Business Associate Agreement

1. Parties and acceptance

This Business Associate Agreement (“Agreement”) is between Chairside Payroll LLC, doing business as Chairside Payroll (“Business Associate” or “Chairside”), and the dental practice or organization that accepts it (“Covered Entity” or “Practice”).

Background. Chairside provides software that calculates provider compensation from the Practice's practice management system exports, and produces reports, pay statements and payroll files (the “Services”). Those exports can contain protected health information, so HIPAA requires this Agreement.

Acceptance. The Practice accepts this Agreement electronically when its authorized representative accepts it at sign-up, or selects “I agree” before any of the Practice's data is uploaded. Chairside records who accepted, the practice, the agreement version and the date and time. Electronic acceptance has the same effect as a written signature under the federal E-SIGN Act. This Agreement forms part of, and is governed by, Chairside's Terms of Service (the “Underlying Agreement”).

2. Definitions

Terms used but not defined here have the meanings given in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

1. Business Associate has the meaning in 45 CFR 160.103 and, in this Agreement, means Chairside.
2. Covered Entity has the meaning in 45 CFR 160.103 and, in this Agreement, means the Practice.
3. HIPAA Rules means the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Parts 160 and 164.
4. PHI means Protected Health Information that Chairside creates, receives, maintains or transmits on behalf of the Practice.

3. Obligations of Chairside

Chairside agrees to:

1. Limit use and disclosure. Not use or disclose PHI other than as permitted or required by this Agreement or as Required by Law.
2. Safeguard PHI. Use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 CFR Part 164 for electronic PHI, to prevent uses or disclosures not provided for here. These include encryption in transit and at rest, access limited to the Practice's authorized users with two-step verification available and enforceable by the Practice, and an audit log of changes to payroll data.
3. Report. Report to the Practice, at its account owner's email, any use or disclosure of PHI not provided for by this Agreement and any Security Incident of which it becomes aware; and any Breach of Unsecured PHI as required by 45 CFR 164.410, without unreasonable delay and no later than 10 business days after discovery, with the information the Practice needs for its own notifications. The parties agree this section is notice of unsuccessful Security Incidents that occur routinely, such as pings, port scans, blocked sign-in attempts and denial-of-service attempts that do not result in unauthorized access, for which no further notice is required.
4. Bind subcontractors. Ensure that any Subcontractor that creates, receives, maintains or transmits PHI on Chairside's behalf agrees to the same restrictions and conditions, under 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2). Chairside's only such Subcontractor at the date of this version is Amazon Web Services (hosting, database, sign-in, email and AI processing), under its own business associate addendum. Chairside will keep a current list available to the Practice on request.
5. Access. To the extent Chairside holds PHI in a Designated Record Set, make it available to the Practice within 10 business days of a request, so the Practice can meet 45 CFR 164.524.
6. Amendment. To the extent Chairside holds PHI in a Designated Record Set, make amendments the Practice directs under 45 CFR 164.526.
7. Accounting. Keep the information needed for the Practice to provide an accounting of disclosures under 45 CFR 164.528, and provide it within 10 business days of a request.
8. Practice obligations. Where Chairside carries out any of the Practice's obligations under Subpart E of 45 CFR Part 164, comply with the requirements that apply to the Practice.
9. Books and records. Make its internal practices, books and records available to the Secretary to determine compliance with the HIPAA Rules.

4. Permitted uses and disclosures

1. To provide the Services. Chairside may use and disclose PHI only as necessary to provide the Services under the Underlying Agreement.
2. Minimum necessary. Chairside will request, use and disclose only the minimum PHI necessary. The Services are designed for this: patient names are removed in the user's browser before an export is uploaded, and the Services use transaction identifiers, procedure codes, dates, provider identifiers and amounts.
3. No other use. Chairside will not use or disclose PHI in a way that would violate Subpart E of 45 CFR Part 164 if done by the Practice, except as permitted in 4.4 and 4.5. Chairside will not sell PHI, use it for marketing, or combine it with other practices' PHI (no Data Aggregation).
4. Management and administration. Chairside may use PHI for its proper management and administration or to carry out its legal responsibilities. It may disclose PHI for those purposes only if the disclosure is Required by Law, or Chairside obtains reasonable assurances that the recipient will keep it confidential, use or further disclose it only as Required by Law or for the purpose for which it was disclosed, and notify Chairside of any breach of its confidentiality.
5. De-identified data. Chairside may de-identify PHI in accordance with 45 CFR 164.514(a)–(c) and use de-identified information only to maintain and improve the Services. De-identified information is not PHI.

5. Obligations of the Practice

The Practice agrees to:

1. Notify Chairside of any limitation in its Notice of Privacy Practices under 45 CFR 164.520, to the extent it may affect Chairside's use or disclosure of PHI.
2. Notify Chairside of any change in, or revocation of, an individual's permission to use or disclose PHI, to the extent it may affect Chairside.
3. Notify Chairside of any restriction on the use or disclosure of PHI the Practice has agreed to under 45 CFR 164.522, to the extent it may affect Chairside.
4. Not ask Chairside to use or disclose PHI in any way that would not be permissible under Subpart E of 45 CFR Part 164 if done by the Practice.
5. Upload only the data the Services need, and manage its own users: grant access only to its workforce members who need it, and remove access promptly when it is no longer needed.

6. Term, termination and return of data

1. Term. This Agreement starts when the Practice accepts it and ends when the Underlying Agreement ends and all PHI has been returned or destroyed under 6.3, or protections are extended under 6.4.
2. Termination for cause. If Chairside breaches a material term of this Agreement, the Practice may give written notice. If Chairside does not cure the breach within 30 days, the Practice may terminate this Agreement and the Underlying Agreement.
3. Return or destruction. When the Underlying Agreement ends for any reason: for 90 days the Practice's account stays available read-only, so it can export the payroll runs, pay statements, reports and audit history its plan included (a free trial's runs are previews and aren't exported; the Practice is responsible for keeping any records it must retain by law, such as payroll records); within 30 days after that window, Chairside will destroy all PHI it maintains in any form, including PHI held by its Subcontractors, and retain no copies, with encrypted automated backups destroyed as they expire on their normal schedule, no later than 35 days after; and on request, Chairside will confirm destruction in writing.
4. When return or destruction is infeasible. If returning or destroying any PHI is infeasible, Chairside will tell the Practice why, extend the protections of this Agreement to that PHI, and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as Chairside keeps it.
5. Survival. Chairside's obligations under 6.3 and 6.4 survive the end of this Agreement.

7. General provisions

1. Regulatory references. A reference to a section of the HIPAA Rules means the section as in effect or as amended.
2. Amendment. The parties will amend this Agreement as needed to comply with changes to the HIPAA Rules or other applicable law. Chairside may publish an updated version; it applies to the Practice after 30 days' notice by email, and the Practice may terminate the Underlying Agreement during that period if it does not agree.
3. Interpretation. Any ambiguity in this Agreement is resolved in favor of a meaning that permits compliance with the HIPAA Rules.
4. Order of precedence. If this Agreement conflicts with the Underlying Agreement on the handling of PHI, this Agreement controls.
5. No third-party beneficiaries. Nothing in this Agreement gives any right to anyone other than the parties.
6. Notices. Notices to Chairside go to privacy@chairsidepayroll.com. Notices to the Practice go to the email of its account owner in the Services.
7. Governing law. This Agreement is governed by federal law and the laws of the State of California.