Business Associate Agreement

Every clinic’s authorized representative accepts this agreement in the Behavior Plan Pro app before the clinic adds client information. This page shows the current version.

Version: 2026-10-23.2
Effective Date: When Covered Entity accepts this Agreement electronically
Last Updated: October 23, 2026

IMPORTANT: THIS AGREEMENT GOVERNS THE USE, DISCLOSURE, SECURITY, AND PROTECTION OF PROTECTED HEALTH INFORMATION UNDER HIPAA.

This Business Associate Agreement ("Agreement" or "BAA") is entered into by and between:

Business Associate:
Behavior Plan Pro
Georgia 31313, United States
Email: contact@behaviorplanpro.com

and

Covered Entity:
The healthcare clinic, practice, or organization identified in the electronic execution record associated with this Agreement ("Covered Entity," "Customer," or "Clinic").

The Business Associate and Covered Entity may individually be referred to as a "Party" and collectively as the "Parties."

RECITALS

WHEREAS, Covered Entity provides healthcare or related clinical services and may be subject to the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA");

WHEREAS, Business Associate provides a cloud-based software platform supporting applied behavior analysis ("ABA") documentation, behavior intervention plans, assessments, staff collaboration, caregiver resources, and related clinical workflows;

WHEREAS, Business Associate may create, receive, maintain, or transmit Protected Health Information ("PHI") on behalf of Covered Entity in connection with providing the Service;

WHEREAS, the Parties intend to comply with applicable requirements of HIPAA, the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), and the implementing regulations;

NOW, THEREFORE, the Parties agree as follows.

1. DEFINITIONS

1.1 HIPAA Terms

Unless otherwise defined, the following terms have the meanings assigned under 45 CFR Parts 160 and 164:

• Breach.
• Business Associate.
• Covered Entity.
• Data Aggregation.
• Designated Record Set.
• Disclosure.
• Electronic Protected Health Information ("ePHI").
• Health Care Operations.
• Individual.
• Minimum Necessary.
• Protected Health Information ("PHI").
• Required by Law.
• Secretary.
• Security Incident.
• Subcontractor.
• Unsecured Protected Health Information.
• Use.

1.2 HIPAA Rules

"HIPAA Rules" means the Privacy, Security, Breach Notification, and Enforcement Rules codified at 45 CFR Parts 160 and 164, as amended.

1.3 Service

"Service" means the Behavior Plan Pro application, associated hosting infrastructure, clinical documentation features, authorized AI-assisted functions, and related services provided under the applicable Terms of Service.

1.4 Subcontractor

"Subcontractor" means a person or entity to whom Business Associate delegates a function, activity, or service involving the creation, receipt, maintenance, or transmission of PHI on behalf of Covered Entity.

1.5 Security Incident

"Security Incident" has the meaning provided under 45 CFR § 164.304.

1.6 Unsecured PHI

"Unsecured PHI" has the meaning assigned under 45 CFR § 164.402 and applicable guidance.

2. OBLIGATIONS OF BUSINESS ASSOCIATE

2.1 Permitted Uses and Disclosures

Business Associate shall not use or disclose PHI except as expressly permitted by this Agreement, the HIPAA Rules, or as Required by Law.

2.2 Safeguards

Business Associate shall implement appropriate administrative, physical, and technical safeguards to protect PHI from unauthorized use or disclosure.

For ePHI, Business Associate shall comply with the applicable requirements of the HIPAA Security Rule under 45 CFR Part 164, Subpart C.

2.3 Security Risk Management

Business Associate shall conduct and document risk analysis and risk management activities as required by the HIPAA Security Rule.

Business Associate shall address identified risks through appropriate safeguards, policies, procedures, and corrective actions.

2.4 Access Controls

Business Associate shall maintain appropriate access control mechanisms designed to restrict PHI access to authorized personnel and systems.

Business Associate shall implement safeguards consistent with applicable requirements for unique user identification, authentication, audit controls, and access authorization.

2.5 Workforce Confidentiality

Business Associate shall require personnel with authorized PHI access to comply with applicable confidentiality and security obligations.

2.6 Minimum Necessary

Business Associate shall limit its uses, disclosures, and requests for PHI to the minimum necessary to accomplish the intended purpose, where the minimum necessary standard applies.

2.7 Subcontractor Compliance

Business Associate shall ensure that any Subcontractor creating, receiving, maintaining, or transmitting PHI on its behalf agrees in writing to the applicable restrictions, conditions, and requirements imposed on Business Associate.

Such agreements shall comply with applicable requirements of 45 CFR §§ 164.502(e), 164.504(e), and 164.308(b).

Business Associate remains responsible for meeting its own obligations under this Agreement when using Subcontractors.

3. PERMITTED USES AND DISCLOSURES OF PHI

3.1 Provision of Services

Business Associate may use and disclose PHI as reasonably necessary to provide the contracted Service, including:

1. Securely storing and retrieving clinical documentation.
2. Creating, editing, and organizing behavior intervention plans.
3. Supporting authorized assessments and clinical workflows.
4. Displaying information to authorized clinic personnel.
5. Supporting approved caregiver access.
6. Generating clinical documents at the direction of authorized users.
7. Providing authorized AI-assisted documentation functions.
8. Maintaining system security, availability, and audit records.
9. Providing authorized technical support.
10. Exporting or returning Customer Data.

These activities must comply with the HIPAA Rules and this Agreement.

3.2 Management and Administration

Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities, as permitted by 45 CFR § 164.504(e).

Business Associate may disclose PHI for those purposes only when Required by Law or when it obtains the reasonable assurances required by the HIPAA Rules concerning confidentiality, limited further use and disclosure, and notification of confidentiality breaches.

3.3 Required Disclosures

Business Associate may disclose PHI when Required by Law, subject to applicable HIPAA requirements.

3.4 Prohibited Uses

Business Associate shall not:

• Sell PHI.
• Use PHI for independent advertising or marketing.
• Use identifiable PHI to train general-purpose AI models without separate lawful authorization and required contractual protections.
• Disclose PHI to unauthorized third parties.
• Access PHI for purposes unrelated to permitted services or legal obligations.
• De-identify PHI for its independent commercial purposes without a separate written agreement and lawful authorization.

3.5 Restrictions on Use

Business Associate shall not use or disclose PHI in a manner that would violate the HIPAA Privacy Rule if performed by Covered Entity, except as expressly permitted for business associate activities under applicable law.

4. ARTIFICIAL INTELLIGENCE AND AUTOMATED PROCESSING

4.1 Authorized AI Functions

The Service may offer AI-assisted documentation tools that help authorized clinicians prepare, organize, summarize, or revise clinical materials.

AI processing involving PHI shall be limited to functions authorized by Covered Entity and permitted by this Agreement.

4.2 Third-Party AI Providers

Business Associate shall not transmit PHI to an external AI provider unless the processing is legally permitted and the provider is subject to all required contractual safeguards, including a compliant subcontractor BAA where applicable.

4.3 AI Model Training Restrictions

Business Associate shall not use Covered Entity's identifiable PHI to train general-purpose AI models for independent commercial purposes.

Any materially different use shall require separate lawful authorization and compliance with applicable HIPAA requirements.

4.4 Human Clinical Oversight

AI-generated content is intended to support, not replace, professional clinical judgment.

Covered Entity retains responsibility for reviewing, verifying, and approving clinical documentation and treatment recommendations.

This allocation of clinical responsibility does not reduce Business Associate's independent privacy or security obligations.

4.5 AI Security and Retention

Business Associate shall apply appropriate safeguards to PHI processed through AI-assisted functions.

Any AI-related retention, logging, or disclosure of PHI must be permitted by this Agreement and applicable law.

5. SECURITY INCIDENTS AND BREACH NOTIFICATION

5.1 Incident Reporting

Business Associate shall report to Covered Entity any use or disclosure of PHI not permitted by this Agreement of which Business Associate becomes aware, including breaches of unsecured PHI as required by 45 CFR § 164.410.

Business Associate shall also report Security Incidents in accordance with this section.

5.2 Breach Notification Deadline

Business Associate shall notify Covered Entity of a discovered Breach of Unsecured PHI without unreasonable delay and no later than 10 business days after discovery.

This contractual reporting deadline does not extend any shorter deadline required by applicable law.

Discovery shall be determined in accordance with the HIPAA Breach Notification Rule.

5.3 Notification Contents

To the extent available, the notification shall include:

• A description of the incident.
• The date of the incident, if known.
• The date of discovery.
• Categories of PHI involved.
• Identification of affected individuals, where available.
• Actions taken to investigate and contain the incident.
• Measures taken or proposed to mitigate harm.
• Available information reasonably necessary for Covered Entity to meet its notification obligations.

5.4 Supplemental Information

If complete information is unavailable at the time of the initial report, Business Associate shall provide available information promptly and supplement the report as additional material facts become known.

5.5 Incident Cooperation

Business Associate shall reasonably cooperate with Covered Entity in investigating reportable incidents, mitigating harm, and satisfying applicable legal obligations.

5.6 Unsuccessful Security Incidents

The Parties acknowledge that routine unsuccessful attempts, including blocked login attempts, unsuccessful network scans, and similar events that do not result in unauthorized access, use, disclosure, modification, or destruction of PHI, may occur.

Covered Entity acknowledges and accepts this section as standing notice of such routine unsuccessful Security Incidents.

Business Associate shall maintain appropriate records and provide additional information upon reasonable request where required by law or this Agreement.

This provision does not excuse reporting of incidents that otherwise require notification.

5.7 Individual and Regulatory Notifications

Unless otherwise required by law or separately agreed in writing, Covered Entity shall be responsible for notifications to affected individuals, the Secretary, and the media, where applicable.

Business Associate shall provide the information and cooperation required by the HIPAA Rules.

6. SUBCONTRACTORS AND CLOUD INFRASTRUCTURE

6.1 Cloud Hosting

Business Associate uses Amazon Web Services ("AWS") for cloud infrastructure and related application services.

Where AWS creates, receives, maintains, or transmits PHI on Business Associate's behalf, Business Associate shall maintain applicable contractual protections and use AWS services consistent with its business associate arrangements and HIPAA obligations.

6.2 Additional Subcontractors

Business Associate may engage additional Subcontractors to support hosting, security, technical operations, or authorized AI processing.

Any Subcontractor processing PHI must be subject to the required written agreement before receiving such information.

6.3 Responsibility for Subcontractors

Business Associate shall take reasonable steps required by HIPAA when it becomes aware of a material pattern of activity or practice by a Subcontractor that constitutes a breach of the Subcontractor's obligations.

6.4 Changes to PHI Processing

Business Associate shall not introduce materially different PHI processing activities that are prohibited by this Agreement.

Material changes requiring contractual authorization shall be addressed before implementation.

7. ACCESS, AMENDMENT, AND ACCOUNTING

7.1 Access to PHI

To the extent Business Associate maintains PHI in a Designated Record Set on behalf of Covered Entity, Business Associate shall make such PHI available to Covered Entity as necessary to satisfy 45 CFR § 164.524.

7.2 Individual Requests

If Business Associate receives a request directly from an Individual for access to PHI, it shall forward the request to Covered Entity within five business days, unless applicable law requires a shorter period.

7.3 Amendments

Business Associate shall make PHI available for amendment and incorporate amendments as directed or agreed to by Covered Entity, in accordance with 45 CFR § 164.526.

7.4 Amendment Requests

Requests received directly from Individuals shall be forwarded to Covered Entity within five business days, unless a shorter period is required by law.

7.5 Accounting of Disclosures

Business Associate shall document and make available information necessary for Covered Entity to respond to requests for an accounting of disclosures under 45 CFR § 164.528.

7.6 Delegated Privacy Rule Duties

If Business Associate performs an obligation of Covered Entity under 45 CFR Part 164, Subpart E, Business Associate shall comply with the applicable requirements of that Subpart in performing the obligation.

8. OBLIGATIONS OF COVERED ENTITY

Covered Entity agrees to:

8.1 Lawful Collection and Disclosure

Maintain lawful authority to collect, use, and disclose PHI submitted to the Service.

8.2 Notices of Privacy Practices

Notify Business Associate of any limitation in Covered Entity's Notice of Privacy Practices under 45 CFR § 164.520 that may affect Business Associate's permitted uses or disclosures.

8.3 Changes in Authorization

Notify Business Associate of changes in, or revocations of, an Individual's authorization where such changes may affect Business Associate's permitted processing.

8.4 Restrictions

Notify Business Associate of applicable restrictions on the use or disclosure of PHI under 45 CFR § 164.522.

8.5 Authorized Users

Maintain appropriate authorization for personnel and caregivers who access the Service.

Covered Entity shall manage user permissions and promptly revoke access when authorization ends.

8.6 Prohibited Requests

Covered Entity shall not request Business Associate to use or disclose PHI in a manner that would violate the HIPAA Privacy Rule if performed by Covered Entity, except as permitted by the HIPAA Rules.

8.7 Clinical Responsibility

Covered Entity retains responsibility for clinical decision-making, professional supervision, treatment authorization, and compliance with applicable clinical and licensing standards.

9. ACCESS TO RECORDS BY THE SECRETARY

Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the United States Department of Health and Human Services for purposes of determining compliance with the HIPAA Rules.

Such access shall be provided as required by applicable law.

10. TERM AND TERMINATION

10.1 Effective Date

This Agreement becomes effective when Covered Entity's authorized representative accepts it electronically in the Service. Business Associate agrees to this Agreement by offering it for acceptance. This Agreement remains effective for as long as Business Associate creates, receives, maintains, or transmits PHI on behalf of Covered Entity, unless terminated in accordance with this Agreement.

10.2 Termination for Cause

If Covered Entity determines that Business Associate has materially breached this Agreement, Covered Entity may provide written notice describing the breach and an opportunity to cure within 30 days, where cure is feasible.

If Business Associate fails to cure the breach within the permitted period, Covered Entity may terminate this Agreement and the affected services.

Where cure is not feasible, Covered Entity may terminate the Agreement as permitted or required by the HIPAA Rules.

10.3 Infeasible Termination

Where termination is infeasible, Covered Entity shall take the actions required by applicable HIPAA provisions, including reporting to the Secretary where required.

10.4 Termination of Services

Termination or expiration of the underlying subscription shall trigger the applicable PHI return, destruction, or continued-protection obligations.

Subscription cancellation does not immediately eliminate either Party's HIPAA responsibilities.

11. RETURN, DESTRUCTION, AND RETENTION OF PHI

11.1 Return or Destruction

Upon termination of this Agreement, Business Associate shall, if feasible, return or destroy all PHI received from Covered Entity or created, received, or maintained on its behalf, including PHI held by Subcontractors.

Business Associate shall not retain copies except as permitted by applicable law and this Agreement.

11.2 Customer Data Export

Business Associate shall provide a reasonable means for Covered Entity to obtain available PHI in an agreed or supported export format.

The Parties shall coordinate the return or destruction process in a manner consistent with applicable legal and contractual obligations.

11.3 Infeasibility

If Business Associate determines that returning or destroying PHI is infeasible, Business Associate shall notify Covered Entity of the conditions making return or destruction infeasible.

11.4 Continued Safeguards

Where PHI cannot feasibly be returned or destroyed, Business Associate shall:

1. Continue to protect the PHI under this Agreement.
2. Limit further uses and disclosures to purposes that make return or destruction infeasible.
3. Maintain applicable safeguards for as long as the PHI is retained.
4. Destroy or return the information when doing so becomes feasible, subject to applicable law.

11.5 Backups

PHI contained in protected backups may remain subject to established backup retention and deletion procedures where immediate deletion is infeasible.

Such information shall remain protected and shall not be restored for ordinary business use except as permitted by this Agreement or required by law.

11.6 Subcontractor Data

Business Associate shall ensure that applicable return, destruction, and continued-protection obligations extend to Subcontractors that maintain PHI on its behalf.

11.7 Survival

The obligations of this section shall survive termination for as long as Business Associate or its Subcontractors retain PHI.

12. LIABILITY AND RESPONSIBILITY

12.1 Independent HIPAA Obligations

Each Party is responsible for complying with the HIPAA obligations directly applicable to it.

12.2 Clinical Decisions

Covered Entity retains responsibility for its clinical services, treatment decisions, professional supervision, and clinical documentation approval.

12.3 Business Associate Responsibilities

Business Associate remains responsible for its own contractual obligations and applicable HIPAA duties.

12.4 Relationship to Terms of Service

The limitations of liability and indemnification provisions in the Terms of Service shall apply only to the extent consistent with this Agreement and applicable law.

Nothing in the Terms of Service or this Agreement shall eliminate liability that cannot lawfully be waived or limited.

13. GENERAL PROVISIONS

13.1 Regulatory References

References to the HIPAA Rules include applicable amendments and successor provisions.

13.2 Amendment

The Parties shall amend this Agreement when reasonably necessary to comply with applicable changes in law.

Material amendments shall require legally valid agreement by both Parties.

Posting an updated BAA alone does not replace any required contractual acceptance.

13.3 Interpretation

Any ambiguity shall be interpreted in a manner that permits compliance with the HIPAA Rules.

13.4 No Third-Party Beneficiaries

Nothing in this Agreement creates contractual rights in persons other than the Parties.

13.5 Governing Law

This Agreement shall be governed by applicable federal law and, to the extent not preempted, the laws of the State of Georgia.

13.6 Severability

If any provision is determined unenforceable, the remaining provisions shall continue in effect to the extent legally permissible.

13.7 Order of Precedence

In the event of a conflict between this Agreement and the Terms of Service concerning PHI, this Agreement shall control.

13.8 Entire Agreement

This Agreement, together with applicable incorporated contractual provisions, constitutes the Parties' agreement regarding Business Associate obligations for PHI processed through the Service.

14. ELECTRONIC EXECUTION

14.1 Electronic Signatures

The Parties agree that this Agreement may be executed electronically in accordance with applicable electronic signature laws.

14.2 Authorized Signatory

Each person executing this Agreement represents that they possess authority to bind the applicable Party.

14.3 Signature Records

Behavior Plan Pro shall maintain an electronic record of execution, which may include:

• Legal name of the Covered Entity.
• Name and title of the authorized signatory.
• Business Associate legal name and authorized signatory.
• Agreement version.
• Agreement acceptance date and time.
• IP address.
• Applicable electronic signature or acceptance evidence.
• A retained copy of the executed Agreement.

14.4 Execution Before PHI Processing

Where a BAA is required, the Service shall not permit the Covered Entity to submit PHI until Covered Entity has validly accepted this Agreement.

15. NOTICES

All notices under this Agreement shall be sent to the designated contractual contacts.

Business Associate:
Behavior Plan Pro
Georgia 31313, United States
Email: contact@behaviorplanpro.com

Covered Entity:
Legal name, authorized contact, and email address as recorded during electronic execution.

Notices involving suspected or confirmed PHI breaches shall follow the reporting requirements of Section 5.

16. SIGNATURES

BUSINESS ASSOCIATE

Legal Name: Behavior Plan Pro
Authorized Representative: K. Peoples
Title: Owner

Business Associate agrees to this Agreement by offering it for electronic acceptance. No separate Business Associate signature is required.

COVERED ENTITY

Legal Clinic/Organization Name, Authorized Representative, Title, and Date: recorded when Covered Entity's authorized representative accepts this Agreement electronically in the Behavior Plan Pro app.