Skip to content

Business Associate Agreements (Organizational Requirements)

Last 1 Enterprises LLC / LastVet Safeguard category: Organizational HIPAA Security Rule citation: 45 CFR §164.314(a)(1) Status: Scaffold (Bucket 1c). Not approved for enforcement until Ryan review.

Document metadata

Field Value
Policy owner TODO (Ryan)
Version 0.1-scaffold
Effective date TODO (Ryan)
Review cadence Annual (TODO: Ryan confirm)
Approver TODO (Ryan)
Last reviewed 2026-08-26 (scaffold only)

1. Purpose

Ensure BA contracts meet organizational requirements for business associates.

2. Scope

All business associate relationships involving LastVet ePHI.

3. Policy statements

  1. BAAs shall include permitted uses and disclosures, safeguard requirements, subcontractor flow-down, breach reporting, and termination/return of ePHI.
  2. LastVet shall not disclose ePHI to a vendor without an executed BAA or statutory exception confirmed by counsel.
  3. Organizational BAA inventory shall align with administrative policy 09-admin-business-associate-contracts.md.

4. Roles and responsibilities

Role Responsibility
Security Officer (Ryan) TODO (Ryan): assign formal Security Rule responsible person per §164.308(a)(2)
Workforce members TODO (Ryan): acknowledge policy when hired / annually
Contractors / BAs TODO (Ryan): flow-down via BAA and agreements

5. LastVet-specific context (from existing docs)

WSGR provider agreement scope includes standalone BAA. On-prem posture may reduce subcontractor BA count (Muster Nguyen note). AWS BAA remains for legacy account.

7. Ryan TODO (substantive content deferred)

  • Subcontractor flow-down template.
  • BAA termination and data return procedure.
  • Angel/Neon and other org boundaries — confirm out of LastVet BAA scope.