Version 2026-10-04
This Business Associate Agreement ("BAA") is entered into between the healthcare organization accepting this BAA ("Covered Entity") and RemitMend LLC ("Business Associate"). This BAA becomes effective when it is accepted on behalf of Covered Entity through RemitMend's account-creation process.
Business Associate provides reimbursement and revenue-recovery software and related services to Covered Entity, which may include processing denied claims, analyzing claim and denial information, reviewing supporting documentation, preparing appeal materials, reconciling payment information, and related reimbursement operations (the "Services"). In providing the Services, Business Associate may create, receive, maintain, or transmit Protected Health Information on behalf of Covered Entity.
The parties intend this BAA to satisfy the applicable requirements of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and their implementing regulations, as amended.
Terms including "Breach," "Covered Entity," "Electronic Protected Health Information," "Individual," "Protected Health Information," "Required by Law," "Secretary," "Security Incident," and "Unsecured Protected Health Information" have the meanings assigned to them under HIPAA and its implementing regulations. "PHI" means Protected Health Information received, created, maintained, or transmitted by Business Associate on behalf of Covered Entity.
Business Associate may use or disclose PHI only as necessary to provide the Services, as permitted by this BAA, as permitted by the underlying service relationship between the parties, or as Required by Law. Business Associate will not use or disclose PHI in a manner that would violate the HIPAA Privacy Rule if done by Covered Entity, except as expressly permitted for a business associate under HIPAA.
Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities to the extent permitted by HIPAA. Any disclosure for those purposes will be made only if Required by Law or if Business Associate obtains reasonable assurances from the recipient that the information will remain confidential and be used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the recipient will notify Business Associate of any breach of confidentiality of which it becomes aware.
Business Associate will make reasonable efforts to request, use, and disclose only the minimum PHI reasonably necessary to accomplish the intended purpose, to the extent required by HIPAA.
Business Associate will use appropriate administrative, physical, and technical safeguards to prevent use or disclosure of PHI other than as provided by this BAA. Business Associate will comply with the applicable provisions of the HIPAA Security Rule with respect to Electronic Protected Health Information.
Business Associate will report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which Business Associate becomes aware, including Breaches of Unsecured Protected Health Information as required by applicable law. Business Associate will also report Security Incidents as required by HIPAA.
Notice of a Breach of Unsecured Protected Health Information will be provided without unreasonable delay and in no event later than sixty (60) calendar days after discovery, or within any shorter period required by applicable law. Business Associate will provide the information required by HIPAA to the extent known at the time of notification and will supplement the notification as additional required information becomes available.
Business Associate will ensure that any subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees to restrictions, conditions, and safeguards that apply to the subcontractor as required by HIPAA, including applicable Security Rule requirements for Electronic Protected Health Information.
To the extent Business Associate maintains PHI in a Designated Record Set on behalf of Covered Entity, Business Associate will make such PHI available to Covered Entity as necessary for Covered Entity to satisfy its obligations concerning an Individual's right of access under 45 C.F.R. § 164.524.
To the extent applicable, Business Associate will make PHI available for amendment and incorporate amendments as directed by Covered Entity as necessary for Covered Entity to satisfy its obligations under 45 C.F.R. § 164.526.
Business Associate will document disclosures of PHI and information related to such disclosures as necessary for Covered Entity to respond to a request for an accounting of disclosures under 45 C.F.R. § 164.528, and will provide such information to Covered Entity upon request to the extent required by HIPAA.
To the extent Business Associate performs an obligation of Covered Entity under the HIPAA Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to Covered Entity in the performance of that obligation.
Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI received from, created for, or received on behalf of Covered Entity available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance with HIPAA.
Covered Entity will not request Business Associate to use or disclose PHI in a manner that would not be permissible under HIPAA if performed by Covered Entity, except where HIPAA permits a business associate to use or disclose PHI for the business associate's management, administration, or legal responsibilities. Covered Entity is responsible for providing Business Associate with any limitations in its privacy practices, permissions, or restrictions that materially affect Business Associate's permitted use or disclosure of PHI.
Covered Entity represents that the person accepting this BAA on its behalf is authorized to bind Covered Entity to this BAA.
This BAA begins when accepted by Covered Entity and remains in effect while Business Associate creates, receives, maintains, or transmits PHI on behalf of Covered Entity, unless terminated in accordance with the parties' applicable service agreement or this BAA.
If either party becomes aware of a material breach of this BAA by the other party, it may provide an opportunity to cure the breach where appropriate. If a material breach is not cured, or cure is not feasible, the non-breaching party may terminate the applicable relationship to the extent required or permitted by HIPAA.
Upon termination of the applicable service relationship, Business Associate will, if feasible, return or destroy PHI received from Covered Entity or created, maintained, or received on behalf of Covered Entity that Business Associate still maintains in any form, and retain no copies, except to the extent retention is Required by Law or return or destruction is infeasible. Where PHI is retained, the protections of this BAA will continue to apply and further uses and disclosures will be limited to the purposes that make return or destruction infeasible or that are Required by Law.
The parties will interpret this BAA consistently with HIPAA. If applicable law changes in a manner that requires amendment of this BAA, the parties will cooperate in good faith to make the amendments reasonably necessary for continued compliance.
Nothing in this BAA is intended to permit either party to use or disclose PHI in a manner prohibited by applicable law. Any ambiguity will be resolved in favor of a meaning that permits the parties to comply with HIPAA.
Covered Entity may execute this BAA electronically. By affirmatively accepting this BAA through RemitMend's account-creation process, the individual accepting it represents that the individual has authority to bind Covered Entity and agrees that the electronic acceptance constitutes Covered Entity's execution of this BAA.
This BAA supplements the agreement governing Covered Entity's use of the RemitMend Services. If a provision of that agreement conflicts with this BAA concerning the use, disclosure, or safeguarding of PHI, this BAA controls to the extent of the conflict.
Business Associate: RemitMend LLC
BAA version: 2026-10-04