Skip to content
Legal

Business Associate Agreement

Effective October 23, 2026 · Version 2026-10-23

How this agreement applies. Whether your firm needs a business associate agreement depends on its relationship to the records. A firm that provides legal services to a health care provider, health plan or other covered entity, and receives protected health information to do so, is generally that covered entity’s business associate; a vendor it uses to work with that information is then its subcontractor. When a customer that is a covered entity or a business associate accepts Medcron’s Terms of Service and provides protected health information, this agreement is part of those Terms. We will countersign a copy on request, or review your firm’s own form, at support@medcron.net.

This Business Associate Agreement (“BAA”) is between Medcron LLC (“Medcron”) and the customer that has accepted Medcron’s Terms of Service (“Customer”).

1. Definitions

Capitalized terms used but not defined in this BAA, including Breach, Designated Record Set, Disclosure, Individual, Minimum Necessary, Protected Health Information (“PHI”), Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information and Use, have the meanings given in the HIPAA Rules. “HIPAA Rules” means the Privacy, Security, Breach Notification and Enforcement Rules at 45 C.F.R. Parts 160 and 164. “Services” means the services Medcron provides to Customer under the Terms of Service.

If Customer is a business associate of a covered entity, Medcron is Customer’s Subcontractor, and this BAA applies to the PHI Customer provides in that capacity.

2. Obligations of Medcron

Medcron will:

  1. Not Use or Disclose PHI other than as permitted or required by this BAA or as Required by Law.
  2. Use appropriate safeguards, and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI, to prevent Use or Disclosure of PHI other than as provided for by this BAA.
  3. Report to Customer any Use or Disclosure of PHI not provided for by this BAA of which it becomes aware, including Breaches of Unsecured PHI as required by 45 C.F.R. § 164.410, and any Security Incident of which it becomes aware, without unreasonable delay and in no case later than ten (10) business days after discovery. A report of a Breach will identify each affected Individual to the extent known and include the other information Customer needs to notify Individuals under 45 C.F.R. § 164.404(c), provided at the time of the report or promptly as it becomes available. The parties agree that this paragraph is notice of the ongoing existence of unsuccessful Security Incidents, such as pings, port scans and blocked sign-in attempts, that do not result in unauthorized access to, or Use or Disclosure of, PHI, and that no further report of them is required.
  4. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractor that creates, receives, maintains or transmits PHI on Medcron’s behalf agrees in writing to the same restrictions, conditions and requirements that apply to Medcron under this BAA. Medcron does not currently use any Subcontractor to create, receive, maintain or transmit PHI.
  5. Within ten (10) business days of Customer’s request, make available PHI that Medcron maintains in a Designated Record Set, if any, as necessary for Customer to meet its obligations under 45 C.F.R. § 164.524.
  6. Within ten (10) business days of Customer’s request, make any amendment to PHI that Medcron maintains in a Designated Record Set, if any, as directed by Customer under 45 C.F.R. § 164.526.
  7. Maintain and, within ten (10) business days of Customer’s request, make available the information required for Customer to provide an accounting of Disclosures under 45 C.F.R. § 164.528.
  8. To the extent Medcron carries out any of Customer’s obligations under Subpart E of 45 C.F.R. Part 164, comply with the requirements of Subpart E that apply to Customer in performing those obligations.
  9. Make its internal practices, books and records relating to PHI available to the Secretary for purposes of determining compliance with the HIPAA Rules.
  10. Request, Use and Disclose only the Minimum Necessary PHI to perform the Services.
  11. Not sell PHI and not Use or Disclose PHI for marketing.
  12. Mitigate, to the extent practicable, any harmful effect known to Medcron of a Use or Disclosure of PHI in violation of this BAA.

3. Permitted Uses and Disclosures

  1. Medcron may Use and Disclose PHI only as necessary to perform the Services for Customer: reading and organizing records into a chronology, having a person review it, and delivering it to Customer.
  2. Medcron may Use PHI for its proper management and administration or to carry out its legal responsibilities, and may Disclose PHI for those purposes only if the Disclosure is Required by Law, or if Medcron obtains reasonable assurances from the recipient that the PHI will be held confidentially, Used or further Disclosed only as Required by Law or for the purpose for which it was Disclosed, and that the recipient will notify Medcron of any instance in which the confidentiality of the PHI has been breached.
  3. Medcron will not de-identify PHI for its own purposes, provide data aggregation services, or Use or Disclose PHI in any manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Customer, except as permitted by paragraph 2 of this Section.

4. Obligations of Customer

Customer will notify Medcron of any limitation in a notice of privacy practices, any change in or revocation of an Individual’s permission, and any restriction on Use or Disclosure agreed under 45 C.F.R. § 164.522, to the extent it affects Medcron’s Use or Disclosure of PHI. Customer will not ask Medcron to Use or Disclose PHI in any manner that would not be permissible under Subpart E of 45 C.F.R. Part 164 if done by Customer, and will provide only the Minimum Necessary PHI for the Services.

5. Term and termination

  1. Term. This BAA takes effect when Customer first provides PHI to Medcron after accepting the Terms of Service, or on the date of a countersigned copy if earlier, and continues until all PHI provided by Customer has been returned or destroyed under paragraph 3.
  2. Termination for cause. If Customer determines that Medcron has violated a material term of this BAA, Customer may terminate this BAA and the Services if Medcron does not cure the violation within thirty (30) days of written notice, or immediately if cure is not possible.
  3. Return or destruction. Medcron deletes each order’s PHI automatically 14 days after the order starts (when it is paid for, or started with a free order), or 14 days after it was created if it is never started, and encrypted backups containing it within 8 further days. On termination, Medcron will return or destroy any PHI it still maintains and retain no copies, and will certify the destruction in writing on request. If return or destruction of any PHI is infeasible, Medcron will extend the protections of this BAA to that PHI and limit further Uses and Disclosures to the purposes that make return or destruction infeasible, for as long as Medcron maintains it.
  4. Survival. Medcron’s obligations under paragraph 3 survive termination of this BAA.

6. Miscellaneous

  1. Regulatory references. A reference to a section of the HIPAA Rules means the section as in effect or as amended.
  2. Amendment. The parties will amend this BAA as necessary for compliance with the HIPAA Rules and any other applicable law. Medcron will post any updated version at medcron.net/baa and notify Customer by email.
  3. Interpretation. Any ambiguity in this BAA will be resolved to permit compliance with the HIPAA Rules. If this BAA conflicts with the Terms of Service regarding PHI, this BAA controls.
  4. Liability. The limitations of liability in the Terms of Service apply to this BAA, except to the extent prohibited by law.
  5. No third-party beneficiaries. Nothing in this BAA confers any rights on any person other than Customer and Medcron.

7. Contact

Medcron LLC
385 S. Manchester Ave., Apt. 1073
Orange, CA 92868
support@medcron.net