Vivlio Health
Book a 1:1 call

Glossary

Business associate agreement

The contract HIPAA requires between a covered entity and a vendor that creates, receives, maintains or transmits protected health information on its behalf. It binds the vendor to the Privacy and Security Rules, sets what it may do with the data, and makes it directly liable for breaches.

Also BAA, business associate contract

A covered entity, which for this purpose means the agency, the practice or the PACE organization, may let a vendor handle protected health information only under a written agreement that meets 45 CFR 164.504(e). The agreement must set out the permitted uses and disclosures, require the vendor to safeguard the data under the Security Rule, require it to report breaches, flow the same terms down to its own subcontractors, and provide for return or destruction of the data when the arrangement ends. Since the 2013 Omnibus Rule the business associate is directly liable under HIPAA for its own compliance, not only through the contract.

A records retrieval service is a business associate by definition: it receives protected health information on the provider’s behalf and holds it. That has two consequences worth understanding before signing anything.

  • The vendor acts under the provider’s authority. When Vivlio queries the exchange networks for an agency’s patient, it does so as that agency’s business associate, under the agency’s treatment purpose of use and identified by the agency’s NPI. The vendor has no purpose of its own; it has the provider’s.
  • The agreement is the place to check the limits. What the vendor may do with the data beyond the service, whether it may de-identify and reuse it, how long it keeps it, and where it is stored are answered in the BAA or not at all.

Vivlio publishes its BAA in full rather than producing it on request, so an agency’s compliance officer can read the terms before the first conversation with sales.

Where it is defined

Talk to us

Start a conversation about your medical records

Send your details and the calendar opens right here. Book thirty minutes and we will walk a record through the view you would actually use, or skip the call and we will come back in writing.

  1. Send your detailsTwo minutes. Your organization, name, email and phone, and the time records cost you; the rest is optional and helps us reply with something specific.
  2. Pick a timeThirty minutes, live, over synthetic records in the shape your team works in. No slides, and no discovery call before the demo.

Who this is for, and who it is not

  • Coverage comes firstVivlio retrieves from providers, hospitals and health systems it can reach through national exchange networks and direct connections. Name the facilities your patients come from on the form and we check coverage before anyone spends thirty minutes on a demo.
  • You can say what the chasing costsThe form asks how many hours a week your team loses to chasing records. If nobody can put a number near it, the case for Vivlio is not there yet, and we would rather say so than sell you a demo.
  • Patients and files at volumeThis is built for intake that runs every day. For one record, once, your patient can request it from the provider directly, and that will be faster than going through us.
  • Treatment, with the paperwork doneProduction access needs an NPI, a declared purpose of use and a signed BAA. Nobody swipes a card onto live PHI.

If none of those describe you, say so in the last field and we will come back in writing instead of booking a call.

Or call sales directly at 404-777-5772

Step 1 of 2

Send us your details

Three to five is plenty. We check coverage for them before the call, so nobody finds out afterwards.

We use your details to reply about Vivlio. No lists, no sharing.