Version 2026-10. Signed electronically in the Heartwood portal by an authorized representative of each hospice.
This Business Associate Agreement ("Agreement") is between the hospice that signs it in the Heartwood portal ("Covered Entity") and Heartwood Letters, an AMVO Studios company ("Business Associate"). It applies to protected health information ("PHI") that Business Associate creates, receives, maintains or transmits on behalf of Covered Entity in providing bereavement letter services.
Business Associate may use and disclose PHI only to perform the bereavement letter services, as required by law, or for its proper management and administration as allowed by 45 CFR 164.504(e). Business Associate will use, disclose and request only the minimum PHI necessary.
Business Associate will use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 CFR Part 164, to prevent use or disclosure of PHI other than as this Agreement provides, including encryption of PHI at rest and in transit and logging of access.
Business Associate will report to Covered Entity any use or disclosure of PHI not provided for by this Agreement, including any breach of unsecured PHI as required by 45 CFR 164.410, without unreasonable delay and in no case later than 30 calendar days after discovery, and any security incident of which it becomes aware.
Business Associate will ensure that any subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions and conditions that apply to Business Associate.
Business Associate will make PHI available to Covered Entity as needed for Covered Entity to meet its obligations for access (45 CFR 164.524), amendment (164.526) and accounting of disclosures (164.528), within 15 days of a request.
Business Associate will make its internal practices, books and records relating to PHI available to the Secretary of Health and Human Services to determine compliance with HIPAA.
This Agreement lasts as long as Business Associate holds PHI for Covered Entity. Covered Entity may terminate it if Business Associate materially breaches it and fails to cure the breach within 30 days. On termination, Business Associate will return or destroy all PHI it still holds, or, if that isn't feasible, extend this Agreement's protections to it.
Terms used here have the meanings given in HIPAA (45 CFR Parts 160 and 164). This Agreement is interpreted to permit compliance with HIPAA, and it controls over any conflicting term between the parties.
Questions about this Agreement, or need your organization's own BAA form reviewed? Write to hello@heartwoodletters.com.
Heartwood Letters