1. Parties and background
This Business Associate Agreement ("Agreement") is made on [effective date] ("Effective Date") between:
- [practice legal name], located at [practice address] ("Covered Entity" or "Practice"); and
- [Sonty legal entity name], located at [Sonty mailing address] ("Business Associate" or "Sonty").
The Practice uses Sonty's web-based service for dental practices (the "Services") under Sonty's Terms of Service and any order form or pilot agreement between the parties (together, the "Underlying Agreement"). In providing the Services, Sonty creates, receives, maintains or transmits Protected Health Information on the Practice's behalf.
The parties are entering this Agreement to meet the requirements of the Health Insurance Portability and Accountability Act of 1996, the HITECH Act, and their implementing regulations at 45 CFR Parts 160 and 164 (together, "HIPAA"). If this Agreement conflicts with the Underlying Agreement on anything about Protected Health Information, this Agreement controls.
2. Definitions
Capitalized terms used but not defined here have the meanings given in HIPAA, including: Breach, Data Aggregation, Designated Record Set, Disclosure, Electronic Protected Health Information, Health Care Operations, Individual, Minimum Necessary, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information and Use.
- "Protected Health Information" or "PHI" has the meaning in 45 CFR 160.103, limited to the information Sonty creates, receives, maintains or transmits for or on behalf of the Practice. It includes Electronic PHI.
- "Patient Data" means the PHI Sonty receives in providing the Services, which may include patient names, mobile phone numbers, text-message consent settings, appointment dates and times, recall due dates, completed and scheduled procedure codes, and the content of text messages between patients and the Practice.
- "Services" has the meaning in Section 1.
3. Permitted uses and disclosures
3.1 Services. Sonty may use and disclose PHI only as needed to provide the Services to the Practice, which are:
- Sending appointment reminders and confirmation requests by text, and recording the patient's reply.
- Sending recall reminders to patients due or overdue for a visit.
- Sending review requests after a visit, if the Practice turns them on.
- Offering open appointment times and booking an appointment in the Practice's system when a patient asks by text.
- Estimating supply use from completed and scheduled procedures, and comparing the Practice's fees with area averages.
- Showing this information to the Practice's authorized users in the Sonty portal.
3.2 Minimum necessary. Sonty will request, use and disclose only the minimum PHI necessary for the purpose, following the Practice's minimum-necessary policies that it shares with Sonty.
3.3 Same limits as the Practice. Sonty will not use or disclose PHI in a way that would violate HIPAA if the Practice did it, except as Sections 3.4 and 3.5 allow.
3.4 Management and administration. Sonty may use PHI for its proper management and administration or to carry out its legal responsibilities. It may disclose PHI for those purposes only if the disclosure is Required By Law, or if Sonty first gets reasonable written assurances from the recipient that it will keep the PHI confidential, use or disclose it only as Required By Law or for the purpose it was disclosed, and notify Sonty of any instance it knows of in which confidentiality was breached.
3.5 De-identified and aggregated data. Sonty may de-identify PHI under 45 CFR 164.514(a) to (c) and use de-identified information to improve the Services, such as refining supplies-per-procedure estimates. Sonty will not perform Data Aggregation services combining the Practice's PHI with another covered entity's PHI unless the Practice agrees in writing.
3.6 Prohibited uses. Sonty will not:
- sell PHI, or receive anything of value in exchange for it;
- use or disclose PHI for marketing, or send any text to a patient that the Practice has not turned on;
- text a patient whose "OK to text" setting in the Practice's system is "No", or who has replied STOP, until they opt back in;
- use PHI to train any artificial intelligence model, or allow a Subcontractor to do so.
4. Sonty's obligations
4.1 Use only as allowed. Sonty will not use or disclose PHI except as this Agreement permits or as Required By Law.
4.2 Safeguards. Sonty will use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 CFR Part 164 (the Security Rule) for Electronic PHI, to prevent any use or disclosure not provided for by this Agreement. These include encrypting PHI in transit, limiting access to people who need it to run and support the Services, keeping a written security risk assessment, and training its workforce on HIPAA.
4.3 Reporting. Sonty will report to the Practice in writing:
- any use or disclosure of PHI not provided for by this Agreement, within 5 business days of discovering it;
- any Breach of Unsecured PHI, without unreasonable delay and within 5 business days of discovery. A Breach is discovered on the first day Sonty knows of it, or would have known by exercising reasonable diligence. The report will identify, as far as possible, each Individual affected, and include the other information the Practice needs to notify them, supplemented promptly as Sonty learns more;
- any Security Incident it becomes aware of, within 10 business days. This Section is notice, with no further notice required, of the ongoing unsuccessful attempts that are routine on the internet, such as pings, port scans, blocked sign-in attempts and denial-of-service attempts, as long as none results in unauthorized access to PHI.
4.4 Mitigation and breach costs. Sonty will take reasonable steps to lessen any harmful effect it knows of from a use or disclosure in violation of this Agreement. If a Breach is caused by Sonty or its Subcontractor, Sonty will reimburse the Practice's reasonable costs of legally required notifications to Individuals and regulators, and of credit monitoring if appropriate.
4.5 Subcontractors. Under 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), Sonty will make sure every Subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions, conditions and requirements that apply to Sonty under this Agreement. Exhibit A lists current Subcontractors. Sonty will give the Practice at least 30 days' notice before adding a Subcontractor that will receive PHI.
4.6 Patient access. Within 10 business days of the Practice's request, Sonty will make PHI it holds in a Designated Record Set available to the Practice so the Practice can meet its obligations under 45 CFR 164.524. If a patient asks Sonty directly, Sonty will forward the request to the Practice within 5 business days.
4.7 Amendment. Within 10 business days of the Practice's request, Sonty will make any amendment to PHI in a Designated Record Set that the Practice directs under 45 CFR 164.526. Because the Services read Patient Data from the Practice's own system, most amendments are made there by the Practice.
4.8 Accounting of disclosures. Sonty will document disclosures of PHI as needed for the Practice to respond to a request for an accounting under 45 CFR 164.528, and give that information to the Practice within 10 business days of its request.
4.9 Practice obligations Sonty carries out. To the extent Sonty carries out any of the Practice's obligations under Subpart E of 45 CFR Part 164, it will comply with the requirements of Subpart E that apply to the Practice for that obligation.
4.10 Access by HHS. Sonty will make its internal practices, books and records relating to PHI available to the Secretary of Health and Human Services to determine compliance with HIPAA.
4.11 Location. Sonty will store and process PHI only in the United States.
5. The Practice's obligations
5.1 Notice of privacy practices. The Practice will tell Sonty of any limitation in its notice of privacy practices that may affect Sonty's use or disclosure of PHI.
5.2 Changes and restrictions. The Practice will tell Sonty promptly of any change in, or revocation of, an Individual's permission to use or disclose PHI, and of any restriction it has agreed to under 45 CFR 164.522, to the extent it may affect Sonty's use or disclosure of PHI.
5.3 Consent to text. The Practice is responsible for having each patient's consent to receive texts before Sonty texts them, and for keeping the "OK to text" setting in its practice management system accurate.
5.4 Permissible requests. The Practice will not ask Sonty to use or disclose PHI in any way that would not be permitted under HIPAA if done by the Practice.
5.5 Only what's needed. The Practice will not send Sonty PHI beyond what the Services need. In particular, staff will not upload documents containing patient information (such as treatment records) through the supply invoice photo feature.
6. Term and termination
6.1 Term. This Agreement starts on the Effective Date and continues until the Underlying Agreement ends, unless ended earlier under Section 6.2.
6.2 Termination for breach. If either party learns of a pattern of activity or practice by the other that is a material breach of this Agreement, it will give written notice. If the breach is not cured within 30 days, the non-breaching party may terminate this Agreement and the Underlying Agreement. If cure is not possible, it may terminate immediately.
6.3 Return or destruction. Within 60 days after this Agreement ends, Sonty will return to the Practice, or destroy, all PHI it or its Subcontractors still hold, and keep no copies. Copies in encrypted backups will be destroyed on the normal backup schedule and stay protected under this Agreement until then. If returning or destroying any PHI is infeasible, Sonty will tell the Practice why, extend this Agreement's protections to that PHI, and limit further use and disclosure to the purposes that make return or destruction infeasible, for as long as Sonty keeps it.
6.4 Survival. Sections 3.4, 4.3, 4.4, 4.10 and 6.3 survive termination for as long as Sonty or its Subcontractors hold any PHI.
7. General terms
7.1 Amendment. The parties will amend this Agreement as needed to keep up with changes to HIPAA. Any other amendment must be in writing and agreed by both parties.
7.2 Interpretation. Any ambiguity will be resolved in favor of a meaning that complies with HIPAA. A reference to a HIPAA section means that section as in effect or as amended.
7.3 No third-party beneficiaries. Nothing in this Agreement gives any rights to anyone other than the parties and their permitted successors.
7.4 Notices. Notices under this Agreement go to the addresses in Section 1, or to the email address each party designates for privacy matters. A report under Section 4.3 must also be sent by email to the Practice's designated privacy contact.
7.5 Electronic signature. This Agreement may be signed electronically, and an electronic signature has the same effect as a handwritten one.
7.6 Governing law. This Agreement is governed by the law of the State of [state], except where HIPAA applies.
Exhibit A: Subcontractors
Subcontractors that create, receive, maintain or transmit PHI for Sonty, each bound by a written business associate agreement:
| Subcontractor | What it does | PHI it handles |
|---|
| [hosting provider] | Runs the Sonty application and stores its database | All Patient Data |
| Twilio | Sends and receives patient text messages | Patient mobile numbers, first names, appointment times and message content |