Fill-in templates implementers use to meet their obligations. Review with counsel before use.
Template BAA for a Covered Entity (or upstream Business Associate) to sign with ITS OWN business associates. NOT for use with HDS: in the vault product HDS holds data for the individual, who grants access directly, so it maintains nothing on a customer's behalf and is nobody's business associate there.
satisfies: hipaa-security.164.314(a)(1) hipaa-privacy.164.502(e)(1)
Template Data Processing Agreement (GDPR Art.28 / Swiss nLPD) for an organisation building on HDS to sign with ITS OWN processors, for the copy of personal data it holds on its own systems. NOT for use with HDS: for the vault product HDS is the controller of the individual's vault and cannot be anyone's Art.28 processor.
satisfies: gdpr.Art.28 swiss-nlpd.Art.9
Template back-to-back agreement by which a Business Associate flows its HIPAA obligations down to a subcontractor that handles ePHI on its behalf.
satisfies: hipaa-security.164.314(a)(2)(ii)(B) hipaa-security.164.314(a)(1)
Template for disclosing the subprocessors used to handle ePHI and recording the assurances obtained from each — the operational companion to the subcontractor agreement.
satisfies: hipaa-security.164.314(a)(2)(ii)(B)