Contact Us
LEGAL DOCUMENT

Business Associate Agreement

  • Template Version 1.0
  • Issued: July 29, 2026
Template Notice: This is a template Business Associate Agreement for use at the time of CMPNT Health’s commercial product launch. It is not currently operative, as CMPNT Health is in pre-commercial development and does not yet handle Protected Health Information. This template should be reviewed by qualified legal counsel prior to execution.
42 CFR Part 2 Note: Because CMPNT Health’s platform is designed to serve substance use disorder treatment programs, applicable patient records may be subject to 42 CFR Part 2 (Confidentiality of Substance Use Disorder Patient Records) in addition to HIPAA. Section 10 of this Agreement addresses Part 2 obligations. Covered Programs must ensure appropriate patient consent is obtained before disclosing Part 2-protected records to CMPNT Health as Business Associate.

Preamble

This Business Associate Agreement (“Agreement”) is entered into as of the date signed below (“Effective Date”) by and between:
  • Covered Entity: ("Covered Entity"), a healthcare provider or health plan subject to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), and
  • Business Associate: CMPNT Health, Inc., a Delaware corporation ("Business Associate" or "CMPNT Health").
This Agreement is incorporated into and made part of any underlying services agreement between the parties (the “Services Agreement”). In the event of a conflict between this Agreement and the Services Agreement regarding the subject matter herein, this Agreement controls.

1. Definitions

Capitalized terms not otherwise defined herein have the meanings ascribed to them in HIPAA, the HITECH Act, and their implementing regulations (45 CFR Parts 160 and 164), as amended.
  • "Breach" has the meaning set forth at 45 CFR § 164.402.
  • "Business Associate" has the meaning set forth at 45 CFR § 160.103.
  • "Covered Entity" has the meaning set forth at 45 CFR § 160.103.
  • "HITECH Act" means the Health Information Technology for Economic and Clinical Health Act, enacted as Title XIII of the American Recovery and Reinvestment Act of 2009.
  • "Part 2 Records" means patient records subject to 42 CFR Part 2, including records of the identity, diagnosis, prognosis, or treatment of any patient maintained in connection with the performance of a program that holds itself out as providing and provides alcohol or drug abuse diagnosis, treatment, or referral for treatment.
  • "Protected Health Information" or "PHI" has the meaning set forth at 45 CFR § 160.103, limited to information received by Business Associate from or on behalf of Covered Entity, or created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity
  • "Security Incident" has the meaning set forth at 45 CFR § 164.304
  • "Unsecured PHI" has the meaning set forth at 45 CFR § 164.402.

Permitted Uses and Disclosures by Business Associate

2.1 Authorized Activities
Business Associate may use and disclose PHI only as necessary to perform its obligations under the Services Agreement, including:
  • Processing prior authorization and concurrent review submissions on behalf of Covered Entity
  • Generating utilization review documentation, appeal packets, and determination records
  • Transmitting utilization review submissions to payers, insurers, and managed care organizations
  • Maintaining audit trails and case records as required by applicable regulations
2.2 Additional Permitted Uses
Business Associate may also use PHI for:
  • Its own management, administration, and legal responsibilities
  • Data aggregation services relating to Covered Entity's healthcare operations, as permitted by 45 CFR § 164.504(e)(2)(i)(B)
  • Reporting violations of law to appropriate government authorities as permitted by 45 CFR § 164.502(j)(1)
2.3 Minimum Necessary
Business Associate shall make reasonable efforts to use, disclose, and request only the minimum amount of PHI necessary to accomplish the intended purpose, consistent with 45 CFR § 164.514(d).

3. Obligations of Business Associate

3.1 Safeguards
Business Associate shall implement and maintain appropriate administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of PHI, including electronic PHI (ePHI), as required by the HIPAA Security Rule (45 CFR Part 164, Subpart C).
3.2 Subcontractors
Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate under this Agreement, through a written agreement satisfying the requirements of 45 CFR § 164.504(e).
3.3 Breach Notification
Business Associate shall notify Covered Entity without unreasonable delay and in no case later than 60 calendar days after discovery of a Breach of Unsecured PHI, as required by 45 CFR § 164.410. Notice shall include, to the extent reasonably possible, the information required by 45 CFR § 164.410(c). Business Associate shall provide updated information as it becomes available.
3.4 Security Incidents
Business Associate shall report to Covered Entity any Security Incident of which Business Associate becomes aware, including Breaches, within the timeframes specified herein.
3.5 Individual Rights
To the extent Business Associate maintains a Designated Record Set on behalf of Covered Entity, Business Associate shall:
  • Provide access to PHI to Covered Entity upon request to enable Covered Entity to fulfill individual rights under 45 CFR § 164.524
  • Make amendments to PHI upon direction from Covered Entity pursuant to 45 CFR § 164.526
  • Provide an accounting of disclosures as requested by Covered Entity pursuant to 45 CFR § 164.528
3.6 Availability for Audit
Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of Health and Human Services for the purpose of determining compliance with HIPAA, upon request.
3.7 Return or Destruction of PHI
Upon termination of the Services Agreement, Business Associate shall return or destroy all PHI received from or created on behalf of Covered Entity. Where return or destruction is not feasible, Business Associate shall extend the protections of this Agreement to such PHI and limit further uses and disclosures to those purposes that make return or destruction infeasible.

4. Obligations of Covered Entity

Covered Entity shall:
  • Notify Business Associate of any limitations in its Notice of Privacy Practices that may affect Business Associate's use or disclosure of PHI
  • Notify Business Associate of any changes in, or revocation of, authorization provided to Covered Entity by an individual that may affect Business Associate's permitted uses or disclosures
  • Not request Business Associate to use or disclose PHI in any manner that would not be permissible under HIPAA if done by Covered Entity
  • Obtain all necessary patient authorizations required by 42 CFR Part 2 before disclosing Part 2 Records to Business Associate

5. Prohibited Uses and Disclosures

Business Associate shall not:
  • Use or disclose PHI other than as permitted or required by this Agreement or required by law
  • Use or disclose PHI in a manner that would violate HIPAA if done by Covered Entity
  • Sell PHI as defined by 45 CFR § 164.502(a)(5)(ii)
  • Use PHI for marketing purposes without individual authorization as defined by 45 CFR § 164.508

6. Term and Termination

6.1 Term
This Agreement shall be effective as of the Effective Date and shall remain in effect until terminated in accordance with this Section or until the Services Agreement expires or is terminated, whichever occurs first.
6.2 Termination for Cause
Either party may terminate this Agreement immediately upon written notice if the other party has materially breached a provision of this Agreement and has not cured such breach within thirty (30) days of receiving written notice specifying the breach in reasonable detail.
6.3 Effect of Termination
The obligations of Business Associate under Section 3.7 shall survive termination of this Agreement.

7. Indemnification

Each party shall indemnify, defend, and hold harmless the other party from and against any claims, losses, liabilities, costs, and expenses (including reasonable attorneys’ fees) arising from that party’s material breach of this Agreement, except to the extent such claims arise from the other party’s negligence or willful misconduct. This Section survives termination.

8. Miscellaneous

8.1 Amendment
The parties agree to amend this Agreement as necessary to comply with changes in applicable law, including amendments to HIPAA and 42 CFR Part 2.
8.2 Interpretation
This Agreement shall be interpreted as broadly as necessary to implement and comply with HIPAA, the HITECH Act, and 42 CFR Part 2. The parties agree that any ambiguity in this Agreement shall be resolved in favor of a meaning that complies with and is consistent with applicable law.
8.3 No Third-Party Beneficiaries
Nothing in this Agreement shall confer upon any person other than the parties any rights, remedies, obligations, or liabilities.
8.4 Governing Law
This Agreement shall be governed by the laws of the State of Delaware, without regard to conflicts of law principles, except to the extent superseded by federal law (including HIPAA and 42 CFR Part 2).
8.5 Entire Agreement
This Agreement, together with the Services Agreement, constitutes the entire agreement between the parties with respect to Business Associate’s obligations regarding PHI and supersedes all prior negotiations, representations, or agreements relating to the subject matter herein.

9. Notices

All notices under this Agreement shall be in writing and delivered to:
CMPNT Health, Inc.: info@cmpnthealth.com
Covered Entity: As specified in the Services Agreement or by written notice.

10. 42 CFR Part 2 — Substance Use Disorder Records

Special Provision: This Section addresses obligations specific to 42 CFR Part 2, which applies to records of SUD patients maintained by federally-assisted programs. These obligations are in addition to, and do not diminish, any HIPAA obligations under this Agreement.
10.1 Acknowledgment
The parties acknowledge that CMPNT Health’s platform is designed to serve substance use disorder treatment programs and that patient records processed through the platform may be subject to 42 CFR Part 2 (“Part 2 Records”).
10.2 Restrictions on Use and Disclosure
Business Associate shall not use or disclose Part 2 Records except as permitted by 42 CFR Part 2, including:
  • With patient written consent meeting the requirements of 42 CFR § 2.31
  • For audit and evaluation activities as permitted by 42 CFR § 2.53
  • As required by court order meeting the requirements of 42 CFR §§ 2.61–2.67
  • For medical emergencies as permitted by 42 CFR § 2.51
  • As otherwise permitted by 42 CFR Part 2
10.3 Prohibition on Re-disclosure
Business Associate shall include in any disclosure of Part 2 Records a written statement that the information disclosed is protected by federal law (42 CFR Part 2) and that the recipient may not make any further disclosure of such information unless further disclosure is expressly permitted by written consent of the patient or as otherwise permitted by 42 CFR Part 2.
10.4 Covered Entity Responsibilities
Covered Entity represents and warrants that it has obtained all patient authorizations required by 42 CFR § 2.31 before disclosing Part 2 Records to Business Associate, and that such authorizations specifically permit disclosure to CMPNT Health for utilization review purposes.
10.5 Security
Business Associate shall implement technical safeguards that segregate Part 2 Records and prevent their unauthorized disclosure, including role-based access controls limiting access to authorized personnel with a need to know.

Signatures

By signing below, the authorized representatives of each party agree to the terms of this Business Associate Agreement
Download BAA (PDF)
Scroll to Top