|
|
|
|
### 2.7 Amendment
|
|
|
|
To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate will make such PHI available for amendment and will incorporate any amendments requested by Covered Entity as required by 45 C.F.R. Section 164.526.
|
|
|
|
### 2.8 Accounting of Disclosures
|
|
|
|
Business Associate will maintain a record of disclosures of PHI and will make such information available to Covered Entity as necessary to respond to a request for an accounting of disclosures under 45 C.F.R. Section 164.528.
|
|
|
|
### 2.9 Government Access
|
|
|
|
Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance with HIPAA.
|
|
|
|
---
|
|
|
|
## 3. Obligations of Covered Entity
|
|
|
|
Covered Entity agrees to:
|
|
|
|
(a) Notify Business Associate of any limitation in Covered Entity's Notice of Privacy Practices that would affect Business Associate's permitted uses or disclosures;
|
|
|
|
(b) Notify Business Associate of any changes in, or revocations of, authorization by individuals that would affect Business Associate's permitted uses or disclosures;
|
|
|
|
(c) Not request Business Associate to use or disclose PHI in any manner that would not be permissible under HIPAA if done by Covered Entity directly;
|
|
|
|
(d) Ensure that any PHI uploaded to Signal is limited to the minimum necessary fields specified in the LOI: an internal patient identifier (patient_id), device type, shipment date, and payer name. Covered Entity will not upload patient names, Social Security numbers, dates of birth, addresses, or direct contact information to Signal at any time.
|
|
|
|
---
|
|
|
|
## 4. Term and Termination
|
|
|
|
### 4.1 Term
|
|
|
|
This Agreement is effective as of the Effective Date and continues until the later of: (a) the termination of the LOI or any subsequent formal agreement between the Parties; or (b) the date on which Business Associate has completed its data return and destruction obligations under Section 4.3.
|
|
|
|
### 4.2 Termination for Cause
|
|
|
|
Either Party may terminate this Agreement immediately upon written notice to the other Party if the other Party has materially breached a provision of this Agreement and has not cured the breach within 10 business days of written notice identifying the breach.
|
|
|
|
### 4.3 Return or Destruction of PHI
|
|
|
|
Upon termination of this Agreement for any reason:
|
|
|
|
(a) Business Associate will return to Covered Entity or destroy all PHI received from or created on behalf of Covered Entity, including PHI in the possession of subcontractors, within **10 business days** of the effective termination date;
|
|
|
|
(b) Business Associate will certify in writing to Covered Entity that all such PHI has been returned or destroyed;
|
|
|
|
(c) If return or destruction is not feasible, Business Associate will extend the protections of this Agreement to such PHI and limit further use or disclosure to the purposes that make return or destruction infeasible, for as long as Business Associate maintains the PHI.
|
|
|
|
---
|
|
|
|
## 5. Miscellaneous
|
|
|
|
### 5.1 Regulatory References
|
|
|
|
Any reference in this Agreement to a section of HIPAA includes the most recent amendment or regulatory guidance applicable to that section.
|
|
|
|
### 5.2 Interpretation
|
|
|
|
This Agreement is intended to comply with HIPAA as amended. Where this Agreement conflicts with HIPAA, HIPAA controls. Where this Agreement is silent, HIPAA controls.
|
|
|
|
### 5.3 No Third-Party Beneficiaries
|
|
|
|
Nothing in this Agreement confers any right, remedy, or claim upon any third party, including any patient whose PHI is involved.
|
|
|
|
### 5.4 Governing Law
|
|
|
|
This Agreement shall be governed by the laws of the **Commonwealth of Pennsylvania**, without regard to conflict of law principles.
|
|
|
|
### 5.5 Entire Agreement
|
|
|
|
This Agreement, together with the LOI and mutual NDA between the Parties, constitutes the entire agreement with respect to PHI and supersedes all prior understandings on the subject.
|
|
|
|
---
|
|
|
|
## Attorney Review Notes
|
|
|
|
The following items should be confirmed by Nixon Law Group before this Agreement is executed:
|
|
|
|
1. **BAA necessity:** Confirm whether Signal's receipt of Covered Entity's internal patient_id (supplier account number, one of HIPAA's 18 Safe Harbor identifiers) makes STTIL Solutions a Business Associate requiring this Agreement, or whether Signal's de-identification architecture (no names, no DOBs, no SSNs; crosswalk stays with Covered Entity) satisfies the Expert Determination or Safe Harbor de-identification standards.
|
|
|
|
2. **Subprocessor agreements:** Confirm whether Railway, Supabase, Vercel, and Clerk each require a separate BAA as subcontractors.
|
|
|
|
3. **Accounting of disclosures scope:** Confirm the scope of Section 2.8 as applied to a software service that processes de-identified data only.
|
|
|
|
4. **Pennsylvania-specific requirements:** Confirm no PA-specific health data protection statutes (beyond HIPAA) apply to this arrangement.
|
|
|
|
---
|
|
|
|
## Signatures
|
|
|
|
**STTIL Solutions LLC (Business Associate)**
|
|
By: ___________________________
|
|
Name: Kisa Fenn
|
|
Title: Managing Member
|
|
Date: _________________________
|
|
Email: kisasttil@gmail.com
|
|
|
|
**Gaboro DME (Covered Entity)**
|
|
By: ___________________________
|
|
Name: Robert Robinson
|
|
Title: Co-Founder and Managing Partner
|
|
Date: _________________________
|
|
Email: ___________________________
|