Business Associate Agreement
Last updated: July 2026
This Business Associate Agreement (“Agreement”) is entered into between the home-care agency accepting it (“Covered Entity”) and Vanguard Veil Limited, operator of Oncu (“Business Associate”), and governs the Business Associate’s handling of Protected Health Information (“PHI”) under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively, “HIPAA”). Capitalized terms not defined here have the meanings given in 45 CFR Parts 160 and 164.
1. Permitted uses and disclosures
Business Associate may use and disclose PHI only as necessary to perform the visit- compliance detection, reminder, and reporting services the Covered Entity has engaged it to provide, or as Required by Law. Business Associate will not use or disclose PHI in a manner that would violate HIPAA if done by the Covered Entity. Outbound messages are engineered to contain no PHI.
2. Safeguards
Business Associate will implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of PHI, including access controls, encryption in transit, tenant isolation enforced at the database (row-level security), and an immutable audit log. Source EVV data is never modified.
3. Minimum necessary
Business Associate will make reasonable efforts to use, disclose, and request only the minimum PHI necessary to accomplish the intended purpose.
4. Subcontractors
Business Associate will require any subcontractor that creates, receives, maintains, or transmits PHI on its behalf to agree in writing to restrictions and conditions at least as protective as those in this Agreement. [List Business Associate’s hosting and infrastructure subprocessors here.]
5. Reporting and breach notification
Business Associate will report to the Covered Entity any use or disclosure of PHI not permitted by this Agreement, any Security Incident, and any Breach of Unsecured PHI without unreasonable delay and no later than [30] calendar days after discovery, and will cooperate in the Covered Entity’s breach-assessment and notification obligations.
6. Individual rights
Business Associate will make PHI available to enable the Covered Entity to meet its obligations regarding individuals’ rights of access, amendment, and accounting of disclosures under 45 CFR 164.524, 164.526, and 164.528.
7. Access by HHS
Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of Health and Human Services as required to determine the Covered Entity’s compliance with HIPAA.
8. Term and termination
This Agreement is effective on the date of acceptance and continues until all PHI is returned or destroyed. The Covered Entity may terminate for a material breach that Business Associate fails to cure within [30] days of notice.
9. Return or destruction of PHI
Upon termination, Business Associate will, if feasible, return or destroy all PHI it maintains on the Covered Entity’s behalf and retain no copies; where return or destruction is infeasible, it will extend the protections of this Agreement to that PHI and limit further use to the purposes that make return or destruction infeasible.
10. Miscellaneous
This Agreement will be interpreted to permit compliance with HIPAA. In the event of a conflict, the interpretation that allows the Covered Entity to comply with HIPAA controls. Acceptance is recorded electronically with the accepting user’s identity and a timestamp in Business Associate’s audit log.