Ralfor
Business Associate Agreement
Parties and acceptance. The home identified in the subscription acceptance record ("Home") and SASA Consulting Partners LLC, doing business as Ralfor ("Business Associate"). Ralfor offers this agreement with its service; it becomes effective when an authorized Home representative accepts the identified version electronically. The acceptance record identifies the Home, representative, document content hashes and time. This contract does not assert that either party has a certification. Protected health information (PHI), breach and security incident have the meanings given in 45 CFR Parts 160 and 164. References to Covered Entity below include a Home acting for a covered entity under its own lawful authority.
1. Permitted uses. Business Associate may use and disclose protected health information (PHI) only:
- to provide the Ralfor service described in the subscription terms;
- for its proper management and administration, or to carry out its legal responsibilities, as 45 CFR 164.504(e)(4) allows;
- as required by law.
It will not use PHI for marketing, sell it, or use it to train AI models.
2. Safeguards. Business Associate shall maintain appropriate administrative, physical and technical safeguards against uses or disclosures not permitted by this agreement, and meet applicable requirements of Subpart C of 45 CFR Part 164 for electronic PHI. Access shall be limited to personnel and service providers authorized for their duties.
3. Subcontractors. Before a subcontractor creates, receives, maintains or transmits PHI on its behalf, Business Associate shall obtain a written agreement imposing the same applicable restrictions, conditions and safeguards. An optional vendor must not receive PHI merely because an API key is present. The Home must authorize its own vendor connections and establish any agreements required for them.
4. Reporting. Business Associate reports to Covered Entity any use or disclosure not provided for by this agreement and any security incident it becomes aware of, and any breach of unsecured PHI without unreasonable delay and no later than 5 business days after discovery, with the information required by 45 CFR 164.410 as it becomes available.
5. Individual rights. Within 10 business days of a request, Business Associate makes PHI in the service available to Covered Entity so it can meet 45 CFR 164.524 (access), 164.526 (amendment) and 164.528 (accounting of disclosures). Covered Entity can also export its records at any time.
6. Minimum necessary. Business Associate requests, uses and discloses only the minimum PHI necessary.
7. Covered Entity's obligations. To the extent Business Associate carries out an obligation of Covered Entity under Subpart E of 45 CFR Part 164, it complies with the requirements that apply to Covered Entity in doing so.
8. HHS access. Business Associate makes its internal practices, books and records relating to PHI available to the Secretary of HHS to determine compliance.
9. Term and termination. These protections remain in effect while Business Associate retains PHI. The Home may terminate for a material breach not cured within 30 days of written notice, or immediately when cure is not possible. At final service termination, Business Associate shall return or destroy PHI as the Home instructs where feasible, retaining no copies except where law requires retention or return or destruction is infeasible. It shall explain any such retention, continue these protections and limit further use to the purposes making return or destruction infeasible. Trial expiry, nonpayment or billing cancellation alone does not trigger destruction, and read and export access remains available.
10. Home cooperation and interpretation. The Home shall communicate applicable privacy restrictions, permissions and changes that affect the service and shall not request an unlawful use or disclosure. For management or administration disclosures, Business Associate shall obtain reasonable confidentiality assurances and notice of breaches, unless disclosure is required by law. Required amendments must be agreed in writing. This agreement controls over conflicting subscription terms; reporting, individual-rights cooperation and protection of retained PHI survive termination. No third-party beneficiary rights are created.
Contact. Privacy and Security Officer, SASA Consulting Partners LLC (Ralfor): privacy@ralfor.com.