Version 2026-10-10. Draft, not yet reviewed by a lawyer.

This agreement follows the sample business associate provisions published by the U.S. Department of Health and Human Services (HHS), in plain words, between Clinihealth LLC, a Georgia limited liability company ("Business Associate") and the practice ("Covered Entity"). Your own counsel may wish to compare it with the current HHS sample.

Do you need one? Probably not, and we say so plainly. Practice KPIs runs on the practice's own PC and keeps patient data there. Clinihealth does not create, receive, keep or send protected health information (PHI) for the practice through the app, so the app alone does not make Clinihealth a business associate. Many practices' policies still ask for an agreement with every software vendor, and support can bring us close to PHI (for example if a practice shares its screen during a support call). This agreement covers those cases.

How it starts. It takes effect when the practice asks for it in writing (an email to [email protected] is enough) or signs a copy we send, and it covers the practices on the practice's licence. It uses the version shown at the top on that date.

1. Definitions

Words in capitals not defined here have the meaning given in the HIPAA Rules (45 CFR Parts 160 and 164).

Business Associate means the software vendor, Clinihealth LLC.
Covered Entity means the practice that accepts this agreement.
HIPAA Rules means the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Part 160 and Part 164.
PHI means protected health information, including electronic PHI, that the Business Associate creates, receives, maintains or transmits for the Covered Entity.
Secretary means the Secretary of the U.S. Department of Health and Human Services.

2. What the Business Associate may do with PHI

The Business Associate may use or disclose PHI only to provide the Practice KPIs software and support to the Covered Entity, as set out in the licence and terms of use, and as this agreement or the law allows. In practice this means seeing PHI only while helping the Covered Entity, at its request, and keeping no copy. Any PHI the Covered Entity sends by mistake is deleted.
The Business Associate will use, disclose and ask for only the minimum PHI needed for the purpose.
The Business Associate may not use or disclose PHI in a way that would break the Privacy Rule if the Covered Entity did it, except as stated in items 4 and 5.
The Business Associate may use PHI for its own proper management and administration, and to meet its legal duties.
The Business Associate may disclose PHI for those same purposes only if the disclosure is required by law, or it gets reasonable assurance from the person receiving the PHI that it will be kept confidential, used or disclosed further only as required by law or for the purpose it was given, and that the person will tell the Business Associate about any breach of confidentiality.

3. What the Business Associate agrees to do

Limits on use. Not to use or disclose PHI except as this agreement permits or the law requires.
Safeguards. To use appropriate safeguards, and to comply with the Security Rule (45 CFR Part 164, Subpart C) for electronic PHI, to prevent any use or disclosure not allowed by this agreement.
Reporting. To report to the Covered Entity, without unreasonable delay and in any case within 10 business days of finding out: any use or disclosure not allowed by this agreement; any security incident; and any breach of unsecured PHI as the Breach Notification Rule requires (45 CFR 164.410).
Subcontractors. To make sure any subcontractor that handles PHI for the Business Associate agrees in writing to the same restrictions and conditions (45 CFR 164.502(e)(1)(ii) and 164.308(b)(2)).
Access. To make PHI it holds in a designated record set available to the Covered Entity, or to the individual as the Covered Entity directs, so the Covered Entity can meet 45 CFR 164.524.
Amendments. To make PHI available for amendment, and to make amendments as the Covered Entity directs, so the Covered Entity can meet 45 CFR 164.526.
Accounting of disclosures. To keep and make available the information the Covered Entity needs to give an accounting of disclosures under 45 CFR 164.528.
Covered Entity's duties. If the Business Associate carries out any of the Covered Entity's Privacy Rule duties, to follow the Privacy Rule requirements that apply to the Covered Entity for that duty.
Government access. To make its internal practices, books and records about PHI available to the Secretary so the Secretary can check the Covered Entity's compliance.

4. What the Covered Entity agrees to do

To tell the Business Associate about any limit in its Notice of Privacy Practices that could affect the Business Associate's use or disclosure of PHI.
To tell the Business Associate about any change in, or withdrawal of, an individual's permission to use or disclose PHI, if it could affect the Business Associate.
To tell the Business Associate about any restriction on the use or disclosure of PHI that the Covered Entity has agreed to or must follow under 45 CFR 164.522, if it could affect the Business Associate.
Not to ask the Business Associate to use or disclose PHI in any way that the Privacy Rule would not allow if the Covered Entity did it itself, except as items 2.4 and 2.5 allow.

5. How long this lasts, and how it ends

Term. This agreement lasts as long as the Covered Entity holds a licence for Practice KPIs, and ends when all PHI held by the Business Associate has been returned or destroyed, or, if that is not possible, when protections are extended as item 5.4 says.
Ending for cause. If one side learns that the other has broken a material term of this agreement, it may give written notice. If the breach is not fixed within 30 days of the notice, the side that gave notice may end this agreement. If fixing the breach is not possible, it may end the agreement at once.
Return or destruction. When this agreement ends, the Business Associate will, if it is feasible, return or destroy all PHI it still holds, and keep no copies.
If return or destruction is not feasible. The Business Associate will tell the Covered Entity why, and will keep the protections of this agreement for that PHI and limit any further use or disclosure to the reason that makes return or destruction not feasible.

6. General

Rule references. A reference to a section of the HIPAA Rules means that section as changed from time to time.
Changing this agreement. The two sides will change this agreement as needed to keep it in line with the HIPAA Rules and other law.
Which way to read it. If anything here is unclear, it should be read in the way that lets both sides comply with the HIPAA Rules.
Survival. Items 3.3, 5.3 and 5.4 continue after this agreement ends.
No third parties. This agreement gives rights only to the Covered Entity and the Business Associate.
Relationship to the terms of use. This agreement sits beside the Practice KPIs terms of use. If the two conflict about PHI, this agreement wins.