Healthcare Software Terms of Service Scanner

Covered entities must have a BAA with vendors handling PHI. Your ToS should reference or incorporate BAA terms covering permitted uses, safeguards, and breach notification.

Describe administrative, physical, and technical safeguards for PHI. Include encryption standards, access controls, audit logging, and workforce training requirements.

HIPAA requires notification of affected individuals within 60 days of a breach. Define breach procedures, notification timelines, and responsibilities between parties.

Specify permitted uses of PHI (treatment, payment, operations). Apply minimum necessary standard. Address subcontractor requirements and prohibition on unauthorized uses.

HIPAA requires retaining records for 6 years. Define retention periods, secure destruction methods, and return/destruction of PHI upon termination.

Address patient rights to access, amend, and receive accounting of disclosures. Define authorization requirements for uses beyond treatment, payment, and operations.