CONCEPT #35 OF 100 · Medical, Dental & Clinical Practices · LAYOUT: pleading_caption
HIPAA Business Associate Agreement (BAA) & ePHI Encryption Security Schedule
Standard / Reference: 45 C.F.R. §§ 164.308, 164.312 & 164.504(e) · HITECH Act 42 U.S.C. § 17932
Why professionals use this template: Healthcare practices and health-tech vendors needing a clear, non-bloated HIPAA/HITECH BAA specifying breach notification timelines, AES-256/TLS 1.3 encryption, and PHI return/destruction.
144-DPI VECTOR PREVIEW · PAGE 1 OF 1
ACROFORM READY
Included Financial Metrics & Line-Item Schedule
Target Roles: Healthcare SaaS Vendors, Medical Billing Companies, EHR Consultants & Covered Entities · Search Keywords: hipaa business associate agreement baa template pdf 45 cfr 164.504, ephi security rule safeguard schedule, hitech breach notification timeline clause, subcontractor baa flow down agreement
ENCRYPTION AT REST / TRANSIT
AES-256-GCM / TLS 1.3
BREACH NOTICE SLA
Within 5 Business Days
SUBCONTRACTOR FLOW-DOWN
100% Written BAA Req
PHI AI TRAINING POLICY
STRICTLY PROHIBITED
| CODE | DESCRIPTION & TECHNICAL SPECIFICATION | BASIS / QTY | AMOUNT / DELTA |
|---|---|---|---|
| SEC-312A | 45 C.F.R. § 164.312(a) Access Control: Unique User IDs, Hardware MFA & Automatic 15-Min Logoff | Technical Safeguard | MANDATORY |
| SEC-312B | 45 C.F.R. § 164.312(b) Audit Controls: Immutable 6-Year Access Logs of All ePHI Reads/Exports | 6-Yr Retention | MANDATORY |
| NTC-410 | 45 C.F.R. § 164.410 Breach Notification: Immediate Notice (Max 5 Days) of Any Unsecured PHI Incident | Strict Notice Window | MANDATORY |
| TRM-504 | 45 C.F.R. § 164.504(e)(2)(ii)(J) Termination: Cryptographic Erasure (NIST 800-88) Within 30 Days | Post-Termination | MANDATORY |
Related Medical, Dental & Clinical Practices Templates
- #31 — Out-of-Network Medical & Physical Therapy Superbill (CPT / ICD-10 / NPI) (CMS-1500 Data Element Alignment · NPI Registry Type 1/2 · HSA/FSA IRC § 213(d) Receipt)
- #32 — No Surprises Act Good Faith Estimate (GFE) for Uninsured / Self-Pay Patients (Public Health Service Act § 2799B-6 · 45 C.F.R. § 149.610 ($400 PPDR Threshold Notice))
- #33 — Dental Implant & Prosthodontic Treatment Plan + Insurance Copay Breakdown (ADA CDT-2026 Procedure Codes · PPO Contracted Fee Schedule · Informed Financial Consent)
- #34 — Direct Primary Care (DPC) & Longevity Clinic Membership Agreement (State Direct Primary Care Medical Home Act · IRC § 223(c)(1)(B) HSA Eligibility Disclosure)
- #76 — Forensic Chain of Custody (CoC) Evidence Transfer Log & Tamper-Seal Audit (Fed. R. Evid. 901(a) · ISO/IEC 17025:2017 Forensic Standards · CJIS Security Policy)
- #77 — Clinical Trial Informed Consent Form (ICF) & FDA GCP Subject Visit Schedule (21 C.F.R. Part 50 (Protection of Human Subjects) · ICH GCP E6(R2) · 45 C.F.R. § 46.116)
- #78 — Analytical Laboratory Certificate of Analysis (COA) & HPLC Assay Specification (21 C.F.R. § 211.165 (Testing & Release for Distribution) · USP <232>/<233> · ISO/IEC 17025)
- #79 — Compounding Pharmacy Master Formulation Record & USP <797>/<800> Sterile Batch Log (USP General Chapters <797> & <800> · FD&C Act § 503A / § 503B (21 U.S.C. § 353a/b))
- #80 — CLIA High-Complexity Clinical Diagnostic Pathology Report & Critical Value Log (42 C.F.R. Part 493 (CLIA '88 High-Complexity Standards) · CAP Laboratory Accreditation)
- #98 — Advance Healthcare Directive, Living Will & HIPAA Medical Surrogate Designation (Uniform Health-Care Decisions Act (UHCDA) · 45 C.F.R. § 164.508 (HIPAA) · 42 U.S.C. § 1395cc PSDA)