Business associate policy, agreement template and register

Granite City Family Dental — Policy set version 1.0 — Effective November 1, 2026 — Binder edition 2026

Authority: 45 CFR 164.502(e) and 164.504(e) (Privacy Rule business associate contracts); 164.308(b) and 164.314(a) (Security Rule business associate contracts); 164.410 (breach notice by a business associate).

Approved by Dr. Maria Lindqvist, Owner. Register owner: Janelle Okafor. Responsible officer: Janelle Okafor, Office Manager.

Purpose

Granite City Family Dental shares patient information with vendors that store it, process it, bill with it or support the systems that hold it. Each of those vendors is a business associate and must sign a business associate agreement before it touches any PHI. Giving a vendor PHI without one is itself a HIPAA violation and is among the most common findings against small practices.

1. Who is a business associate

A business associate is a person or company, outside the workforce, that creates, receives, maintains or transmits PHI on behalf of the practice, or provides legal, accounting, consulting, management, billing or similar services that involve PHI (45 CFR 160.103).

Typical business associates of a practice like this one: the EHR vendor (Open Dental), billing and clearinghouse vendors (Open Dental eClaims via DentalXChange), the IT provider (CRU Technologies), the backup vendor (CRU Backups), the email host where PHI is emailed (Microsoft 365), the e-fax provider (Open Dental eFax (BAA signed)), the shredding vendor (Shred-It, locked console, monthly pickup with certificate), answering services, transcription, collections agencies, off-site storage, and attorneys and accountants who see PHI.

Not business associates:

• Workforce. Employees, volunteers, students and contractors who work under the practice's direct control are workforce, trained and sanctioned under this binder, not business associates.
• Other providers treating the patient. A specialist, hospital, lab or pharmacy receiving PHI for the patient's treatment acts as its own covered entity; no agreement is needed for treatment disclosures.
• Conduits. A carrier that only transports PHI and does not store it beyond what transmission requires, such as the postal service, a courier, or an internet service provider, is a conduit. A cloud service that stores PHI is not a conduit even if it cannot read the data.
• Health plans receiving claims for payment, and government agencies receiving required reports.
• Janitorial, maintenance and landlord staff whose contact with PHI would be incidental; they are controlled by the facility rules in document 20 instead. If they have unsupervised access to records areas, the Privacy Officer decides whether an agreement is needed.

When it is unclear, the Privacy Officer decides and records the reason in the register's status column ("Not a BA (conduit / provider)").

2. Agreement before PHI

• No vendor receives, stores or connects to PHI until a business associate agreement signed by both parties is on file. The administrator checks the register before any new vendor, software subscription or cloud tool is turned on.
• The practice's own template follows this policy. A vendor's own agreement may be accepted if the Privacy Officer confirms it contains every provision in section 6; large vendors (EHR, email platform) usually sign only their own.
• Free or trial software that will hold PHI, including transcription, scheduling, texting and artificial-intelligence tools, is treated like any other vendor: no agreement, no PHI.
• IT provider: a business associate agreement is signed with CRU Technologies and recorded in the register.- Every row in the register with status "Not yet" or "Requested" is a risk-register item with Janelle Okafor as owner and a due date no more than 60 days out.

3. Annual review

Janelle Okafor reviews the register once a year before the annual review meeting and reports to it:

• every vendor still in use has a signed agreement and a current security contact;
• vendors no longer used are marked ended and asked in writing to return or destroy the practice's PHI;
• any vendor incident or breach notice received during the year is listed with the practice's response;
• new vendors added during the year are confirmed on the register.

The practice is not required to audit its business associates, but it may ask for a security summary, a SOC 2 report or an attestation when a vendor holds a large share of the practice's records; the proposed Security Rule update would make a yearly written verification mandatory.

4. When a business associate reports an incident

A business associate must report any security incident, and any breach of unsecured PHI, to the practice. The practice's template requires the report within 10 days of discovery; the rule allows up to 60 days (45 CFR 164.410), and the practice's own 60-day notification clock runs from the day the business associate is treated as its agent or the day the practice learns of the breach. A business associate's report is logged in the incident log (document 16) and handed to Janelle Okafor with counsel under document 22.

5. Business associate register

Authority: 45 CFR 164.504(e); 164.308(b). Reviewed annually by Janelle Okafor.

Open: DentalXChange (Claims clearinghouse) handles PHI with the agreement marked "Not yet". Recorded in the risk register; owner Janelle Okafor; due within 60 days.

Annual review sign-off: ___________________________ Date: ______________

Approval

Policy approved by: Dr. Maria Lindqvist, Owner Signature: ___________________________ Date: ______________

Privacy Officer: Janelle Okafor Signature: ___________________________ Date: ______________

6. Business Associate Agreement

This agreement follows the sample business associate agreement provisions published by the U.S. Department of Health and Human Services, adapted for Granite City Family Dental. Where a vendor supplies its own agreement, the Privacy Officer confirms each numbered provision below appears in it.

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement ("Agreement") is entered into as of ______________ (the "Effective Date") between Granite City Family Dental, P.A., doing business as Granite City Family Dental, ("Covered Entity"), and __________________________________________ ("Business Associate").

1. Definitions

Terms used but not otherwise defined in this Agreement have the meanings given in the HIPAA Rules. "HIPAA Rules" means the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Parts 160 and 164. The following terms have the meanings set out in 45 CFR 160.103 and 164.402: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use. "Protected Health Information" or "PHI" in this Agreement is limited to the PHI Business Associate creates, receives, maintains or transmits on behalf of Covered Entity.

2. Obligations and activities of Business Associate

Business Associate agrees to:

1. not use or disclose PHI other than as permitted or required by this Agreement or as required by law;
2. use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent any use or disclosure of PHI other than as provided for by this Agreement;
3. report to Covered Entity any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, including any breach of unsecured PHI as required by 45 CFR 164.410, and any security incident of which it becomes aware, within ten (10) calendar days of discovery, and provide the identity of each individual affected and the other information Covered Entity needs to meet its notification obligations as it becomes available;
4. in accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any subcontractor that creates, receives, maintains or transmits PHI on behalf of Business Associate agrees in writing to the same restrictions, conditions and requirements that apply to Business Associate under this Agreement;
5. make available PHI in a designated record set to Covered Entity, within ten (10) business days of request, as necessary for Covered Entity to satisfy its obligations under 45 CFR 164.524;
6. make any amendment to PHI in a designated record set as directed or agreed to by Covered Entity under 45 CFR 164.526, or take other measures as necessary for Covered Entity to satisfy its obligations under that section, within ten (10) business days of request;
7. maintain and make available the information required to provide an accounting of disclosures to Covered Entity, within ten (10) business days of request, as necessary for Covered Entity to satisfy its obligations under 45 CFR 164.528;
8. to the extent Business Associate is to carry out one or more of Covered Entity's obligations under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to Covered Entity in the performance of those obligations;
9. make its internal practices, books and records available to the Secretary of Health and Human Services for purposes of determining compliance with the HIPAA Rules;
10. limit its uses, disclosures and requests of PHI to the minimum necessary to accomplish the intended purpose;
11. mitigate, to the extent practicable, any harmful effect known to Business Associate of a use or disclosure of PHI in violation of this Agreement;
12. train its workforce members who handle Covered Entity's PHI on the requirements of this Agreement and the HIPAA Rules.

3. Permitted uses and disclosures by Business Associate

1. Business Associate may only use or disclose PHI as necessary to perform the services set forth in the underlying service agreement between the parties, described as: __________________________________________.
2. Business Associate may use or disclose PHI as required by law.
3. Business Associate agrees to make uses, disclosures and requests for PHI consistent with Covered Entity's minimum necessary policies and procedures.
4. Business Associate may not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, except for the specific uses and disclosures set out in items 5 and 6.
5. Business Associate may use PHI for the proper management and administration of Business Associate or to carry out its legal responsibilities.
6. Business Associate may disclose PHI for the proper management and administration of Business Associate or to carry out its legal responsibilities, provided the disclosure is required by law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and be used or further disclosed only as required by law or for the purposes for which it was disclosed, and the person notifies Business Associate of any instance of which it is aware in which the confidentiality of the information has been breached.
7. Business Associate may provide data aggregation services relating to the health care operations of Covered Entity only if authorized in writing by Covered Entity: [ ] Authorized [ ] Not authorized.
8. Business Associate may de-identify PHI in accordance with 45 CFR 164.514(a)-(c) only if authorized in writing by Covered Entity: [ ] Authorized [ ] Not authorized.

4. Provisions for Covered Entity to inform Business Associate of privacy practices and restrictions

1. Covered Entity shall notify Business Associate of any limitation in its Notice of Privacy Practices under 45 CFR 164.520, to the extent the limitation may affect Business Associate's use or disclosure of PHI.
2. Covered Entity shall notify Business Associate of any changes in, or revocation of, the permission by an individual to use or disclose their PHI, to the extent the change may affect Business Associate's use or disclosure of PHI.
3. Covered Entity shall notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent the restriction may affect Business Associate's use or disclosure of PHI.
4. Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Covered Entity, except as permitted under section 3, items 5 through 8.

5. Term and termination

1. Term. This Agreement is effective as of the Effective Date and remains in effect until all PHI provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or, if return or destruction is infeasible, until the protections of this Agreement are extended to that information under item 3 below.
2. Termination for cause. Covered Entity may terminate this Agreement if it determines Business Associate has violated a material term of it and Business Associate has not cured the breach or ended the violation within thirty (30) days of written notice.
3. Obligations of Business Associate upon termination. Upon termination for any reason, Business Associate shall return to Covered Entity, or if agreed by Covered Entity destroy, all PHI that Business Associate still maintains in any form, including PHI held by subcontractors, and retain no copies; shall retain only that PHI necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities; shall continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI for as long as it retains it; shall not use or disclose retained PHI other than for the purposes for which it was retained and subject to the same conditions as section 3, items 5 and 6; and shall return or destroy the retained PHI when it is no longer needed. Where return or destruction is infeasible, Business Associate shall notify Covered Entity of the conditions that make it infeasible and extend the protections of this Agreement to that PHI for as long as it is retained. Business Associate shall certify in writing when return or destruction is complete.
4. Survival. The obligations of Business Associate under this section survive the termination of this Agreement.

6. Miscellaneous

1. Regulatory references. A reference in this Agreement to a section of the HIPAA Rules means the section as in effect or as amended.
2. Amendment. The parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with the requirements of the HIPAA Rules and any other applicable law, including the Minnesota Health Records Act where it applies.
3. Interpretation. Any ambiguity in this Agreement shall be interpreted to permit compliance with the HIPAA Rules.
4. No third-party beneficiaries. Nothing in this Agreement confers any rights on any person other than the parties.
5. Relationship to service agreement. This Agreement supplements the underlying service agreement; where they conflict, this Agreement controls as to PHI.

Signatures

Covered Entity: Granite City Family Dental, P.A.

Signature: ___________________________ Printed name: Dr. Maria Lindqvist Title: Owner and Dentist Date: ______________

Business Associate: __________________________________________

Signature: ___________________________ Printed name: ___________________________ Title: ___________________________ Date: ______________