Business Associate Agreement
Last updated: October 30, 2026
This Business Associate Agreement ("Agreement") is between the subscribing practice ("Covered Entity") and Orient Innovations, 7100 Foundry Row, Suite 288-51, Liberty Township, OH 45069, the owner of ClinoraSys ("Business Associate"), and applies whenever Business Associate creates, receives, maintains or transmits protected health information ("PHI") on Covered Entity's behalf in providing the Service. Terms used but not defined here have the meanings given in the HIPAA Rules (45 CFR Parts 160 and 164).
1. Permitted uses and disclosures
Business Associate may use and disclose PHI only to provide the Service to Covered Entity, as required by law, or for its own proper management and administration as permitted by 45 CFR 164.504(e)(4). It will request, use and disclose only the minimum necessary.
2. Safeguards
Business Associate will use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 CFR Part 164 for electronic PHI, to prevent use or disclosure other than as this Agreement provides.
3. Reporting
Business Associate will report to Covered Entity any use or disclosure not provided for by this Agreement, any security incident, and any breach of unsecured PHI as required by 45 CFR 164.410, without unreasonable delay and no later than 30 days after discovery.
4. Subcontractors
Business Associate will ensure that any subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions and conditions.
5. Individual rights
Business Associate will make PHI available for access and amendment, and provide the information required for an accounting of disclosures, as Covered Entity needs to meet its obligations under 45 CFR 164.524, 164.526 and 164.528.
6. Books and records
Business Associate will make its internal practices, books and records relating to PHI available to the Secretary of HHS for determining compliance with the HIPAA Rules.
7. Term and termination
This Agreement lasts as long as the subscription. Covered Entity may terminate it if Business Associate materially breaches it and does not cure the breach within 30 days. On termination, Business Associate will return or destroy all PHI where feasible, and otherwise extend this Agreement's protections to it for as long as it is retained.
8. Miscellaneous
This Agreement is interpreted to permit compliance with the HIPAA Rules, and will be amended as needed to comply with changes to them. Accepting it online, when subscribing, is an electronic signature on behalf of Covered Entity.