BUSINESS ASSOCIATE AGREEMENT
Version: 2026.11
Effective Date: November 1, 2026
This Business Associate Agreement (“Agreement”) supplements and is made part of the EDIdEv Terms of Service between EDIdEv LLC (“Business Associate,” “EDIdEv,” “we,” “us”) and the customer identified on the EDIdEv account (“Covered Entity,” “you”).
This Agreement is required by the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, as amended by the HITECH Act and the Omnibus Rule (collectively, “HIPAA”).
This Agreement takes effect on the date you accept it electronically and remains in effect until terminated as described below.
This document is not legal advice. You should have it reviewed by your own counsel before accepting it.
1. DEFINITIONS
Terms used but not otherwise defined in this Agreement have the meaning given to them in HIPAA, at 45 CFR Parts 160 and 164.
- Protected Health Information (PHI) means individually identifiable health information transmitted or maintained in any form or medium, limited to the information EDIdEv creates, receives, maintains, or transmits on your behalf.
- Electronic PHI (ePHI) means PHI transmitted by or maintained in electronic media.
- Services means the EDIdEv hosted services described in the Terms of Service, including file upload, translation, generation, validation, acknowledgment, reporting, and file storage services, whether used during an evaluation or under a subscription.
- Customer Files means the files you upload to a Service, the files, reports, and results the Service generates from them, and the records derived from them that contain PHI.
- Breach, Required by Law, Secretary, Subcontractor, Unsecured PHI, and Use and Disclosure have the meanings given in 45 CFR 160.103 and 164.402.
2. STATUS OF THE PARTIES
You are a Covered Entity, or a Business Associate acting on behalf of a Covered Entity.
EDIdEv is your Business Associate with respect to any PHI you submit to the Services. Where you are yourself a Business Associate, EDIdEv acts as your Subcontractor and this Agreement binds EDIdEv to the same restrictions and conditions that apply to you with respect to that PHI, as required by 45 CFR 164.502(e)(1)(ii).
3. PERMITTED USES AND DISCLOSURES BY EDIdEv
EDIdEv may Use or Disclose PHI only:
- to perform the Services you have requested, as described in the Terms of Service and in this Agreement;
- for the proper management and administration of EDIdEv, or to carry out EDIdEv's legal responsibilities, provided that any Disclosure for those purposes is either Required by Law or made subject to written assurances of confidentiality and of notice to EDIdEv of any breach;
- to provide data aggregation services relating to your health care operations, if and only to the extent you have requested them;
- to report violations of law to appropriate federal and state authorities, consistent with 45 CFR 164.502(j)(1);
- as Required by Law.
EDIdEv will not Use or Disclose PHI in any manner that would violate Subpart E of 45 CFR Part 164 if done by you, except as expressly permitted above.
EDIdEv will not Use or Disclose PHI for marketing, for the sale of PHI, or to train, tune, or evaluate any machine-learning or artificial-intelligence model.
4. MINIMUM NECESSARY
EDIdEv will request, Use, and Disclose only the minimum amount of PHI necessary to accomplish the purpose of the request, Use, or Disclosure, consistent with 45 CFR 164.502(b) and 164.514(d).
You are responsible for not submitting PHI beyond what the requested Service actually requires. During an evaluation, use test or de-identified data wherever it will serve.
5. SAFEGUARDS
EDIdEv will use appropriate administrative, physical, and technical safeguards, and will comply with Subpart C of 45 CFR Part 164 (the Security Rule) with respect to ePHI, to prevent Use or Disclosure of PHI other than as provided for by this Agreement.
Those safeguards include:
- encryption of PHI in transit using current industry-standard transport security;
- access controls limiting PHI access to personnel with a demonstrated need;
- logging of processing events;
- a documented risk analysis and risk management process;
- workforce training on the handling of PHI.
6. STORAGE, RETENTION, AND DESTRUCTION OF PHI
The Services store Customer Files on EDIdEv systems so that you can process them and download the results. EDIdEv keeps Customer Files no longer than this Section allows, and deletes them sooner when you choose a shorter retention option.
While a Service is active, EDIdEv permanently destroys each uploaded file, and the Customer Files generated from it, no later than ninety (90) days after upload.
When a Service ends, EDIdEv permanently destroys that Service's remaining Customer Files as follows:
- Evaluation ended: one (1) day after the evaluation end date.
- Subscription cancelled: immediately, when you confirm the cancellation.
- Subscription ended for any other reason: no later than thirty (30) days after the subscription end date.
A Service that is past due or suspended has not ended for the purpose of this Section.
Destroyed Customer Files cannot be recovered. You are responsible for downloading any file you need before its destruction date.
Copies of Customer Files held in EDIdEv backup media are destroyed when those backups expire under EDIdEv's normal backup rotation. Until then, they remain subject to this Agreement and are not used to restore Customer Files of an ended Service.
EDIdEv may retain records that contain no PHI, such as account, billing, and agreement-acceptance records, and counts and status of processed jobs.
7. SUBCONTRACTORS
EDIdEv will ensure, in accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), that any Subcontractor that creates, receives, maintains, or transmits PHI on EDIdEv's behalf agrees in writing to restrictions and conditions at least as restrictive as those that apply to EDIdEv under this Agreement.
This includes infrastructure and hosting providers used to operate the Services.
8. REPORTING OF UNAUTHORIZED USE, DISCLOSURE, OR BREACH
EDIdEv will report to you:
- any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware;
- any Security Incident with respect to ePHI of which it becomes aware;
- any Breach of Unsecured PHI, in accordance with 45 CFR 164.410.
A report of a Breach of Unsecured PHI will be made without unreasonable delay and in no case later than thirty (30) calendar days after discovery, and will include, to the extent known: the identification of each individual whose Unsecured PHI was or is reasonably believed to have been accessed, acquired, used, or disclosed; the nature of the incident; the date of the incident and the date of discovery; and the mitigation and remediation steps taken.
Reports will be sent to the e-mail address on your EDIdEv account. You are responsible for keeping that address current.
Unsuccessful Security Incidents that do not result in unauthorized access to ePHI, such as routine port scans, blocked connection attempts, and unsuccessful log-on attempts, are reported to you on request rather than individually, and this paragraph constitutes notice of them.
9. ACCESS, AMENDMENT, AND ACCOUNTING
EDIdEv does not maintain PHI in a Designated Record Set on your behalf. To the extent EDIdEv ever does:
- EDIdEv will make that PHI available to you, or to the individual as you direct, within fifteen (15) business days of your written request, so you can meet your obligations under 45 CFR 164.524;
- EDIdEv will make amendments you direct within fifteen (15) business days, so you can meet your obligations under 45 CFR 164.526;
- EDIdEv will document and make available the information required for an accounting of Disclosures under 45 CFR 164.528.
If an individual makes any such request directly to EDIdEv, EDIdEv will forward it to you and will not respond to it directly, except as Required by Law.
10. AVAILABILITY TO THE SECRETARY
EDIdEv will make its internal practices, books, and records relating to the Use and Disclosure of PHI available to the Secretary for purposes of determining your compliance with HIPAA.
EDIdEv will notify you of any such request unless prohibited from doing so by law.
11. YOUR OBLIGATIONS
You agree that you will:
- obtain any consent, authorization, or permission required before submitting PHI to the Services;
- notify EDIdEv of any limitation in your notice of privacy practices, of any change in or revocation of an individual's permission, and of any restriction on Use or Disclosure you have agreed to under 45 CFR 164.522, to the extent any of these affects EDIdEv's Use or Disclosure of PHI;
- not request that EDIdEv Use or Disclose PHI in any manner that would violate HIPAA if done by you;
- submit only the PHI actually required for the requested Service;
- download any Customer File you need to keep before it is destroyed under Section 6.
12. TERM AND TERMINATION
This Agreement takes effect on the date of your electronic acceptance and continues until terminated.
Termination for cause. You may terminate this Agreement if EDIdEv materially breaches it and fails to cure that breach within thirty (30) days of written notice. If cure is not possible, you may terminate immediately.
Effect of termination. On termination, EDIdEv will destroy all PHI it holds on your behalf, on the schedule in Section 6 and in no case later than thirty (30) days after termination, and will retain no copies other than backup copies destroyed as described in Section 6.
If return or destruction is infeasible, EDIdEv will extend the protections of this Agreement to that PHI and limit further Uses and Disclosures to the purposes that make return or destruction infeasible, for so long as it retains the PHI, as required by 45 CFR 164.504(e)(2)(ii)(J).
Survival. Sections 6, 8, 10, 12, and 13 survive termination.
13. RECORD RETENTION
EDIdEv retains the record of your acceptance of this Agreement, including the version accepted, the account that accepted it, the IP address and browser it was accepted from, and the date and time, for no less than six (6) years from the later of the date of creation or the date it was last in effect, as required by 45 CFR 164.530(j)(2).
14. AMENDMENT AND NEW VERSIONS
The parties agree to take such action as is necessary to amend this Agreement from time to time so that each party remains in compliance with HIPAA.
EDIdEv may publish a new version of this Agreement. When it does, you will be notified and asked to accept it. The version you previously accepted remains in effect until you do, except where a change is required by law.
15. NO WAIVER OF DIRECT LIABILITY
This Agreement makes the Disclosure of PHI to EDIdEv lawful and defines each party's obligations.
It does not waive, transfer, or limit either party's direct liability under HIPAA. EDIdEv remains directly liable under HIPAA for its own acts and omissions as a Business Associate.
16. INTERPRETATION AND CONFLICTS
Any ambiguity in this Agreement is resolved in favor of a meaning that permits compliance with HIPAA.
In the event of a conflict between this Agreement and the Terms of Service with respect to PHI, this Agreement controls.
If any provision is held unenforceable, the remainder of this Agreement remains in effect.
17. CONTACT
Questions about this Agreement, and all breach notifications and HIPAA-related requests, should be directed to:
EDIdEv LLC 263 W. Olive Avenue #357 Burbank, CA 91502, U.S.A. support@edidev.com
18. ACCEPTANCE
By checking the box agreeing to the Terms of Service and this Agreement and clicking Accept, you represent that:
- you have read this Agreement in full;
- you are authorized to bind the customer identified on the EDIdEv account;
- you intend your electronic acceptance to have the same effect as a handwritten signature, under the ESIGN Act and applicable state law.
The version accepted, your account, the IP address and browser you accepted from, and the date and time of your acceptance are recorded.