Business Associate Agreement

HIPAA requires this agreement when a healthcare provider, health plan or healthcare clearinghouse (a "covered entity"), or one of their business associates, uses FaxToFax to send, receive or store protected health information. It sets out how FaxToFax may use that information, the safeguards we maintain, how quickly we tell you about incidents, and what happens to the information when our service ends. It is available on Business and Enterprise plans and takes effect when an account owner e-signs it in Security & compliance.

This Business Associate Agreement ("BAA") is between the customer organization named in the electronic signature record ("Covered Entity") and FaxToFax.com ("Business Associate"). It supplements the FaxToFax Terms of Service (the "Terms"). If Covered Entity is itself a business associate of another covered entity, "Covered Entity" in this BAA means that customer, and Business Associate acts as its subcontractor.

1. Definitions

Terms used but not defined in this BAA have the meanings given to them in the HIPAA Rules, including: Breach, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information and Use.

• "HIPAA Rules" means the Privacy, Security, Breach Notification and Enforcement Rules at 45 C.F.R. Parts 160 and 164, as amended, including by the HITECH Act.
• "PHI" means protected health information, as defined at 45 C.F.R. §160.103, that Business Associate creates, receives, maintains or transmits on behalf of Covered Entity through the Service. It includes electronic PHI.
• "Service" has the meaning given in the Terms.

2. Eligibility and effective date

This BAA is available to customers on the Business and Enterprise plans. It becomes effective on the date an authorized representative of Covered Entity signs it electronically in Security & compliance (the "Effective Date"). The signature record includes Covered Entity's legal name, the signer's name and title, and the date and time of signature, and is recorded in the account's audit log. Covered Entity must not use the Service to create, receive, maintain or transmit PHI before the Effective Date, or on a plan for which this BAA is not available.

3. Obligations of Business Associate

3.1 Use and disclosure

Business Associate will not use or disclose PHI other than as permitted or required by this BAA or as Required by Law.

3.2 Safeguards

Business Associate will use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this BAA. These safeguards include encryption of PHI in transit (TLS 1.2 or higher) and at rest (AES-256), unique user identification through email one-time codes, two-step verification, automatic sign-out after inactivity, role-based access, an append-only audit log, a SHA-256 integrity fingerprint for each fax, and access to production systems limited to authorized personnel using two-step verification. Our Security Overview describes these measures in more detail.

3.3 Reporting

Business Associate will report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which it becomes aware, including any Breach of Unsecured PHI as required by 45 C.F.R. §164.410, and any Security Incident of which it becomes aware.

• Timing: reports will be made without unreasonable delay and in no case later than 60 calendar days after discovery, as the HIPAA Rules require. Business Associate commits to making its initial report within 10 business days of discovery.
• Content: to the extent known, the report will identify each Individual whose Unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used or disclosed, and will include the other information Covered Entity needs to meet its notification obligations under 45 C.F.R. §164.404. Business Associate will supplement the report as further information becomes available.
• Unsuccessful Security Incidents: the parties agree that this section is notice of the ongoing existence of unsuccessful Security Incidents, such as pings, port scans, failed sign-in attempts and denial-of-service attempts, that do not result in unauthorized access to, or use or disclosure of, PHI. No further notice of these is required.
• Reports will be sent by email to the account owner's email address.

3.4 Mitigation

Business Associate will mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure of PHI in violation of this BAA.

3.5 Subcontractors

In accordance with 45 C.F.R. §§164.502(e)(1)(ii) and 164.308(b)(2), Business Associate will ensure that any Subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions, conditions and requirements that apply to Business Associate under this BAA. Business Associate will not allow any Subcontractor to create, receive, maintain or transmit PHI until a business associate agreement with that Subcontractor is in effect. Our current subprocessors are listed in Annex 3 of our Data Processing Addendum.

3.6 Access

Covered Entity can view, download and export PHI held in the Service directly. Where Covered Entity needs further help, Business Associate will, within 15 days of a written request, make PHI in a Designated Record Set available to Covered Entity as necessary for Covered Entity to meet its obligations under 45 C.F.R. §164.524. If an Individual asks Business Associate directly for access, Business Associate will forward the request to Covered Entity within 10 business days.

3.7 Amendment

Within 15 days of a written request, Business Associate will make PHI in a Designated Record Set available for amendment, and will incorporate any amendment as directed or agreed to by Covered Entity under 45 C.F.R. §164.526.

3.8 Accounting of disclosures

Business Associate will maintain, and within 15 days of a written request make available, the information required for Covered Entity to provide an accounting of disclosures under 45 C.F.R. §164.528. The Service's audit log, which records views, downloads and sends and can be exported to CSV, is designed to help Covered Entity with this.

3.9 Privacy Rule obligations

To the extent Business Associate carries out any of Covered Entity's obligations under Subpart E of 45 C.F.R. Part 164, it will comply with the requirements of Subpart E that apply to Covered Entity in performing those obligations.

3.10 Access by the Secretary

Business Associate will make its internal practices, books and records relating to PHI available to the Secretary of the U.S. Department of Health and Human Services for the purpose of determining compliance with the HIPAA Rules.

3.11 Minimum necessary and prohibited uses

Business Associate will request, use and disclose only the minimum necessary PHI. It will not sell PHI, use PHI for marketing or advertising, use PHI to train artificial intelligence models, or de-identify PHI for its own purposes.

3.12 Workforce

Business Associate will ensure that its personnel who may access PHI are authorized, bound by confidentiality obligations, and given access only where needed for the purposes permitted by this BAA.

4. Permitted uses and disclosures by Business Associate

1. Service: Business Associate may use and disclose PHI as necessary to provide the Service under the Terms, including transmitting, receiving, converting, storing, displaying, retaining and deleting faxes, sending new-fax alerts (which never contain document contents), and providing support when Covered Entity asks for it.
2. Required by Law: Business Associate may use or disclose PHI as Required by Law.
3. Management and administration: Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities. It may disclose PHI for these purposes only if the disclosure is Required by Law, or if it obtains reasonable assurances from the recipient that the PHI will be held confidentially, used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the recipient will notify Business Associate of any instance in which the confidentiality of the PHI has been breached.
4. Limits: Business Associate will not use or disclose PHI in any manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except as permitted by the Management and administration item above.

5. Obligations of Covered Entity

• Covered Entity will notify Business Associate of any limitation in its Notice of Privacy Practices under 45 C.F.R. §164.520, any change in or revocation of an Individual's permission, and any restriction it has agreed to under 45 C.F.R. §164.522, to the extent it affects Business Associate's use or disclosure of PHI.
• Covered Entity will not ask Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 C.F.R. Part 164 if done by Covered Entity.
• Covered Entity is responsible for configuring and using the Service appropriately for its own compliance, including assigning roles, requiring two-step verification, setting the automatic sign-out period and retention period, removing users who no longer need access, checking fax numbers before sending, and using cover pages with confidentiality notices.
• Covered Entity will not send PHI to Business Associate outside the Service, such as in support emails, unless it is necessary and Business Associate has asked for it, and then only the minimum necessary.
• Covered Entity acknowledges that faxes sent to or received from external fax machines travel over the public telephone network, which is not encrypted, and that it is responsible for deciding whether fax is an appropriate way to send particular PHI.

6. Term and termination

6.1 Term

This BAA starts on the Effective Date and continues until the Terms end and all PHI has been returned or destroyed under section 6.4, or its protections have been extended under that section.

6.2 Termination for cause

If either party determines that the other has materially breached this BAA, it may give written notice of the breach. If the breach is not cured within 30 days after that notice, the non-breaching party may terminate this BAA and the Terms.

6.3 Change of plan

If Covered Entity moves to a plan for which this BAA is not available, it must stop using the Service for PHI and delete any PHI from the Service before the change takes effect.

6.4 Return or destruction of PHI

When this BAA ends, Business Associate will return or destroy all PHI it maintains in any form and keep no copies. Covered Entity may export its data through the Service before closing its account; closing the account, or the expiry of the retention period, results in deletion as described in the Terms. If returning or destroying any PHI is not feasible, for example where it remains in encrypted backups until they are overwritten, or where the law requires a record to be kept, Business Associate will extend the protections of this BAA to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as it keeps the PHI.

6.5 Survival

Business Associate's obligations under section 6.4 survive the end of this BAA.

7. General

• Regulatory references: a reference to a section of the HIPAA Rules means that section as in effect or as amended.
• Amendment: the parties will take such action as is necessary to amend this BAA to comply with changes in the HIPAA Rules. Business Associate may update this BAA to reflect changes in law by giving at least 30 days' notice, provided that the update does not reduce the protection given to PHI.
• Interpretation: any ambiguity in this BAA will be resolved to permit compliance with the HIPAA Rules.
• Conflicts: if this BAA conflicts with the Terms with respect to PHI, this BAA prevails.
• Independent contractor: Business Associate is an independent contractor and not an agent of Covered Entity.
• No third-party beneficiaries: nothing in this BAA gives any right or remedy to anyone other than the parties.
• Liability: except where the law does not allow it, the limitations of liability in the Terms apply to this BAA.
• Notices: Business Associate will send notices to the account owner's email address. Covered Entity should send incident-related notices to security@faxtofax.com, other notices to privacy@faxtofax.com; formal legal notices are sent to the same address.
• Governing law: this BAA is governed by the law that governs the Terms (the laws of the Province of Ontario and the federal laws of Canada that apply there), except to the extent federal law of the United States, including the HIPAA Rules, applies.
• Electronic signature: electronic signature in Security & compliance by an authorized representative of Covered Entity is binding. Business Associate's acceptance is given by making this BAA available for signature in the Service.