Business Associate Agreement (BAA) Information

1. When a BAA May Apply

A BAA may apply when LiverDirectory provides services to a healthcare provider or other HIPAA Covered Entity and, in connection with those services, LiverDirectory creates, receives, maintains, or transmits PHI on behalf of that Covered Entity.

Not every service provided by LiverDirectory, and not every relationship with a healthcare provider, creates a Business Associate relationship under HIPAA.

Whether a BAA is required depends on the nature of the services provided, the information involved, and the Parties’ respective roles under HIPAA and applicable law.

Where a Business Associate relationship exists and a BAA is required, LiverDirectory will work with the applicable Covered Entity to establish appropriate contractual arrangements addressing the Parties’ HIPAA-specific obligations.

2. Protected Health Information

For purposes of HIPAA, Protected Health Information (“PHI”) generally means individually identifiable health information that is created, received, maintained, or transmitted by a Covered Entity or Business Associate, subject to the definitions and exclusions under applicable law.

When LiverDirectory acts as a Business Associate, PHI received or maintained on behalf of the Covered Entity will be handled in accordance with the applicable BAA, HIPAA, and other applicable privacy and security requirements.

3. Permitted Uses and Disclosures

When acting as a Business Associate, LiverDirectory may use or disclose PHI only as permitted or required by the applicable BAA, the services agreement with the Covered Entity, HIPAA, or other applicable law.

LiverDirectory may use or disclose PHI as reasonably necessary to provide the services for which it has been engaged by the Covered Entity.

LiverDirectory may also use or disclose PHI where required by law or where otherwise permitted under HIPAA and the applicable BAA.

LiverDirectory will not use or disclose PHI in a manner that would violate the HIPAA Privacy Rule if done by the Covered Entity, except as otherwise permitted by HIPAA.

4. Minimum Necessary Information

Where the HIPAA minimum necessary standard applies, LiverDirectory will make reasonable efforts to limit its use, disclosure, and requests for PHI to the minimum amount necessary to accomplish the intended purpose, consistent with applicable law and the terms of the applicable BAA.

5. Privacy and Security Safeguards

LiverDirectory takes reasonable and appropriate measures to protect information in its possession or control.

When LiverDirectory acts as a Business Associate and handles Electronic Protected Health Information (“ePHI”), LiverDirectory will implement safeguards required by the applicable HIPAA Security Rule provisions.

These safeguards may include administrative, physical, and technical measures designed to protect PHI against unauthorized access, use, disclosure, alteration, or destruction.

Access to PHI will be limited to individuals and service providers who require access for authorized purposes, subject to applicable law and contractual requirements.

6. Breach and Security Incident Notification

LiverDirectory will address unauthorized uses or disclosures of PHI, Breaches of Unsecured PHI, and applicable Security Incidents in accordance with HIPAA and the terms of the applicable BAA.

Where required, LiverDirectory will notify the Covered Entity of a Breach or other reportable incident within the timeframe required by applicable law and the applicable BAA.

LiverDirectory will reasonably cooperate with the Covered Entity in investigating, mitigating, and addressing applicable privacy or security incidents.

7. Individual Rights

When LiverDirectory maintains PHI on behalf of a Covered Entity and the HIPAA requirements concerning individual rights apply, LiverDirectory will reasonably assist the Covered Entity in meeting its obligations under HIPAA.

This may include providing appropriate assistance concerning:

• Access to PHI;
• Requests to amend PHI;
• Accounting of certain disclosures; and
• Other individual rights applicable under HIPAA.

Individuals should generally direct requests concerning their PHI to the applicable healthcare provider or Covered Entity. Where appropriate, LiverDirectory may assist the Covered Entity in responding to such requests.

8. Subcontractors and Service Providers

LiverDirectory may use third-party service providers or subcontractors to provide technology, hosting, security, communications, support, or other services.

Where a subcontractor creates, receives, maintains, or transmits PHI on behalf of LiverDirectory, LiverDirectory will require appropriate contractual protections concerning PHI as required by HIPAA and applicable law.

LiverDirectory will take reasonable steps to ensure that applicable subcontractors maintain appropriate safeguards for PHI.

9. Return or Destruction of PHI

When a Business Associate relationship ends, LiverDirectory will address PHI in accordance with the applicable BAA and HIPAA requirements.

Where required and feasible, LiverDirectory will return or securely destroy PHI.

If return or destruction is not feasible, LiverDirectory will continue to protect the retained PHI and limit its use and disclosure as required by HIPAA and applicable law.

10. Other Privacy Laws

HIPAA may not apply to every type of information collected or processed through LiverDirectory.

Depending on the circumstances, other federal, state, provincial, territorial, or international privacy laws may also apply.

LiverDirectory maintains separate privacy practices addressing applicable personal information and consumer privacy requirements. These may include requirements under applicable U.S. state privacy laws, the Washington My Health My Data Act, Canada's Personal Information Protection and Electronic Documents Act (“PIPEDA”), and Québec privacy legislation, including requirements introduced by Law 25, where applicable.

Compliance with HIPAA does not replace or limit other privacy obligations that may apply to LiverDirectory.

11. Relationship to the Privacy Policy

This BAA information page should be read together with the LiverDirectory Privacy Policy & HIPAA Notice and Terms & Conditions.

The Privacy Policy explains how LiverDirectory collects, uses, discloses, retains, and protects personal information and other information through its Services, including technical information such as IP addresses that may be collected when users access the Services or interact with forms, communications, and other features.

Where a separate BAA has been entered into between LiverDirectory and a Covered Entity, that BAA will govern the Parties’ specific HIPAA obligations concerning PHI to the extent provided in the BAA.

12. Changes to This BAA Information

LiverDirectory may update this page from time to time to reflect changes in its services, privacy practices, legal requirements, or regulatory guidance.

Any material changes will be reflected by updating the “Last Updated” date above.

Where a separate BAA is in place with a Covered Entity, amendments to that BAA will be handled in accordance with the terms of the applicable agreement.

13. Contact Us

If you have questions about LiverDirectory’s Business Associate practices, HIPAA, or the handling of PHI, you may contact us: