Health data agreements
A Startup holds health fields only after every upstream that processes them signs a business associate Agreement.
Satisfies
| Criterion | Text |
|---|---|
| HIPAA 164.308(b)(1) | A business associate handles protected health information only under satisfactory written assurances. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Preventive: it stops the failure before it happens. |
| Select | Every upstream that receives a health field in the report period. |
| Assert | Each has a signed business associate Agreement dated before its first receipt. |
Owner
Contracts Manager, Legal Team.
Example
A clinic-scheduling SaaS adds a transcription upstream for visit notes. The first note reaches it only after its business associate Agreement is signed and on file.