Adverity Business Associate Agreement ("BAA")

Our BAA in plain language

Talk legal to me - here is the full text of our BAA

Adverity may use or disclose PHI:

1. To perform the Services on behalf of the Customer, as specified in the Agreement.

2. As required by law.

3. For Adverity's own management and legal responsibilities, as long as:

a. The disclosure is required by law, or

b. Adverity obtains written assurances from the recipient that the PHI will be kept confidential and used only for the intended purpose or as required by law, and that the recipient will notify Adverity of any known breaches.

4. For data aggregation or de-identification if allowed by the Agreement.

Adverity shall make reasonable efforts to limit its use, disclosure, or request of PHI to the minimum necessary to accomplish the intended purpose.

Adverity will use appropriate security measures to protect PHI.

Adverity shall:

1. Implement appropriate administrative, physical, and technical safeguards to protect PHI.

2. Take reasonable steps, including by training its employees, to ensure compliance with this BAA.

Adverity will notify Customer promptly if PHI is breached or misused and cooperate with Customer to mitigate harmful effects.

Adverity shall:

1. Promptly report to Customer any use or disclosure of PHI not permitted by this Agreement, including any Breach of Unsecured PHI or Security Incident.

2. Notify Customer without undue delay and no later than 60 days from the discovery of the Breach.

3. Provide information required for Customer to meet its breach notification obligations under HIPAA.

4. Cooperate with Customer to mitigate any harmful effects and support any required notifications.

Adverity will ensure that subcontractors follow HIPAA protections for PHI.

If Adverity uses a subcontractor who will access PHI, it must:

1. Ensure the subcontractor agrees in writing to the same restrictions and safeguards required by this BAA and HIPAA.

2. Monitor the subcontractor's compliance with those requirements.

3. Remain responsible for any failure to comply with this BAA by the subcontractor.

Adverity will assist Customer with Patients’ and Authorities’ requests.

1. Patient Rights Support: Adverity agrees to:

a. Help Customer respond to patient requests to access their PHI without undue delay.

b. Support Customer in making any corrections to PHI at the patient’s request.

c. Inform Customer without undue delay of any requests received directly from patients.

2. Access for Oversight: Adverity will make its internal records related to PHI available to the Secretary of Health and Human Services if needed to determine HIPAA compliance.

Adverity shall document and make available to Customer, upon request, an accounting of disclosures of PHI as required by HIPAA.

Customer commits to comply with its legal obligations under HIPAA.

Customer agrees to:

1. Provide Adverity with its notice of privacy practices if they include any limitations that may affect Adverity’s use or disclosure of PHI.

2. Inform Adverity of any changes in, or revocation of, authorization to use or disclose PHI, if that may affect Adverity.

3. Notify Adverity of any restrictions on the use or disclosure of PHI that it agrees to under HIPAA, if that may affect Adverity.

4. Not request Adverity to use or disclose PHI in any way that would violate HIPAA if done by Customer.

Adverity will return or destroy PHI at end of contract unless not feasible.

The term of the BAA is that of the Agreement.

1. Term. This BAA is effective as of the date it is incorporated in the Agreement and shall continue until termination of the Agreement or until all PHI is returned or destroyed.

2. Termination for Cause. Either Party may terminate this Agreement if the other Party materially breaches this BAA and does not cure the breach within 30 days of written notice.

1. Regulatory Changes. If there are changes to HIPAA, the Parties will update this Agreement as needed.

2. Notices. All notices under this BAA must be in writing and sent to hipaa@adverity.com.

3. No Third-Party Rights. This BAA does not give rights to any third parties.

4. Governing Law. The governing law provisions set forth in the Agreement shall apply to this BAA.

5. Amendments and Waivers. Must be in writing and signed by both Parties.

6. Severability. If any part of this BAA is invalid, the rest remains in effect.

All terms used have the same meaning as defined in HIPAA.

Unless otherwise stated in this BAA, all terms used—such as “Protected Health Information,” “Adverity,” “Customer,” “Breach,” and “Security Incident”—have the same meanings as defined in the Health Insurance Portability and Accountability Act of 1996 (HIPAA), including its regulations at 45 C.F.R. Parts 160 and 164, as amended.

General Description of Measures 

Description of Measures Implemented 

Physical Access  and Environmental Control 

Suitable physical security and environmental controls are in place and designed to protect, control, and restrict physical access for systems and servers

Used hosting providers comply with:

• information security standards such as with ISO 27018 and ISO 27001 and can provide certificates for evidence

• AICPA SOC 2 standard and can provide reports for evidence

Logical Access Control (systems)

Preventing data processing systems from being used without authorization

• Database security controls restrict access

• Access rights are granted based on roles and need to know

• Password policy based on established information security standards such as BSI and NIST

• Automatic blocking of access (e.g. password, timeout)

• Protocol of failed log-in attempts

Access Control (data)

Ensuring that persons entitled to use a data processing system have access only to the data to which they have a right of access, and that Personal Data cannot be read, copied, modified or removed without authorization

• Access rights are granted based on roles and need to know

• Approval process for access rights

• Periodical reviews of access rights

• Signed confidentiality undertakings

• Optional restricted to VPN (Virtual Privacy Networks) access only

Transmission Control

Ensuring that Personal Data cannot be read, copied, modified or removed without authorization during electronic transmission or transport, and that it is possible to review and establish which bodies are to receive the Personal Data

• Encrypted transfer based on secure management of encryption keys and minimum requirements for encryption algorithm (e.g. AES 256)

• Log files

Input Control

Ensuring that it is possible to review and establish whether and by whom Personal Data have been input into data processing systems, modified, or removed

• Access rights granted based on roles and need to know

• Approval process for access rights

• Periodical reviews of access rights

• Log files

Job Control

Ensuring that the Personal Data is processed exclusively in accordance with the instructions

• Diligently selecting (Sub-)processors and other service providers

• Documenting selection procedures (privacy and security policies, audit reports, certifications)

• Backgrounds of service providers are checked, subsequent monitoring

• Standardized policies and procedures (including clear segregation of responsibilities)

• Documentation of instructions received from Data Controller

• Signed confidentiality undertakings

Availability Control

Ensuring that Personal Data is protected from accidental destruction and loss

Used hosting provider comply with:

• Information security standards such as ISO 27018 and ISO 270001 and can provide certificates for evidence
• AICPA SOC 2 standard and can provide reports for evidence

Additional managed by Data Processor:

• Backup procedures based on Business Impact Analysis
• Disaster recovery plan
• Routinely tests of disaster recovery plan

Separation Control

Ensuring that data collected for different purposes can be processed separately

• Separate processing possibilities in the SaaS

• Separation between productive and test data

• Detailed management of access rights

Document Information

Document Owner

VP Legal & Compliance

Version

V1.0

Date of Version

2025-05-20