Who needs one
Every practice, and every billing company working for practices, that puts protected health information into CollaboratMD. A billing company signs with us as its subcontractor, and with each practice it serves as that practice's business associate.
What it covers
The agreement contains what the HIPAA Privacy and Security Rules require of one (45 CFR 164.504(e) and 164.314(a)). In it we agree to:
- use and disclose protected health information only to provide the service, or as the law requires;
- apply administrative, physical and technical safeguards under the Security Rule;
- report any use or disclosure the agreement does not allow, including breaches of unsecured protected health information and security incidents;
- hold our own subcontractors that handle the information to the same restrictions, through agreements of their own;
- make the information available so you can meet patients' rights to access, amend and receive an accounting of disclosures;
- make our practices and records available to the Department of Health and Human Services on request;
- return or destroy the information when the service ends, where that is feasible.
The services we use to run CollaboratMD, and what each one handles, are listed in the trust center. How the system itself protects data is on the security page.
Before it is signed
You can set up a practice and try every feature with test data. The setup checklist keeps a reminder until the agreement is in place. Please do not enter real patient information until it is signed.
Requesting the agreement
Email hello@collaboratmd.com with your organization's legal name and the person who will sign. We send our agreement for your review. If your organization has its own form, send it and we will review it.