Get Free Consultant + 10% Off!
HIPAA Business Associate Agreement (BAA)
This Business Associate Agreement (BAA) outlines how StedyDesk (“Business Associate”) complies with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), including HITECH Act provisions, in support of clients and healthcare entities (“Covered Entities”).
1. Purpose
This Agreement describes how StedyDesk handles Protected Health Information (PHI) while delivering services such as medical billing, revenue cycle management, and related healthcare administrative functions.
2. Definitions
- PHI: Protected Health Information as defined by HIPAA.
- Covered Entity: A healthcare organization that shares PHI with us to perform services.
- Business Associate: StedyDesk, acting on behalf of the Covered Entity to manage or process PHI.
3. Obligations of Stedy Desk
As a Business Associate, Stedy Desk agrees to:
- Use or disclose PHI only as permitted under applicable agreements or as required by law.
- Implement appropriate safeguards to protect PHI from unauthorized access or disclosure.
- Promptly report any breach or security incident involving PHI.
- Ensure subcontractors and partners adhere to HIPAA requirements when handling PHI.
- Provide access to PHI as required for inspection, amendment, or audit.
- Maintain required documentation for compliance and accountability.
4. Permitted Uses and Disclosures
Stedy Desk may use or disclose PHI strictly for the purpose of delivering contracted services, including:
- Medical billing and coding
- Accounts receivable (AR) follow-up
- Claims processing and appeals
- Credentialing and insurance verification
5. Termination
Upon termination of services, StedyDesk will return or securely destroy all PHI unless retention is legally required. Any retained PHI will continue to be protected under the terms of this Agreement.
6. Compliance and Indemnification
Stedy Desk is committed to HIPAA compliance and agrees to indemnify healthcare partners in the event of violations caused by our negligence or misconduct.
7. Governing Law
This Agreement is governed by U.S. federal laws and HIPAA regulations. It remains effective until terminated with written notice by either party or superseded by a new agreement.