Business Associate Agreement
Last updated: July 10, 2026
This Business Associate Agreement ("BAA") supplements the Terms & Conditions between H2H Solutions, Inc. ("Business Associate") and the customer ("Covered Entity") and governs the handling of Protected Health Information (PHI) in connection with the H2H DigitalRx Services. It is intended to satisfy the requirements of HIPAA, the HITECH Act, and their implementing regulations (45 CFR Parts 160 and 164).
1. Definitions
Capitalized terms not defined here have the meanings given in the HIPAA Rules. "PHI" means Protected Health Information created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity.
2. Permitted Uses & Disclosures
Business Associate may use and disclose PHI only to perform the Services, as permitted by this BAA, or as Required by Law. Business Associate may use PHI for its proper management and administration and to carry out its legal responsibilities, and may de-identify PHI in accordance with the HIPAA Rules.
3. Obligations of Business Associate
- use appropriate administrative, physical, and technical safeguards, including those required by the HIPAA Security Rule, to protect PHI;
- not use or disclose PHI other than as permitted by this BAA or Required by Law;
- report to Covered Entity any use or disclosure not permitted by this BAA, including Breaches of Unsecured PHI, without unreasonable delay;
- make PHI available for access, amendment, and accounting of disclosures as required by 45 CFR 164.524, 164.526, and 164.528;
- make its internal practices, books, and records available to the Secretary of HHS for purposes of determining compliance.
4. Subcontractors
Business Associate will ensure that any subcontractors that create, receive, maintain, or transmit PHI on its behalf agree in writing to restrictions and conditions at least as protective as those in this BAA.
5. Breach Notification
Following discovery of a Breach of Unsecured PHI, Business Associate will notify Covered Entity without unreasonable delay and in any event within the timeframe required by law, and will provide the information reasonably necessary for Covered Entity to meet its own notification obligations.
6. Term & Termination
This BAA is effective for the duration of the underlying agreement. Upon termination, Business Associate will return or destroy all PHI where feasible; where return or destruction is not feasible, Business Associate will extend the protections of this BAA to such PHI and limit further uses and disclosures.
7. Interpretation
Any ambiguity in this BAA will be resolved to permit compliance with the HIPAA Rules. In the event of a conflict between this BAA and other terms regarding PHI, this BAA controls.
8. Contact & Execution
A countersigned copy of this BAA is provided as part of the service-agreement package during onboarding. Questions can be directed to:
H2H Solutions, Inc.
49197 Wixom Tech Drive, Suite B, Wixom, MI 48393, USA
+1 (248) 675-1200 · info@h2hsolutions.com
9. Service Suspension Never Restricts Access to Records (Plain-Language Summary)
This is a plain-language summary for customers; it does not replace the Business Associate Agreement above. If a subscription is suspended for non-payment, that suspension never restricts access to patient records, prescription history, or the ability to export data. Because H2H acts as a Business Associate under HIPAA, continued access to PHI for treatment and recordkeeping is preserved. Suspension pauses only the creation of new prescriptions, the addition of new patients, and the assignment of new seats; responding to pharmacy refill requests already received also remains available.
10. Records After Termination Availability, Retention & Destruction
After an account is terminated, patient records remain available on request. H2H retains PHI and prescribing records for seven (7) years under HIPAA-required safeguards, and fulfills valid record requests within thirty (30) days. When the retention period ends and no legal obligation to retain remains, records are securely destroyed. Where return or destruction of PHI is not feasible, the protections of the Business Associate Agreement continue to apply.