Version 2026-10. This agreement is between Vantage Health ("Business Associate") and the licensed professional or practice that creates a provider account ("Covered Entity"). It is accepted at sign up together with the Terms of Service and applies from the moment any protected health information is placed in the service.
Covered Entity uses the Vantage Health service to schedule, document, bill and communicate with its patients, which requires Business Associate to create, receive, maintain and transmit protected health information ("PHI") on Covered Entity's behalf. Terms used here have the meaning given in the HIPAA Privacy, Security and Breach Notification Rules (45 CFR Parts 160 and 164), as amended, including by the HITECH Act.
Business Associate may use and disclose PHI only to provide the service to Covered Entity, as this agreement allows, or as the law requires. Business Associate may use PHI for its own management and administration and to carry out its legal responsibilities, and may de-identify PHI in accordance with 45 CFR 164.514. Business Associate will not sell PHI or use it for marketing, and will not use or disclose PHI in a way that would be unlawful if done by Covered Entity.
Business Associate will keep appropriate administrative, physical and technical safeguards that comply with the Security Rule, including encryption of PHI in transit and at rest, access limited to staff who need it, unique sign ins, logging of access to records, and hosting on infrastructure covered by a business associate agreement with the hosting provider. Automated processing (transcription, drafting, image generation) is performed only within that covered infrastructure.
Business Associate will ensure that any subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions and conditions that apply to Business Associate under this agreement. Payment processing is handled by Stripe under Covered Entity's own agreement with Stripe; Business Associate sends Stripe no clinical information.
Business Associate will report to Covered Entity, without unreasonable delay and no later than ten business days after discovery, any use or disclosure of PHI not permitted by this agreement, any security incident involving PHI, and any breach of unsecured PHI as defined at 45 CFR 164.402, with the information Covered Entity needs to meet its own notification duties. Unsuccessful attempts such as blocked log in attempts, port scans and malware that is stopped before it reaches PHI are reported in aggregate on request.
Within ten business days of a request from Covered Entity, Business Associate will make PHI available so that Covered Entity can meet its duties to give individuals access to their information, to amend it, and to account for disclosures, as set out at 45 CFR 164.524, 164.526 and 164.528. Requests received directly from an individual will be forwarded to Covered Entity.
Covered Entity will obtain any consent or authorisation needed for the uses it makes of the service, including the recording of sessions, will tell Business Associate of any restriction it has agreed to with an individual that affects Business Associate's use of PHI, and will not ask Business Associate to use or disclose PHI in a way Covered Entity could not do itself.
Business Associate will make its internal practices, books and records relating to PHI available to the Secretary of Health and Human Services for the purpose of determining compliance with HIPAA. Business Associate will carry out any of Covered Entity's obligations under the Privacy Rule that it has taken on, in the way the Privacy Rule requires of Covered Entity.
This agreement runs for as long as Covered Entity has a provider account. Either party may terminate it if the other materially breaches it and does not cure the breach within thirty days of written notice. On termination Business Associate will return PHI to Covered Entity in a usable export, or destroy it where return is not feasible, and will keep no copies except where the law requires retention, in which case the protections of this agreement continue for as long as the PHI is kept.
This agreement is to be read so as to comply with HIPAA; where a term is ambiguous, the reading that complies governs. It will be amended as needed to keep up with changes in the law, and the current version is the one published at this address. It takes precedence over the Terms of Service for anything concerning PHI.
This is the first published version of this agreement and is under legal review. Material changes will be issued as a new version and presented for acceptance.
