Template document — for legal-counsel review.
This page is boilerplate that CUBE OneCare customers and counsel are expected to adapt to their specific jurisdiction, use case, and contractual arrangements with CUBE Collective LLC. It is provided for transparency about the platform's policies and is not an executed agreement until separately signed.
Legal
Template BAA between Covered Entities and CUBE Collective LLC. The template becomes a binding agreement only when executed by authorized signatories of both parties.
Covered Entities onboarding to CUBE OneCare sign this Business Associate Agreement alongside the platform Service Agreement. This page publishes the current template; it becomes binding only once signed by both parties. No copy is issued until both parties have signed.
This Business Associate Agreement ("BAA") supplements the CUBE OneCare Terms of Service and is entered into between the Covered Entity and CUBE Collective LLC ("Business Associate"). It becomes effective on the date it is counter-signed by both parties.
The BAA governs the creation, receipt, maintenance, or transmission of Protected Health Information ("PHI") by Business Associate on behalf of Covered Entity as defined by the HIPAA Privacy, Security, and Breach-Notification Rules (45 CFR Parts 160 and 164).
Business Associate may use and disclose PHI only as permitted or required by this BAA, and only to:
Business Associate will not use or disclose PHI in a manner that would violate the Privacy Rule if done by Covered Entity directly.
Business Associate will implement and maintain:
Business Associate will enter into a written BAA with each subcontractor that creates, receives, maintains, or transmits PHI on its behalf, containing substantially the same obligations as this BAA. A current list of material subcontractors is maintained at /legal/subprocessors and customers will be notified at least 30 days before a new material subprocessor is added.
Business Associate will report to Covered Entity, without unreasonable delay and in no case later than sixty (60) calendar days after discovery:
Business Associate will cooperate with Covered Entity in mitigating any known harmful effect of a use or disclosure in violation of this BAA.
Business Associate will, within fifteen (15) business days of a documented request from Covered Entity, provide PHI necessary to satisfy Covered Entity's obligations under 45 CFR §§ 164.524 (access), 164.526 (amendment), and 164.528 (accounting of disclosures). Where Business Associate maintains PHI in a Designated Record Set electronically, access will be provided in the electronic form and format requested, or in a readable electronic form agreed by the parties.
This BAA becomes effective on execution and remains in effect while Business Associate maintains PHI received from, or created on behalf of, Covered Entity.
Upon termination of the underlying Service Agreement, Business Associate will return or destroy all PHI received from, created, or received by Business Associate on behalf of Covered Entity. If return or destruction is not feasible, Business Associate will extend the protections of this BAA to such PHI and limit further uses and disclosures to those purposes that make return or destruction infeasible.
Each party is responsible for its own non-compliance with HIPAA. Business Associate carries cyber-liability insurance in amounts customary for enterprise SaaS vendors in the healthcare industry, the certificate of which is available on written request. Indemnification and liability caps are governed by the underlying Service Agreement unless explicitly overridden in an order form.