Clincor Business Associate Agreement
Form effective September 21, 2026. To be completed and signed by both parties before any protected health information is processed through Clincor's secure transcription or drafting.
This Business Associate Agreement ("Agreement") is entered into between [Practice legal name], a [state and entity type] with its principal office at [practice address] ("Covered Entity"), and Coach OS LLC, a Florida limited liability company (document number L26000444666), Miami, Florida ("Business Associate"), effective on the date of the last signature below.
1. Background
Covered Entity uses Clincor, clinical documentation software provided by Business Associate under the Clincor Terms of Service (the "Service Agreement"). In providing secure transcription and optional drafting assistance, Business Associate may create, receive, maintain or transmit protected health information on behalf of Covered Entity. The parties enter this Agreement to comply with the Health Insurance Portability and Accountability Act of 1996, the HITECH Act, and their implementing regulations at 45 C.F.R. Parts 160 and 164 (together, "HIPAA").
2. Definitions
Capitalized terms not defined here have the meanings given in HIPAA, including Breach, Designated Record Set, Electronic Protected Health Information, Individual, Protected Health Information ("PHI"), Required by Law, Secretary, Security Incident, Subcontractor and Unsecured PHI.
3. Permitted uses and disclosures
3.1 Business Associate may use and disclose PHI only to perform the services in the Service Agreement: receiving dictation audio, transcribing it, returning text to Covered Entity, and, where Covered Entity switches it on, returning drafting assistance.
3.2 Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities, and may disclose PHI for those purposes if the disclosure is Required by Law or Business Associate obtains reasonable written assurances from the recipient as required by 45 C.F.R. § 164.504(e)(4).
3.3 Business Associate will not use or disclose PHI in any way that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, will limit uses, disclosures and requests to the minimum necessary, will not sell PHI, and will not use PHI to train any machine-learning model.
4. Safeguards
4.1 Business Associate will use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 C.F.R. Part 164, to protect Electronic PHI.
4.2 PHI is processed only in an Amazon Web Services account covered by Business Associate's business associate addendum with Amazon Web Services, encrypted in transit and at rest. Clinical records created in Clincor are stored on Covered Entity's own computers and are not held by Business Associate.
4.3 Dictation audio held for transcription is deleted within thirty (30) days of receipt.
5. Subcontractors
Business Associate will ensure that any Subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions and conditions that apply to Business Associate. Covered Entity acknowledges Amazon Web Services, Inc. as a Subcontractor under its business associate addendum with Business Associate.
6. Reporting
6.1 Business Associate will report to Covered Entity any use or disclosure of PHI not provided for by this Agreement, and any Security Incident of which it becomes aware. Unsuccessful attempts that do not result in unauthorized access (such as pings, port scans and blocked sign-in attempts) are reported by this sentence and need no further notice.
6.2 Business Associate will notify Covered Entity of a Breach of Unsecured PHI without unreasonable delay and no later than thirty (30) calendar days after discovery, with the information required by 45 C.F.R. § 164.410 as it becomes available.
7. Individual rights
7.1 To the extent Business Associate maintains PHI in a Designated Record Set, it will, within fifteen (15) business days of Covered Entity's request, make PHI available for access and amendment as required by 45 C.F.R. §§ 164.524 and 164.526.
7.2 Business Associate will document disclosures and provide the information Covered Entity needs to give an accounting under 45 C.F.R. § 164.528 within fifteen (15) business days of request.
7.3 Business Associate will forward to Covered Entity, within five (5) business days, any request it receives directly from an Individual.
8. Books and records
Business Associate will make its internal practices, books and records relating to PHI available to the Secretary for purposes of determining compliance with HIPAA.
9. Covered Entity obligations
Covered Entity will obtain any consents or authorizations required for Business Associate's services, notify Business Associate of any restriction or change in permission that affects Business Associate's use of PHI, and not ask Business Associate to use or disclose PHI in a way HIPAA would not permit Covered Entity to.
10. Term and termination
10.1 This Agreement runs until the Service Agreement ends and all PHI is returned or destroyed under section 10.3.
10.2 If either party determines the other has materially breached this Agreement, it may give written notice and an opportunity to cure within thirty (30) days, and terminate this Agreement and the Service Agreement if the breach is not cured.
10.3 On termination Business Associate will return or destroy all PHI it maintains in any form and retain no copies. If return or destruction is not feasible, the protections of this Agreement continue for as long as the PHI is retained.
11. General
11.1 Any ambiguity is resolved in favor of a meaning that permits compliance with HIPAA. A reference to a regulation means the regulation as amended.
11.2 This Agreement is governed by federal law and, where not preempted, the laws of the State of Florida.
11.3 Nothing in this Agreement gives any third party any right or remedy.
11.4 If this Agreement conflicts with the Service Agreement on the handling of PHI, this Agreement controls.
Signatures
Covered Entity: [Practice legal name]
Signature: ______________________________ Name: ______________________ Title: ______________________ Date: __________
Business Associate: Coach OS LLC
Signature: ______________________________ Name: ______________________ Title: ______________________ Date: __________