Required determination
Before PHI is exchanged, the client and Peyelis document the service, data involved, access frequency, systems, subcontractors, and whether the conduit exception applies. If Peyelis is a business associate, no PHI-enabled workflow begins until a signed BAA and security review are complete.
Required BAA subjects
The signed BAA must define permitted and required uses and disclosures; prohibit other uses; require appropriate safeguards; require reporting of security incidents and breaches; bind subcontractors; support applicable access, amendment, accounting, and government-inspection duties; require return or destruction at termination where feasible; and authorize termination for material breach.
Use the current HHS model provisions as the legal-review starting point. Client-specific names, addresses, notice contacts, systems, breach deadlines, state-law duties, insurance, indemnity, data-retention, and security schedules must be completed and signed by authorized representatives.
Federal starting point
Use the current U.S. Department of Health and Human Services model BAA provisions during attorney and compliance review.
Review HHS business-associate guidance