BAA review draft · Not effective unless separately executed
Business Associate ("BA"): CaseNote Vault™, operated by AgencyVault OS.
Covered Entity ("CE"): The organization or entity that has entered into a subscription agreement with CaseNote Vault and is a Covered Entity or Business Associate under HIPAA.
Protected Health Information ("PHI"): Has the meaning given in 45 CFR § 160.103, limited to PHI created, received, maintained, or transmitted by CaseNote Vault on behalf of the Covered Entity.
Required by Law: Has the meaning given in 45 CFR § 164.103.
All other capitalized terms not defined herein have the meanings given in HIPAA (45 CFR Parts 160 and 164).
CaseNote Vault may use and disclose PHI only as necessary to:
CaseNote Vault will not use or disclose PHI for any purpose other than as permitted or required by this BAA, the Terms of Service, or as Required by Law. CaseNote Vault will not use or disclose PHI in a manner that would violate HIPAA if done by the Covered Entity.
Any executed BAA must accurately describe the safeguards supported by the final hosting and service arrangement. CaseNote Vault currently implements application-level controls including authenticated access, role-based authorization, organization-scoped data rules, workflow audit events, record finalization controls, and integrity protections for critical documentation workflows.
Infrastructure-specific assurances — including encryption standards, backup controls, breach procedures, subcontractor obligations, and independent certifications — must be verified and incorporated into the executed agreement as applicable. This review draft does not create those assurances by itself.
Security-incident and breach-notification obligations must be defined in the executed BAA and any applicable service agreement, consistent with applicable law and the responsibilities of the parties.
This review draft does not promise a contractual notification deadline. Agencies should confirm required timelines, notification contacts, and escalation procedures before regulated production use.
Before PHI is permitted, the parties must identify relevant service providers and determine whether downstream Business Associate obligations apply. Required agreements with subcontractors must be in place before those subcontractors handle PHI.
A current, verified subprocessor list and applicable contractual assurances should be supplied during the agency's security and legal review rather than inferred from this public draft.
To the extent required by HIPAA, upon written request from the Covered Entity, CaseNote Vault will assist the Covered Entity in responding to individuals' requests to:
The platform provides data export tools that the Covered Entity may use directly to fulfill many of these requests.
CaseNote Vault will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining the Covered Entity's and CaseNote Vault's compliance with HIPAA.
Term: An executed BAA becomes effective only on the effective date agreed to by authorized representatives. Merely visiting this page or using a pilot does not execute a BAA or authorize storage of PHI.
Termination for Cause: Either party may terminate this BAA if the other party materially breaches a provision and fails to cure the breach within 30 days of written notice.
Effect of Termination: Upon termination, if feasible, CaseNote Vault will return or destroy all PHI it maintains on behalf of the Covered Entity. If return or destruction is not feasible, CaseNote Vault will continue to apply the protections of this BAA to the PHI for as long as it is retained.
Return, export, retention, backup, and destruction obligations for PHI must be specified in the executed agreement based on the verified capabilities of the production infrastructure and the agency's legal retention requirements.
Amendment: This BAA may only be amended by mutual written agreement. Changes to HIPAA regulations that require modification of this BAA will be implemented upon 30 days' notice.
Interpretation: Any ambiguity in this BAA shall be resolved in a manner that permits the Covered Entity to comply with HIPAA.
Governing Law: This BAA shall be governed by the laws of the Commonwealth of Pennsylvania and applicable federal law.
Contact for BAA matters: compliance@casenotevault.com