Business Associate Agreement
(BAA) – OrthoAlign Solution
Effective Date: Effective upon acceptance
Last Updated: October 15, 2026
This Business Associate Agreement (“Agreement” or “BAA”) establishes the terms and conditions governing the use, disclosure, storage, transmission, and protection of Protected Health Information (“PHI”) by OrthoAlign Solution when providing services to a HIPAA Covered Entity or another authorized healthcare organization.
By subscribing to our services, creating an account, or clicking “I Accept” during the registration process, you acknowledge that you have read, understood, and agreed to the terms of this Business Associate Agreement. This Agreement forms a legally binding agreement between you, the Covered Entity, and OrthoAlign Solution, acting as the Business Associate, to the extent applicable under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (“HITECH Act”), and their implementing regulations.
This Agreement supplements our Terms of Service and Privacy Policy. If there is a conflict between this Agreement and another agreement concerning the handling, use, or disclosure of PHI, this Agreement will control with respect to PHI, to the extent required by applicable law.
1. Recitals and Purpose of the Agreement
1.1 Services Provided by OrthoAlign Solution
OrthoAlign Solution provides services as described in our Terms of Service. Depending on the services purchased or used by the Covered Entity, these services may involve the processing, management, storage, organization, transmission, or other handling of information relating to patients, healthcare providers, or healthcare operations.
In connection with these services, OrthoAlign Solution may create, receive, maintain, or transmit PHI on behalf of the Covered Entity. The parties therefore acknowledge the need to establish appropriate safeguards and contractual obligations to protect the confidentiality, integrity, and availability of PHI.
1.2 HIPAA Compliance
The parties intend for this Agreement to satisfy the applicable requirements of HIPAA, including the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule, as well as the applicable provisions of the HITECH Act and related federal regulations.
OrthoAlign Solution agrees to perform its Business Associate obligations in accordance with applicable law and the terms of this Agreement. The Covered Entity remains responsible for its own HIPAA compliance obligations, including its duties concerning patient rights, privacy practices, and disclosures of PHI.
1.3 Mutual Understanding
Both parties acknowledge that the proper handling of PHI is essential to protecting patient privacy and maintaining trust in healthcare-related services. Each party agrees to cooperate in good faith to fulfill its respective obligations under this Agreement and applicable law.
1.4 Scope and Application
This Agreement applies to PHI that OrthoAlign Solution creates, receives, maintains, or transmits on behalf of the Covered Entity in connection with the services provided. It does not authorize the use or disclosure of PHI for purposes that are prohibited by HIPAA or this Agreement.
2. Definitions
For purposes of this Agreement, the following definitions apply. Terms not expressly defined in this section will have the meanings assigned to them under HIPAA and its implementing regulations.
2.1 Protected Health Information (PHI)
“Protected Health Information” or “PHI” means individually identifiable health information, as defined under 45 CFR § 160.103, that is created, received, maintained, or transmitted by OrthoAlign Solution on behalf of the Covered Entity, in any form or medium, including electronic, written, or oral information.
PHI may include patient names, contact details, medical histories, treatment information, insurance information, healthcare identifiers, and other information that identifies an individual or could reasonably be used to identify an individual in connection with health information.
2.2 Electronic Protected Health Information (ePHI)
“Electronic Protected Health Information” or “ePHI” means PHI that is transmitted by or maintained in electronic media, as defined under the HIPAA Security Rule.
2.3 Covered Entity
“Covered Entity” means a healthcare provider, health plan, healthcare clearinghouse, or other organization that meets the definition of a covered entity under 45 CFR § 160.103 and engages OrthoAlign Solution to perform services involving PHI.
2.4 Business Associate
“Business Associate” means OrthoAlign Solution when it performs functions or activities involving PHI on behalf of the Covered Entity, as defined under HIPAA.
2.5 Individual
“Individual” means the person who is the subject of PHI and includes a personal representative recognized under applicable HIPAA regulations.
2.6 HIPAA Rules
“HIPAA Rules” means the applicable administrative simplification regulations issued under HIPAA, including the Privacy Rule, Security Rule, Breach Notification Rule, and Enforcement Rule, as amended from time to time.
2.7 Security Incident
“Security Incident” means an attempted or successful unauthorized access, use, disclosure, modification, or destruction of information, or interference with information systems, as defined under the HIPAA Security Rule.
2.8 Breach
“Breach” means the acquisition, access, use, or disclosure of PHI in a manner not permitted under the HIPAA Privacy Rule that compromises the security or privacy of the PHI, subject to the applicable exceptions and risk assessment requirements under 45 CFR § 164.402.
2.9 Subcontractor
“Subcontractor” means a person or entity engaged by OrthoAlign Solution to perform functions, activities, or services on its behalf that involve the creation, receipt, maintenance, or transmission of PHI.
2.10 Designated Record Set
“Designated Record Set” has the meaning assigned under 45 CFR § 164.501 and includes records maintained by or for a Covered Entity that are used, in whole or in part, to make decisions about individuals, to the extent applicable to the services provided.
3. Permitted Uses and Disclosures of PHI
3.1 General Authorization
OrthoAlign Solution may use or disclose PHI only as necessary to provide the contracted services, fulfill its obligations under this Agreement, comply with applicable law, or perform other activities expressly permitted by HIPAA and this Agreement.
All permitted uses and disclosures must remain within the scope of the services provided to the Covered Entity and must be consistent with the minimum necessary requirements where applicable.
3.2 Service Delivery
OrthoAlign Solution may use PHI to perform the functions, activities, and services agreed upon with the Covered Entity, including applicable administrative, technical, operational, and support activities necessary to deliver those services.
Such activities may include processing information submitted by the Covered Entity, maintaining service functionality, providing customer support, troubleshooting service-related issues, and performing authorized data management activities.
3.3 Internal Administration and Legal Responsibilities
OrthoAlign Solution may use PHI for the proper management and administration of its operations and to fulfill its legal responsibilities, but only where permitted by HIPAA.
Disclosures for these purposes will be made only where required by law or where the applicable conditions under 45 CFR § 164.504(e)(4) are satisfied, including any required assurances concerning confidentiality and reporting of unauthorized uses or disclosures.
3.4 Prohibited Uses and Disclosures
OrthoAlign Solution will not use or disclose PHI in a manner that would violate the HIPAA Privacy Rule if performed by the Covered Entity, except for uses and disclosures expressly permitted for a Business Associate under HIPAA.
OrthoAlign Solution will not sell PHI, use PHI for unrelated commercial purposes, or disclose PHI to unauthorized third parties unless the disclosure is permitted by applicable law and this Agreement.
3.5 Minimum Necessary Standard
Where applicable, OrthoAlign Solution will make reasonable efforts to limit its use, disclosure, and requests for PHI to the minimum necessary to accomplish the intended purpose, consistent with 45 CFR §§ 164.502(b) and 164.514(d).
3.6 De-Identified Information
Where permitted by HIPAA and the applicable service agreement, OrthoAlign Solution may create or use information that has been properly de-identified in accordance with 45 CFR § 164.514.
Information that has been de-identified in accordance with applicable HIPAA requirements is not PHI under the HIPAA Privacy Rule. OrthoAlign Solution will not treat identifiable PHI as de-identified unless the applicable regulatory requirements have been satisfied.
4. Obligations of OrthoAlign Solution as a Business Associate
OrthoAlign Solution acknowledges its responsibilities as a Business Associate and agrees to comply with the requirements applicable to its handling of PHI.
4.1 Safeguarding PHI
OrthoAlign Solution will implement and maintain reasonable and appropriate safeguards to prevent the use or disclosure of PHI other than as permitted by this Agreement or required by law.
These safeguards will be appropriate to the nature of the services, the information processed, the risks identified, and the applicable HIPAA requirements.
4.2 HIPAA Privacy Rule Compliance
To the extent applicable, OrthoAlign Solution will comply with the provisions of the HIPAA Privacy Rule that apply to Business Associates and will not use or disclose PHI except as permitted by this Agreement or required by law.
4.3 HIPAA Security Rule Compliance
OrthoAlign Solution will implement administrative, physical, and technical safeguards required by the HIPAA Security Rule for ePHI, including the applicable requirements of 45 CFR Part 164, Subpart C.
4.4 Workforce Training and Confidentiality
OrthoAlign Solution will take reasonable steps to ensure that workforce members who may access PHI are informed of their confidentiality responsibilities and receive appropriate privacy and security training based on their roles and responsibilities.
Access to PHI will be limited to authorized personnel who require access to perform their assigned duties.
4.5 Compliance Documentation
OrthoAlign Solution will maintain documentation concerning its applicable privacy and security policies, procedures, and compliance activities as required by law.
Where required under HIPAA, relevant documentation will be made available to the U.S. Department of Health and Human Services (“HHS”) for purposes of determining compliance with the HIPAA Rules.
5. Administrative, Physical, and Technical Safeguards
OrthoAlign Solution recognizes that protecting ePHI requires appropriate administrative, physical, and technical controls.
5.1 Administrative Safeguards
Administrative safeguards may include security risk analysis and risk management, workforce security procedures, access authorization, security awareness training, incident response procedures, contingency planning, and periodic evaluation of applicable security controls.
OrthoAlign Solution will implement the administrative safeguards required by the HIPAA Security Rule that are applicable to its operations and the services provided.
5.2 Physical Safeguards
OrthoAlign Solution will implement reasonable and appropriate physical safeguards designed to protect systems, facilities, devices, and other resources used to maintain or process ePHI, as applicable to its service environment.
Such safeguards may include appropriate facility access controls, workstation protections, device security procedures, and controls for the disposal or reuse of electronic media.
5.3 Technical Safeguards
OrthoAlign Solution will implement applicable technical safeguards designed to protect ePHI against unauthorized access, alteration, loss, or disclosure.
Depending on the services and systems involved, these measures may include access controls, authentication procedures, audit controls, integrity protections, secure transmission mechanisms, and encryption where appropriate or required.
5.4 Access Management
Access to PHI will be limited to authorized users based on legitimate operational requirements. OrthoAlign Solution will take reasonable steps to prevent unauthorized account access and to address access privileges when workforce roles or responsibilities change.
5.5 Risk Management and Evaluation
OrthoAlign Solution will conduct and document risk analysis and risk management activities as required by applicable HIPAA regulations. It will periodically evaluate its relevant security measures and address identified risks in accordance with applicable requirements.
5.6 No Absolute Security Guarantee
Although OrthoAlign Solution will implement the safeguards required by applicable law and this Agreement, no information system can be guaranteed to be completely secure. This statement does not limit any obligation imposed on OrthoAlign Solution by HIPAA, this Agreement, or other applicable law.
6. Reporting Security Incidents and Breaches
6.1 Reporting Unauthorized Uses or Disclosures
OrthoAlign Solution will notify the Covered Entity of any use or disclosure of PHI that is not permitted by this Agreement, including any Breach of Unsecured PHI, as required by applicable law and the timelines established in this section.
6.2 Security Incident Notification
OrthoAlign Solution will notify the Covered Entity in writing of a discovered Security Incident involving the Covered Entity’s PHI within five business days of discovery, unless a different reporting arrangement is expressly agreed to in writing and is consistent with applicable law.
Where appropriate, the parties may establish procedures for handling unsuccessful security events, such as unsuccessful login attempts, scans, or similar activities, that do not result in unauthorized access to PHI. Any such arrangement must be consistent with the HIPAA Security Rule and must not eliminate required breach reporting obligations.
6.3 Breach Notification
OrthoAlign Solution will notify the Covered Entity of a Breach of Unsecured PHI without unreasonable delay and no later than 30 calendar days after discovery of the Breach, unless a shorter deadline is required by applicable law or otherwise agreed to by the parties.
The notification will include, to the extent known and reasonably available:
- A description of the nature of the Breach.
- The date of the Breach and the date it was discovered, if known.
- The categories of PHI involved.
- The identities of affected individuals, where known or reasonably ascertainable.
- The steps taken or planned to investigate, mitigate, and address the incident.
- Any additional information reasonably necessary for the Covered Entity to meet its legal notification obligations.
If all information is not available at the time of the initial notification, OrthoAlign Solution will provide additional information as it becomes available, consistent with applicable law.
6.4 Discovery of a Breach
A Breach will be treated as discovered in accordance with the applicable HIPAA requirements, including the rules governing when a Breach is known or should reasonably have been known to the relevant person or organization.
6.5 Cooperation and Investigation
OrthoAlign Solution will reasonably cooperate with the Covered Entity in investigating reported incidents, determining the nature and extent of affected PHI, identifying affected individuals where possible, and supporting appropriate corrective actions.
6.6 Mitigation
OrthoAlign Solution will take reasonable and appropriate steps to mitigate, to the extent practicable, harmful effects known to it resulting from a use or disclosure of PHI in violation of this Agreement or applicable law.
6.7 Covered Entity Notification Duties
The Covered Entity remains responsible for determining and completing any notifications to affected individuals, HHS, the media, or other authorities that are legally required of the Covered Entity under the HIPAA Breach Notification Rule, except to the extent an obligation is expressly assigned to OrthoAlign Solution by applicable law or a written agreement.
7. Subcontractors and Third-Party Service Providers
7.1 Use of Subcontractors
OrthoAlign Solution may engage subcontractors to assist in providing services, provided that any subcontractor that creates, receives, maintains, or transmits PHI on behalf of OrthoAlign Solution is subject to the applicable contractual safeguards required by HIPAA.
7.2 Written Agreements
OrthoAlign Solution will enter into written agreements with applicable subcontractors requiring them to comply with restrictions and conditions that are substantially equivalent to those applicable to OrthoAlign Solution under this Agreement, as required by HIPAA.
These agreements will require appropriate safeguards for PHI and applicable reporting of unauthorized uses, disclosures, and Security Incidents or Breaches.
7.3 Responsibility for Subcontractors
OrthoAlign Solution will take reasonable steps to oversee its subcontractors’ compliance with their contractual obligations concerning PHI. OrthoAlign Solution remains responsible for its own obligations under this Agreement and applicable law.
7.4 Third-Party Disclosures
OrthoAlign Solution will not disclose PHI to a third party unless the disclosure is permitted by this Agreement, authorized by the Covered Entity where required, or otherwise permitted or required by applicable law.
8. Obligations of the Covered Entity
The Covered Entity acknowledges that HIPAA compliance requires cooperation between the parties and agrees to fulfill its applicable responsibilities.
8.1 Authority to Provide PHI
The Covered Entity represents that it has the authority to provide PHI to OrthoAlign Solution for the contracted services and that it will obtain any authorizations, consents, or other legal permissions required for its disclosures.
8.2 Permitted Requests
The Covered Entity will not request that OrthoAlign Solution use or disclose PHI in a manner that would violate HIPAA if performed by the Covered Entity, except as otherwise permitted under the HIPAA Rules.
8.3 Privacy Notices and Permissions
The Covered Entity is responsible for maintaining its applicable Notice of Privacy Practices and obtaining authorizations or permissions required for its own use and disclosure of PHI.
The Covered Entity will notify OrthoAlign Solution of any relevant restrictions or changes that affect the permitted use or disclosure of PHI, to the extent required by HIPAA and this Agreement.
8.4 Accuracy and Lawful Submission
The Covered Entity is responsible for the accuracy, completeness, and lawful submission of the information it provides, subject to any separate obligations OrthoAlign Solution has expressly accepted under the applicable service agreement.
8.5 Minimum Necessary Information
The Covered Entity will limit PHI submitted to OrthoAlign Solution to information reasonably necessary for the services being provided, where the minimum necessary standard applies.
8.6 Designated Contact
The Covered Entity will maintain appropriate contact information for privacy, security, and compliance communications and will promptly update that information when it changes.
9. Individual Access Requests and Amendments
9.1 Access to PHI
To the extent OrthoAlign Solution maintains PHI in a Designated Record Set on behalf of the Covered Entity, OrthoAlign Solution will make the PHI available to the Covered Entity as necessary to enable the Covered Entity to satisfy its obligations under 45 CFR § 164.524.
The parties will cooperate to address individual access requests within the timeframes required by applicable law.
9.2 Requests Received Directly from Individuals
If an individual contacts OrthoAlign Solution directly with a request to access PHI maintained on behalf of the Covered Entity, OrthoAlign Solution will forward the request to the Covered Entity within ten business days of receipt, unless a shorter period is required by applicable law or agreed to in writing.
OrthoAlign Solution will not independently approve or deny an access request on behalf of the Covered Entity unless authorized to do so and legally permitted.
9.3 Amendments to PHI
OrthoAlign Solution will make amendments to PHI in a Designated Record Set as directed by the Covered Entity, to the extent required by 45 CFR § 164.526 and applicable law.
The Covered Entity will determine whether an amendment request should be approved or denied. OrthoAlign Solution will reasonably assist with implementing an authorized amendment where the relevant information is maintained within its services.
9.4 Documentation and Cooperation
OrthoAlign Solution will provide reasonable assistance to the Covered Entity in locating relevant PHI and processing authorized requests, subject to applicable security controls, technical capabilities, and legal requirements.
10. Accounting of Disclosures
To the extent required under 45 CFR § 164.528, OrthoAlign Solution will make available information concerning disclosures of PHI that it maintains on behalf of the Covered Entity and that is necessary for the Covered Entity to respond to an individual’s request for an accounting of disclosures.
The parties will cooperate in identifying relevant disclosures and providing the information required by applicable law. OrthoAlign Solution will provide such information within a reasonable timeframe that allows the Covered Entity to meet its legal obligations.
11. Access by the Department of Health and Human Services
OrthoAlign Solution will make its internal practices, books, records, and relevant documentation relating to the use and disclosure of PHI available to HHS as required by applicable HIPAA regulations for purposes of determining compliance with the HIPAA Privacy Rule and other applicable requirements.
Nothing in this Agreement is intended to prevent either party from fulfilling its legal obligations to HHS or another authorized government agency.
12. Data Retention, Return, and Destruction of PHI
12.1 Retention During the Agreement
OrthoAlign Solution may retain PHI for as long as reasonably necessary to provide the contracted services and meet its obligations under this Agreement, applicable law, and relevant data retention requirements.
12.2 Return or Destruction Upon Termination
Upon termination of the services or this Agreement, OrthoAlign Solution will, if feasible and as required by HIPAA, return or securely destroy PHI received from or created on behalf of the Covered Entity that it maintains.
The parties will coordinate the return or destruction process, including the appropriate method and timing, taking into account the nature of the services and the technical requirements involved.
12.3 Infeasibility of Return or Destruction
If returning or destroying PHI is infeasible, OrthoAlign Solution will extend the protections of this Agreement to the retained PHI and limit further uses and disclosures to those purposes that make the return or destruction infeasible or that are otherwise required by law.
12.4 Backup Systems and Technical Limitations
Where PHI remains in backup systems, archives, or other systems from which immediate deletion is not reasonably feasible, OrthoAlign Solution will maintain appropriate protections and limit access and use until the information can be securely deleted or otherwise handled in accordance with applicable requirements.
12.5 Legal Retention Requirements
Nothing in this Agreement requires OrthoAlign Solution to destroy information where retention is required by applicable law. Any retained PHI will remain subject to the applicable confidentiality and security obligations.
13. Term and Termination
13.1 Effective Date
This Agreement becomes effective when the Covered Entity accepts it electronically or otherwise agrees to be bound by it, subject to the applicable registration or contracting process.
13.2 Term
This Agreement will remain in effect for as long as OrthoAlign Solution maintains PHI on behalf of the Covered Entity, unless terminated in accordance with this section.
13.3 Termination for Cause
If either party becomes aware of a material breach of this Agreement by the other party, the non-breaching party will provide written notice describing the breach and, where required or appropriate, a reasonable opportunity to cure it.
If the breach is not cured within the applicable period, the non-breaching party may terminate this Agreement or the affected services, subject to applicable law and any controlling agreement.
Where HIPAA requires the Covered Entity to terminate the arrangement if a Business Associate has violated a material term and the violation cannot be remedied, the parties will comply with the applicable regulatory requirements.
13.4 Termination Due to Legal Requirements
Either party may terminate this Agreement or the affected services where necessary to comply with applicable law, provided that the termination is carried out consistently with the parties’ legal obligations and any applicable contractual requirements.
13.5 Effect of Termination
Termination does not eliminate obligations relating to PHI that remain in the possession or control of OrthoAlign Solution. The provisions concerning safeguarding, permitted use, return or destruction, and any other surviving obligations will continue to apply for as long as required by applicable law or this Agreement.
14. Confidentiality and Restrictions on Disclosure
OrthoAlign Solution will treat PHI as confidential and will not disclose it except as authorized under this Agreement or permitted or required by applicable law.
Workforce members and applicable third parties who are authorized to access PHI must be subject to appropriate confidentiality and security obligations.
OrthoAlign Solution will take reasonable steps to prevent unauthorized disclosure and will respond to known violations in accordance with applicable policies, contractual obligations, and legal requirements.
15. Data Security Responsibilities and Cooperation
The parties acknowledge that maintaining the security of PHI requires ongoing cooperation.
Each party will be responsible for the security controls within its own environment and for the obligations assigned to it under this Agreement. Where an incident may affect both parties, they will cooperate in good faith to investigate and address the issue.
OrthoAlign Solution may request reasonable information from the Covered Entity to investigate incidents, verify authorized access, or fulfill its security responsibilities. The Covered Entity agrees to provide reasonable cooperation, subject to applicable law and its own confidentiality obligations.
16. Indemnification and Allocation of Responsibility
Each party remains responsible for its own acts, omissions, negligence, willful misconduct, and violations of applicable law, subject to the terms of any controlling agreement and applicable legal requirements.
Nothing in this Agreement is intended to eliminate a party’s obligations under HIPAA or to excuse a party from responsibility for its own breach of this Agreement.
Any indemnification obligations, limitations of liability, or allocation of damages will be governed by the applicable master agreement or Terms of Service, to the extent enforceable and consistent with applicable law.
17. Regulatory Changes and Updates
HIPAA regulations and related healthcare privacy requirements may change over time. The parties agree to comply with applicable legal requirements that govern their respective obligations.
If a change in law materially affects this Agreement, the parties will cooperate in good faith to make any amendments reasonably necessary to maintain compliance.
OrthoAlign Solution may update this Agreement in accordance with its applicable contractual procedures. Any update will not be interpreted as authorizing a use or disclosure of PHI that is prohibited by applicable law.
18. No Third-Party Beneficiaries
Except where applicable law provides otherwise, this Agreement is intended to govern the relationship between OrthoAlign Solution and the Covered Entity.
Nothing in this Agreement is intended to create additional contractual rights for third parties solely by virtue of this Agreement.
This section does not limit any rights that an individual may have under applicable law or any obligations that HIPAA imposes independently of this Agreement.
19. Governing Law and Dispute Resolution
This Agreement will be interpreted in accordance with applicable federal law, including HIPAA and its implementing regulations, and any applicable state law that is not preempted by federal law.
Any dispute concerning this Agreement will be handled in accordance with the dispute resolution and governing law provisions of the applicable Terms of Service or other controlling agreement, to the extent those provisions are enforceable and consistent with applicable law.
Nothing in this section limits the authority of HHS or another authorized government agency to exercise its legal powers.
20. Electronic Acceptance and Binding Agreement
By clicking “I Accept,” subscribing to the services, or otherwise electronically accepting this Agreement through an authorized registration or contracting process, the Covered Entity acknowledges that it has reviewed and agreed to the applicable terms.
The electronic acceptance will serve as evidence of agreement to the extent permitted by applicable law. The person accepting this Agreement on behalf of an organization represents that they are authorized to bind that organization to the Agreement.
The Covered Entity is responsible for maintaining accurate account information and ensuring that individuals accepting contractual terms on its behalf have appropriate authority.
21. Severability
If any provision of this Agreement is found to be invalid, unlawful, or unenforceable, that provision will be interpreted or limited to the extent necessary to make it enforceable where legally permissible.
If the provision cannot be made enforceable, it will be severed to the extent required, and the remaining provisions will continue in effect, provided that the remaining terms can operate consistently with the purpose of this Agreement and applicable law.
22. Entire Agreement and Order of Precedence
This Agreement, together with the applicable Terms of Service, Privacy Policy, and any other written agreements incorporated by reference, constitutes the agreement between the parties concerning the handling of PHI, subject to the terms of any applicable master agreement.
If a provision of the Terms of Service or another agreement conflicts with a requirement of this BAA concerning PHI, this BAA will control to the extent necessary to resolve the conflict and comply with applicable law.
Nothing in this Agreement is intended to reduce the protections required by HIPAA or any other applicable privacy or security law.
23. Contact Information and Privacy Inquiries
For questions concerning this Business Associate Agreement, HIPAA compliance, PHI handling, privacy practices, or the reporting of a suspected Security Incident, the Covered Entity should contact OrthoAlign Solution through its designated support or privacy contact channels.
Please include sufficient information to allow the request to be identified and routed appropriately. Do not submit unnecessary PHI or sensitive patient information through an unsecured communication channel.
Additional information about our services and privacy practices is available through the following resources:
24. Acknowledgment and Acceptance
By accepting this Business Associate Agreement, the Covered Entity acknowledges and agrees that:
- It has read and understood the terms of this Agreement.
- It is authorized to enter into this Agreement with OrthoAlign Solution.
- It will comply with its applicable obligations under HIPAA and other relevant laws.
- It will not request unauthorized uses or disclosures of PHI.
- It understands the procedures for reporting Security Incidents and Breaches.
- It agrees to cooperate with OrthoAlign Solution as reasonably necessary to protect PHI and fulfill applicable legal obligations.
Effective Upon Acceptance: This Agreement becomes effective when accepted by the Covered Entity through the applicable electronic or written acceptance process.
Organization: OrthoAlign Solution
Agreement Title: Business Associate Agreement (BAA)
Purpose: To establish the contractual requirements for protecting Protected Health Information in accordance with applicable HIPAA requirements.