This BAA is available for Enterprise plan customers. Contact sales@findthebreach.com to execute a BAA.
This HIPAA Business Associate Agreement ("BAA") is entered into by and between Find The Breach ("Business Associate," "we," or "us") and the customer ("Covered Entity," "you," or "your") pursuant to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act of 2009 ("HITECH Act"), and their implementing regulations, including the HIPAA Privacy Rule (45 CFR Part 160 and Subparts A and E of Part 164), the HIPAA Security Rule (45 CFR Part 160 and Subparts A and C of Part 164), and the HIPAA Breach Notification Rule (45 CFR Part 160 and Subparts A and D of Part 164), collectively referred to as the "HIPAA Rules." This BAA supplements and forms part of the underlying service agreement between the parties for the provision of vulnerability scanning and penetration testing services (the "Service") and governs the use and disclosure of Protected Health Information ("PHI") that Business Associate may create, receive, maintain, or transmit on behalf of Covered Entity in connection with the Service.
1 Definitions
Capitalized terms used in this BAA and not otherwise defined shall have the meanings ascribed to them under the HIPAA Rules. The following definitions apply:
Protected Health Information (PHI)
Individually identifiable health information, in any form or medium, that is created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity, as defined under 45 CFR §160.103.
Electronic Protected Health Information (ePHI)
PHI that is created, received, maintained, or transmitted in electronic media, as defined under 45 CFR §160.103.
Covered Entity
The customer, being a health plan, health care clearinghouse, or health care provider that transmits health information in electronic form in connection with a transaction covered by HIPAA, as defined under 45 CFR §160.103.
Business Associate
Find The Breach, which performs certain functions or activities on behalf of, or provides certain services to, Covered Entity that involve the use or disclosure of PHI, as defined under 45 CFR §160.103.
Breach
The acquisition, access, use, or disclosure of PHI in a manner not permitted under the HIPAA Privacy Rule which compromises the security or privacy of the PHI, as defined under 45 CFR §164.402.
Security Incident
The attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system, as defined under 45 CFR §164.304.
Subcontractor
A person or entity to whom Business Associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of such Business Associate.
2 Permitted Uses and Disclosures of PHI
Business Associate shall not use or disclose PHI other than as permitted or required by this BAA or as required by law. Business Associate is permitted to use and disclose PHI solely for the following purposes:
- To perform vulnerability scanning, penetration testing, and related security assessment services on behalf of Covered Entity as described in the underlying service agreement
- To carry out the legal responsibilities of Business Associate, including compliance with the HIPAA Rules
- For the proper management and administration of Business Associate, provided that such disclosures are required by law or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purpose for which it was disclosed
Business Associate shall not use or disclose PHI in a manner that would violate the HIPAA Rules if done by Covered Entity, except as expressly permitted under this Section. Business Associate shall not use or disclose PHI for marketing purposes, sell PHI, or use PHI for underwriting purposes.
3 Obligations of Business Associate
Business Associate agrees to the following obligations:
3.1 Safeguards
Business Associate shall implement and maintain appropriate administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI that it creates, receives, maintains, or transmits on behalf of Covered Entity, as required by the HIPAA Security Rule. Business Associate shall comply with the applicable requirements of 45 CFR Part 164, Subpart C, with respect to ePHI.
3.2 Reporting
Business Associate shall report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which Business Associate becomes aware, including any Breach of Unsecured PHI and any Security Incident, in accordance with Section 4 of this BAA.
3.3 Subcontractors
Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree in writing to the same restrictions, conditions, and requirements that apply to Business Associate under this BAA with respect to such PHI, in accordance with 45 CFR §164.502(e)(1)(ii) and §164.308(b)(2).
3.4 Access to PHI
To the extent Business Associate maintains a Designated Record Set on behalf of Covered Entity, Business Associate shall make PHI maintained in such Designated Record Set available to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 CFR §164.524, within fifteen (15) business days of receiving a written request from Covered Entity.
3.5 Amendment of PHI
To the extent Business Associate maintains a Designated Record Set on behalf of Covered Entity, Business Associate shall make PHI available for amendment and shall incorporate any amendments to PHI as directed by Covered Entity pursuant to 45 CFR §164.526, within fifteen (15) business days of receiving a written request from Covered Entity.
3.6 Accounting of Disclosures
Business Associate shall make available the information required to provide an accounting of disclosures to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 CFR §164.528, within thirty (30) days of receiving a written request from Covered Entity.
3.7 Government Access
Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining Covered Entity's compliance with the HIPAA Rules.
3.8 Minimum Necessary
Business Associate shall, to the extent practicable, limit its use, disclosure, or request of PHI to the minimum necessary to accomplish the intended purpose of such use, disclosure, or request, in accordance with 45 CFR §164.502(b).
4 Breach Notification
Business Associate shall report to Covered Entity any Breach of Unsecured PHI without unreasonable delay and in no event later than forty-eight (48) hours after discovery of such Breach, in accordance with the requirements of 45 CFR §164.410 and the HITECH Act. A Breach shall be treated as discovered by Business Associate as of the first day on which such Breach is known to Business Associate or, by exercising reasonable diligence, would have been known to Business Associate.
The notification to Covered Entity shall include, to the extent reasonably available:
- The identification of each individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired, used, or disclosed during the Breach
- A description of the nature of the Breach, including the types of Unsecured PHI involved
- A description of what Business Associate has done or is doing to investigate the Breach, mitigate harm to individuals, and protect against further Breaches
- Any other details necessary for Covered Entity to fulfill its notification obligations under 45 CFR §§164.404 through 164.408
Business Associate shall cooperate with Covered Entity in investigating any Breach and shall provide reasonable assistance to Covered Entity in meeting its obligations under the HIPAA Breach Notification Rule, including any required notifications to affected individuals, the Secretary of HHS, and the media.
Business Associate shall also report to Covered Entity any Security Incident of which Business Associate becomes aware. The parties acknowledge that unsuccessful Security Incidents (such as pings, port scans, unsuccessful log-on attempts, or denial-of-service attacks that do not result in unauthorized access, use, or disclosure of PHI) occur routinely, and Business Associate shall provide notice of such unsuccessful incidents upon request.
5 Term and Termination
This BAA shall become effective on the date it is executed by both parties and shall remain in effect for the duration of the underlying service agreement, unless earlier terminated in accordance with this Section.
Either party may terminate this BAA and the underlying service agreement if the other party materially breaches any provision of this BAA and fails to cure such breach within thirty (30) days after receiving written notice of the breach. If cure is not reasonably possible, the non-breaching party may terminate this BAA immediately upon written notice.
Covered Entity may terminate this BAA immediately if Covered Entity determines that Business Associate has violated a material term of this BAA and cure is not possible. Upon any determination that Business Associate has breached a material term of this BAA, Covered Entity shall have the right, at its sole discretion, to either terminate this BAA and the underlying service agreement or, if termination is not feasible, report the breach to the Secretary of HHS.
6 Obligations Upon Termination
Upon termination of this BAA for any reason, Business Associate shall:
- Return to Covered Entity or destroy all PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity, that Business Associate still maintains in any form, and retain no copies of such PHI
- If return or destruction is not feasible, extend the protections of this BAA to such PHI and limit further uses and disclosures to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such PHI
- Provide written certification to Covered Entity of the destruction of PHI within thirty (30) days of termination, where destruction is feasible
The obligations of Business Associate under this Section shall survive termination of this BAA.
7 Covered Entity Obligations
Covered Entity agrees to the following obligations in connection with this BAA:
- Covered Entity shall notify Business Associate of any limitations in its Notice of Privacy Practices under 45 CFR §164.520, to the extent that such limitation may affect Business Associate's use or disclosure of PHI
- Covered Entity shall notify Business Associate of any changes in, or revocation of, permission by an individual to use or disclose PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI
- Covered Entity shall notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR §164.522, to the extent that such restriction may affect Business Associate's use or disclosure of PHI
- Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Covered Entity, except as expressly permitted in this BAA
- Covered Entity represents and warrants that it has obtained all necessary consents, authorizations, and permissions required under applicable law for the disclosure of PHI to Business Associate in connection with the Service
8 Limitations and Scope of Services
The parties acknowledge and agree that Find The Breach's security scanning and penetration testing services are not designed to intentionally access, store, or process Protected Health Information. The Service is directed at identifying security vulnerabilities in Covered Entity's systems and infrastructure. Any exposure to PHI during the course of providing the Service is incidental in nature.
This BAA is provided to address the possibility of incidental exposure to PHI that may occur during authorized security assessments. Notwithstanding anything to the contrary in this BAA:
- Business Associate does not intentionally access, index, copy, or retain PHI encountered during vulnerability scans or penetration tests
- Scan results and reports generated by the Service are designed to capture technical vulnerability data, not the content of health records or PHI
- Covered Entity is responsible for configuring its systems and access controls to minimize the exposure of PHI during security assessments
- Business Associate employs technical measures to minimize the retention of any data that may constitute PHI incidentally encountered during scans
Covered Entity acknowledges that the effectiveness of the safeguards described in this BAA is limited to the extent that Business Associate does not intentionally access or process PHI. Covered Entity is encouraged to implement appropriate de-identification or data segmentation measures before initiating security assessments on systems containing PHI.
9 General Provisions
Regulatory References. Any reference in this BAA to a section of the HIPAA Rules shall mean the section as in effect or as amended from time to time, and any comparable successor provisions.
Amendment. The parties agree to take such action as is necessary to amend this BAA from time to time as is necessary for compliance with the requirements of the HIPAA Rules and any other applicable law.
Interpretation. Any ambiguity in this BAA shall be resolved in favor of a meaning that permits both parties to comply with the HIPAA Rules.
No Third-Party Beneficiaries. Nothing express or implied in this BAA is intended to confer, nor shall anything herein confer, upon any person other than the parties and their respective successors and assigns, any rights, remedies, obligations, or liabilities whatsoever.
Entire Agreement. This BAA, together with the underlying service agreement and any attachments, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior negotiations, representations, and agreements relating to this subject matter.
10 Contact Information
For questions, concerns, or requests related to this Business Associate Agreement or HIPAA compliance, please contact:
To execute a BAA or inquire about Enterprise plan eligibility:
Email: sales@findthebreach.com
Download & Execute This BAA
Healthcare organizations can download this BAA for internal review and execution. Enterprise plan customers receive a countersigned copy.
⚠️ Important: This BAA must be executed (signed by both parties) before Find The Breach processes any systems containing Protected Health Information. A signed BAA is required for HIPAA compliance. Enterprise plan required.