Business Associate Agreement

This Business Associate Agreement establishes the terms under which NexiScribe, as a Business Associate, will handle Protected Health Information on behalf of Covered Entities. The agreement ensures compliance with the HIPAA Privacy Rule, Security Rule, and the HITECH Act.

NexiScribe agrees to use and disclose PHI only as permitted by this agreement and applicable law. We will implement appropriate administrative, physical, and technical safeguards to prevent unauthorized use or disclosure of PHI. We will promptly report any security incidents or breaches to the Covered Entity.

NexiScribe may use PHI solely for the purpose of providing clinical documentation services as described in our service agreement. We may also use PHI for our proper management and administration, and to carry out our legal responsibilities, provided that any disclosures are required by law or the recipient agrees to protect the information.

NexiScribe maintains comprehensive security safeguards including AES-256 encryption for data at rest and in transit, multi-factor authentication, role-based access controls, regular vulnerability assessments, and continuous monitoring. Our infrastructure is hosted in SOC 2-compliant data centers.

In the event of a breach of unsecured PHI, NexiScribe will notify the Covered Entity without unreasonable delay and no later than 60 days after discovery. The notification will include the nature of the breach, the types of information involved, steps taken to mitigate harm, and recommended actions for affected individuals.

This agreement remains in effect for the duration of the underlying service agreement. Either party may terminate for cause if the other party materially breaches this agreement and fails to cure the breach within 30 days of notice. Upon termination, NexiScribe will return or destroy all PHI in its possession, where feasible.