Draft · the BAA

Business Associate Agreement

Draft v1.3 · 2 October 2026 · for counsel review

This Business Associate Agreement ("Agreement") is entered into as of [EFFECTIVE DATE] ("Effective Date") by and between:

[PRACTICE LEGAL NAME], a [STATE] [entity type] with its principal place of business at [PRACTICE ADDRESS] ("Covered Entity"), and

Revalis Solutions LLC, a Wyoming limited liability company ("Business Associate").

Covered Entity and Business Associate are each a "Party" and together the "Parties."

RECITALS

A. Covered Entity is a covered entity as defined by the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, including the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164, as amended by the HITECH Act (collectively, "HIPAA").

B. Business Associate provides denied-claim review and appeal-preparation services to Covered Entity (the "Services"), in the course of which Business Associate may create, receive, maintain, or transmit Protected Health Information ("PHI") on behalf of Covered Entity.

C. The Parties enter into this Agreement to satisfy the business associate contract requirements of 45 CFR 164.502(e) and 164.504(e).

1. DEFINITIONS

Terms used but not otherwise defined in this Agreement have the meanings given to them in HIPAA. "PHI" means Protected Health Information as defined in 45 CFR 160.103, limited to the information created, received, maintained, or transmitted by Business Associate from or on behalf of Covered Entity.

2. PERMITTED USES AND DISCLOSURES

2.1. Business Associate may use and disclose PHI only as necessary to perform the Services: reviewing denied claims identified by Covered Entity's records; retrieving and analyzing the minimum necessary supporting documentation for claims Business Associate has identified to Covered Entity; preparing appeals, corrected claims, and related correspondence for submission to health plans on Covered Entity's behalf; and preparing statements and reports of that work for Covered Entity.

2.2. Business Associate may use PHI as necessary for its proper management and administration and to carry out its legal responsibilities, and may disclose PHI for such purposes only if the disclosure is required by law, or Business Associate obtains reasonable assurances from the recipient that the PHI will be held confidentially, used or further disclosed only as required by law or for the purposes for which it was disclosed, and that the recipient will notify Business Associate of any instances of which it is aware in which the confidentiality of the PHI has been breached.

2.3. Business Associate shall not use or disclose PHI other than as permitted by this Agreement or as required by law, and shall not use or disclose PHI in any manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, except as permitted under Section 2.2.

2.4. No sale; no marketing; no AI training. Business Associate shall not sell PHI, use PHI for marketing, or use PHI to train, fine-tune, improve, or evaluate any machine-learning or artificial-intelligence model, whether Business Associate's own or a third party's. PHI is processed by Business Associate's systems solely to perform the Services for Covered Entity, and this prohibition is not subject to any exception elsewhere in this Agreement.

2.5. Minimum necessary. Business Associate shall request from Covered Entity, and shall use and disclose, only the minimum PHI necessary to perform the Services. Business Associate shall identify to Covered Entity the specific claims for which supporting clinical documentation is requested and shall not request full-chart exports, or clinical or chart documentation of patients whose claims Business Associate is not working. Claim-level denial, accounts-receivable, and remittance exports used to identify Eligible Claims are within the minimum necessary.

2.6. De-identified information. Business Associate may de-identify PHI only by the safe-harbor method at 45 CFR 164.514(b)(2), only for the purpose of internal quality measurement of the Services performed for Covered Entity, shall retain no re-identification code, and shall not attempt re-identification. De-identified information remains subject to Section 2.4's prohibition on model training.

3. SAFEGUARDS

3.1. Business Associate shall use appropriate administrative, physical, and technical safeguards, and shall comply with Subpart C of 45 CFR Part 164 (the Security Rule) with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this Agreement.

3.2. Without limiting Section 3.1, Business Associate maintains: encryption of PHI in transit (TLS) and at rest; access limited to authenticated, logged sessions under named accounts; a complete audit trail of each claim accessed and each document created; and U.S.-based cloud infrastructure under a signed business associate agreement with its cloud provider. Business Associate's written security policies, risk analysis, and incident response plan are available to Covered Entity on request.

3.3. Insurance. Business Associate maintains professional (errors and omissions) liability insurance of not less than $1,000,000 per occurrence and $2,000,000 aggregate, and cyber liability insurance of not less than $250,000, in force before its receipt of any PHI and throughout the retention period in Section 9.3. A certificate of insurance, with any endorsements then in force, is delivered to Covered Entity at execution of this Agreement.

4. SUBCONTRACTORS

Business Associate shall ensure, in accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), that any subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to restrictions and conditions at least as restrictive as those that apply to Business Associate under this Agreement, including the prohibitions in Section 2.4. Business Associate's current subcontractor list is maintained in its compliance documentation and will be provided to Covered Entity on request; Business Associate will notify Covered Entity before adding a subcontractor that will handle PHI.

5. REPORTING

5.1. Business Associate shall report to Covered Entity any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, including breaches of unsecured PHI as required by 45 CFR 164.410, and any security incident of which it becomes aware.

5.2. Business Associate shall make the report required for a breach of unsecured PHI without unreasonable delay and in no case later than ten (10) business days after discovery, and the report shall include, to the extent known: the identity of each individual whose PHI was or is reasonably believed to have been involved; a description of what happened; the types of PHI involved; steps individuals should take to protect themselves; and what Business Associate is doing to investigate, mitigate, and prevent recurrence. Business Associate shall supplement the report as information becomes available.

5.3. For unsuccessful security incidents that do not result in unauthorized access to or acquisition of PHI (such as pings, port scans, and blocked intrusion attempts), the Parties agree this Section constitutes notice, and no further reporting is required.

6. INDIVIDUAL RIGHTS

6.1. Access. Business Associate shall, within ten (10) business days of request by Covered Entity, make available PHI in a designated record set to Covered Entity as necessary for Covered Entity to satisfy its obligations under 45 CFR 164.524.

6.2. Amendment. Business Associate shall, within ten (10) business days of request by Covered Entity, incorporate any amendment to PHI in a designated record set as directed by Covered Entity pursuant to 45 CFR 164.526.

6.3. Accounting. Business Associate shall document disclosures of PHI and information related to such disclosures as required for Covered Entity to respond to a request for an accounting under 45 CFR 164.528, and shall provide that documentation to Covered Entity within ten (10) business days of request.

6.4. If an individual makes any of the foregoing requests directly to Business Associate, Business Associate shall forward the request to Covered Entity within five (5) business days and shall not respond directly except as directed by Covered Entity.

7. OBLIGATIONS OF COVERED ENTITY

7.1. Covered Entity shall notify Business Associate of any limitation in its notice of privacy practices, any change in or revocation of an individual's permission to use or disclose PHI, and any restriction on use or disclosure agreed to under 45 CFR 164.522, in each case to the extent it may affect Business Associate's use or disclosure of PHI.

7.2. Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under HIPAA if done by Covered Entity.

7.3. Covered Entity retains all responsibility for its relationships with health plans, including receipt of payments; Business Associate does not receive, hold, or transmit Covered Entity's funds.

8. GOVERNMENT ACCESS

Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received on behalf of, Covered Entity available to the Secretary of Health and Human Services for purposes of determining Covered Entity's compliance with HIPAA.

9. TERM AND TERMINATION

9.1. Term. This Agreement is effective as of the Effective Date and continues until the later of termination of the Services or the return or destruction of all PHI as provided in Section 9.3.

9.2. Termination for cause. Either Party may terminate this Agreement and the Services if the other Party materially breaches this Agreement and fails to cure the breach within thirty (30) days of written notice, or immediately if cure is not possible.

9.3. Return or destruction. Upon termination of the Services for any reason, Business Associate shall return or destroy all PHI that it maintains in any form, retain no copies, and confirm in writing to Covered Entity which was done and the date it was completed, except that submitted appeal packets, audit trails, and submission records are retained for seven (7) years after termination for legal and compliance purposes, remain subject to all protections of this Agreement throughout, and are then destroyed. If no service agreement is executed between the Parties within ninety (90) days of the Effective Date, Business Associate shall destroy all PHI it holds, including snapshot analyses and their audit trails, within thirty (30) days thereafter and certify destruction in writing. If return or destruction is infeasible for particular PHI, Business Associate shall notify Covered Entity of the conditions making it infeasible, and shall extend the protections of this Agreement to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for so long as it is maintained. Nothing in this Agreement permits Business Associate to continue performing Services, or to use PHI for any new purpose, after termination.

9.4. This Agreement imposes no minimum purchase, no fees, and no obligation on Covered Entity to proceed with any Services; it exists so that the Parties may lawfully exchange the information needed to evaluate and perform the Services.

10. MISCELLANEOUS

10.1. Regulatory references. A reference in this Agreement to a section of HIPAA means the section as in effect or as amended.

10.2. Amendment. The Parties agree to amend this Agreement as necessary to comply with changes in HIPAA. No other amendment is effective unless in writing and signed by both Parties.

10.3. Interpretation. Any ambiguity shall be resolved to permit compliance with HIPAA. In the event of a conflict between this Agreement and any service agreement between the Parties, this Agreement controls with respect to PHI.

10.4. No third-party beneficiaries. Nothing in this Agreement confers any rights on any person other than the Parties.

10.5. Governing law. This Agreement is governed by the laws of the State of [PRACTICE STATE], without regard to conflict-of-law principles, except to the extent preempted by federal law.

10.6. Notices. Notices under this Agreement shall be sent in writing to the signatories below at the addresses above, with copies by email to security@revalissolutions.com (Business Associate) and [PRACTICE EMAIL] (Covered Entity).

SIGNATURES

COVERED ENTITY — [PRACTICE LEGAL NAME]

Signature: ______________________ Name: ______________________ Title: ______________________ Date: ________

BUSINESS ASSOCIATE — Revalis Solutions LLC

Signature: ______________________ Name: Brendan Gamache Title: Manager Date: ________

← Back to the page for your attorney