Skip to content

Business Associate Contracts and Other Arrangements (Administrative)

Last 1 Enterprises LLC / LastVet Safeguard category: Administrative HIPAA Security Rule citation: 45 CFR §164.308(b)(1) Status: Scaffold (Bucket 1c). Not approved for enforcement until Ryan review.

Document metadata

Field Value
Policy owner TODO (Ryan)
Version 0.1-scaffold
Effective date TODO (Ryan)
Review cadence Annual (TODO: Ryan confirm)
Approver TODO (Ryan)
Last reviewed 2026-08-26 (scaffold only)

1. Purpose

Require written contracts or other arrangements with business associates that create, receive, maintain, or transmit ePHI on LastVet's behalf.

2. Scope

Vendors and partners handling LastVet ePHI or providing services to covered activities.

3. Policy statements

  1. LastVet shall maintain BAAs (or equivalent) with each business associate before ePHI is disclosed to that associate.
  2. Contracts shall include required Security Rule flow-down provisions per §164.314(a).
  3. TODO (Ryan): Maintain BAA inventory (AWS executed; B2 planned; email/SendGrid TBD [Depends on 1a §4 TODO 7]).

4. Roles and responsibilities

Role Responsibility
Security Officer (Ryan) TODO (Ryan): assign formal Security Rule responsible person per §164.308(a)(2)
Workforce members TODO (Ryan): acknowledge policy when hired / annually
Contractors / BAs TODO (Ryan): flow-down via BAA and agreements

5. LastVet-specific context (from existing docs)

Muster: Ryan fully on-prem; downstream BA chain simpler than AWS era. WSGR drafting provider agreement + standalone BAA. AWS BAA executed for legacy account. Nguyen (WSGR) reviewing on-prem sole-custody posture.

7. Ryan TODO (substantive content deferred)

  • BAA inventory table with vendor, status, renewal date.
  • Provider BAA template alignment with WSGR draft.
  • Confirm whether colo move requires facility BAA (1a §4 TODO 8).