Last updated: October 11, 2026
This Business Associate Agreement (BAA) is part of the JotPsych Terms of Service. A practice enters into the BAA when it accepts the Terms of Service at signup. If a practice and JotPsych have signed a separate BAA, the signed BAA governs instead of this one.
This Business Associate Agreement (“BAA”) is made and entered into as of the date it takes effect under Section 15.A, by and between the Client, as defined in the JotPsych Terms of Service, that accepts those Terms of Service (“Covered Entity”) and SmartScribe Corp. dba JotPsych, a Delaware corporation (“Business Associate”), in accordance with the meanings given to those terms at 45 CFR §164.501. Covered Entity and Business Associate are each a “Party” and, collectively, are the “Parties.”
Background. Covered Entity is a “covered entity” or “business associate” of a covered entity as defined under the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, as amended by the HITECH Act and related HHS regulations (collectively, “HIPAA”). The Parties have entered into the JotPsych Terms of Service, and may enter into one or more other service agreements, under which Business Associate provides services to Covered Entity (collectively, the “Agreement”). In providing those services, Business Associate will have access to Protected Health Information. The Parties are committed to complying with all federal and state laws governing the confidentiality and privacy of health information.
In consideration of the mutual covenants herein and the continued provision of PHI by Covered Entity to Business Associate under the Agreement, the Parties agree as follows.
Capitalized terms used but not defined in this BAA have the meanings given in the Privacy Rule or pertinent law. The following terms have the meanings set forth below:
Business Associate may use or disclose PHI only to the extent explicitly necessary to perform services as outlined in the Agreement, or as expressly permitted or mandated by this BAA or applicable law, adhering strictly to the principle of minimum necessary use.
Except as otherwise limited by this BAA or applicable law, Covered Entity authorizes Business Associate to use PHI in its possession for the proper management and administration of Business Associate’s business and to carry out its legal responsibilities. Business Associate may disclose PHI for such purposes, provided that (i) the disclosure is required by law, or (ii) Business Associate obtains, in writing, prior to any disclosure to a third party: (a) reasonable assurances that the PHI will be held confidential as provided under this BAA and used or further disclosed only as required by law or for the purpose for which it was disclosed; and (b) an agreement from the third party to notify Business Associate promptly of any breach of the confidentiality of the PHI.
Business Associate will use or disclose PHI, to the extent practicable, as a limited data set or limited to the minimum necessary amount to carry out the intended purpose of the use or disclosure, in accordance with Section 13405(b) of the HITECH Act and applicable implementing regulations.
Upon request and to the extent feasible, Business Associate will endeavor to provide Covered Entity with access to PHI in Business Associate’s possession. Business Associate will require its agents or subcontractors to agree to the same restrictions as this BAA before accessing or processing PHI on Covered Entity’s behalf.
Business Associate may use PHI to report violations of law to appropriate federal and state authorities, consistent with 45 CFR §164.502(j)(1).
Business Associate will use appropriate safeguards to prevent use or disclosure of PHI other than as provided by the Agreement or this BAA. Business Associate agrees to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic PHI created, received, maintained, or transmitted on behalf of Covered Entity. Business Associate agrees to take reasonable steps, including providing adequate training to its workforce, to ensure compliance with this BAA and to ensure that the actions or omissions of its employees or agents do not cause Business Associate to breach this BAA.
Business Associate will report to Covered Entity in writing any use or disclosure of PHI not provided for by this BAA of which Business Associate becomes aware, and any Security Incident affecting Electronic PHI of Covered Entity of which Business Associate becomes aware. Business Associate will report any such event within ten (10) business days of becoming aware of the event.
Upon identification of a potential breach of this BAA, Business Associate shall be afforded thirty (30) days from the date of written notification by Covered Entity to remedy the breach to Covered Entity’s reasonable satisfaction. If Business Associate cures the breach within the cure period, Covered Entity shall not exercise its rights of termination or other remedies related to that breach.
Business Associate will notify Covered Entity in writing promptly upon discovery of any Breach of Unsecured PHI in accordance with 45 CFR §164.410, but in no case later than sixty (60) calendar days after discovery of a Breach. Business Associate will reimburse Covered Entity for reasonable costs actually incurred in complying with the notification requirements of Subpart D of 45 CFR Part 164 to the extent such costs arise solely from a Breach directly caused by Business Associate’s willful neglect or intentional misconduct; such reimbursement obligation does not apply to costs arising from Covered Entity’s own acts or omissions, payer or regulatory actions, or circumstances beyond Business Associate’s reasonable control.
Business Associate will take commercially reasonable measures to mitigate, to the extent practicable, any harmful effect known to Business Associate of any unauthorized use or disclosure of PHI by Business Associate or its agents or subcontractors in violation of this BAA.
Business Associate will ensure that any agent or subcontractor that has access to PHI agrees in writing to the restrictions and conditions of this BAA and to implement reasonable and appropriate safeguards to protect Electronic PHI. Business Associate shall provide Covered Entity written notice of any subcontract or agreement under which a subcontractor or agent receives PHI within thirty (30) calendar days of execution of that subcontract; notice shall be provided directly to Covered Entity by written communication (which may include email to the address provided in Section 19) rather than solely by website publication. Business Associate shall ensure that all such subcontracts provide the same level of privacy and security protection as this BAA.
Business Associate may De-Identify PHI received under this BAA in accordance with 45 CFR §§164.514(a)-(b). Once properly De-Identified, such information is no longer PHI and is not subject to the restrictions of this BAA or HIPAA.
Business Associate may use De-Identified data and aggregated statistical information derived from PHI to: (i) develop, improve, train, and evaluate Business Associate’s AI models, software, algorithms, workflows, and products; (ii) conduct internal analytics, quality assurance, and performance benchmarking; (iii) develop industry-standard benchmarks and reporting tools; and (iv) fulfill Business Associate’s operational and legal obligations. Business Associate shall not use De-Identified data in any manner that re-identifies Individuals or that constitutes disclosure of PHI to unauthorized parties.
Business Associate may use PHI, in minimum necessary scope, for its own internal quality assurance, error detection, system improvement, workforce training, and audit defense purposes, provided such use does not result in disclosure to unauthorized third parties and is otherwise consistent with this BAA.
Nothing in this Section 8 authorizes Business Associate to sell De-Identified data derived from Covered Entity’s PHI to third parties or to use PHI for marketing purposes unrelated to the provision of services under the Agreement.
Upon request, Business Associate agrees to furnish Covered Entity with copies of PHI maintained by Business Associate in a Designated Record Set in the time and manner designated by Covered Entity, to enable Covered Entity to respond to an Individual’s request for access under 45 CFR §164.524.
In the event an Individual or personal representative requests access to PHI directly from Business Associate, Business Associate will, within ten (10) business days, forward that request to Covered Entity. Any decision regarding disclosure of PHI to an Individual and compliance with Individual access rights under HIPAA shall be the sole responsibility of Covered Entity.
Upon request and instruction from Covered Entity, Business Associate will amend PHI or a record about an Individual in a Designated Record Set in accordance with 45 CFR §164.526. Any such amendment requested by Covered Entity will be completed by Business Associate within fifteen (15) business days of Covered Entity’s written request.
In the event an Individual requests that Business Associate amend PHI or a record in a Designated Record Set, Business Associate will, within ten (10) business days, forward that request to Covered Entity. Any decision regarding amendment of PHI and compliance with applicable Individual rights shall be the sole responsibility of Covered Entity.
Business Associate will document disclosures of PHI and make available information related to such disclosures as would be required for Covered Entity to respond to a request for an accounting under 45 CFR §164.528. For each covered disclosure, Business Associate will provide at minimum: (i) the date of disclosure; (ii) the name and, if known, the address of the recipient; (iii) a brief description of the PHI disclosed; and (iv) a brief statement of the purpose and basis of the disclosure.
Business Associate will furnish to Covered Entity the information described in this Section 11 within ten (10) business days after written request by Covered Entity, to permit Covered Entity to make an accounting of disclosures as required by 45 CFR §164.528, or to the extent required under the HITECH Act or applicable HHS regulations, in response to an Individual’s direct request to Business Associate for such accounting.
In the event an Individual delivers an initial accounting request directly to Business Associate, Business Associate will forward that request to Covered Entity within ten (10) business days.
Business Associate will make available its internal practices, books, agreements, records, and policies and procedures relating to the use and disclosure of PHI, upon request, to the Secretary of HHS for purposes of determining compliance with HIPAA.
With regard to the use and/or disclosure of PHI by Business Associate, Covered Entity agrees to:
Business Associate’s data stewardship and analytics rights under this BAA do not confer data ownership rights on Business Associate with respect to PHI shared under the Agreement. Subject to Business Associate’s rights under Section 8, all PHI and derivative identifiable information remains the property of Covered Entity and the applicable Individuals.
This BAA becomes effective on the date Covered Entity accepts the JotPsych Terms of Service that incorporate this BAA, at signup or by continuing to use Business Associate’s services after those Terms of Service take effect, and continues in effect until all obligations of the Parties under the Agreement and this BAA have been met.
Covered Entity may terminate this BAA, the Agreement, and any related agreements if Covered Entity determines that Business Associate has breached a material term of this BAA and Business Associate has failed to cure that material breach to Covered Entity’s reasonable satisfaction within thirty (30) days after written notice. Covered Entity may report the issue to the Secretary of HHS if termination is not feasible.
If Business Associate determines that Covered Entity has breached a material term of this BAA, Business Associate will provide Covered Entity written notice and thirty (30) days to cure the breach. Covered Entity’s failure to cure within the thirty-day period will be grounds for immediate termination of the Agreement and this BAA by Business Associate. Business Associate may report the breach to HHS.
Upon termination of the Agreement or this BAA for any reason, Business Associate will return to Covered Entity or destroy all PHI maintained by Business Associate, and will not retain copies, except as follows: (i) to the extent PHI is retained in automated backup or disaster recovery systems not reasonably accessible without extraordinary technical effort, Business Associate shall protect such PHI under the terms of this BAA and shall destroy it in the ordinary course of its backup rotation schedule; (ii) to the extent Business Associate has De-Identified PHI under Section 8 prior to termination, such De-Identified data is not PHI and is not subject to return or destruction obligations; and (iii) to the extent return or destruction is otherwise not feasible in Business Associate’s reasonable judgment, Business Associate will notify Covered Entity in writing and, upon mutual agreement that infeasibility exists, will extend the protections of this BAA to such information for as long as it is retained. This Section 15.D survives termination of this BAA.
In no event shall Business Associate (SmartScribe Corp. dba JotPsych) be liable to Covered Entity for any special, incidental, indirect, punitive, or consequential damages, including lost profits or costs of procurement of substitute goods or services, arising out of or in connection with the performance or non-performance of obligations under this BAA, whether based on warranty, contract, tort, or any other legal theory, and whether or not Business Associate is advised of the possibility of such damages.
Business Associate’s aggregate liability for all claims related to this BAA shall not exceed the total amount of fees paid by Covered Entity to Business Associate during the twelve (12) months preceding the event giving rise to the claim.
The limitations of liability in this Section 16 survive termination or expiration of this BAA and apply to claims made during or after the term, regardless of the theory of recovery.
The Parties agree that the limitations and exclusions in this Section 16 represent the agreed and bargained-for allocation of risk, and that Business Associate’s compensation reflects such allocation. These limitations apply notwithstanding the failure of the essential purpose of any limited remedy.
This BAA is a part of and subject to the terms of the Agreement, except that to the extent any term of this BAA conflicts with any term of the Agreement, the BAA governs with respect to PHI and HIPAA compliance obligations. Except as expressly stated in this BAA or as provided by law, this BAA does not create any rights in favor of any third party.
A reference in this BAA to a section of HIPAA means the section as in effect or as amended at the time of the relevant act or omission.
All notices, requests, and other communications under this BAA shall be in writing and delivered by first class mail, registered or certified mail, express courier, or email to the addresses set forth below. Notice is deemed given upon actual receipt.
This BAA may not be modified, nor may any provision be waived or amended, except in a writing duly signed by authorized representatives of both Parties. A waiver of any provision or breach with respect to one event shall not be construed as a continuing waiver or as a waiver of any right or remedy as to subsequent events.
Covered Entity accepts this BAA by accepting the JotPsych Terms of Service, which incorporate this BAA by reference. Business Associate accepts this BAA by providing services to Covered Entity under the Agreement. The Parties agree that this electronic acceptance forms a binding written agreement.