Business Associate Agreement

Version: 2026-09-22 (draft, pending legal review)

Rescue Ally LLC signs this standard Business Associate Agreement with any HIPAA covered entity whose workforce documents patient care in Rescue Ally. It is the same agreement for every organization, offered at no charge.

How to execute it

  1. Download the agreement as a PDF.
  2. Fill in your organization's details and sign.
  3. Email the signed copy to support@rescueally.org. Include the name of your Rescue Ally team if you have already created one.
  4. We countersign and return the executed agreement within a few business days.

Questions about how Rescue Ally handles protected health information are answered on the Security and Privacy pages.

This Business Associate Agreement (the "Agreement") is entered into as of the date of the last signature below (the "Effective Date") between:

Covered Entity: ______________________________________ ("Covered Entity"), with its principal place of business at ______________________________________, and

Business Associate: Rescue Ally LLC, a Colorado limited liability company, with its principal place of business at 10451 Independence Cir, Broomfield, CO 80021 ("Business Associate").

1. Background

1.1. Business Associate provides the Rescue Ally mobile application and related cloud services (the "Services"), which members of Covered Entity's workforce use to document patient assessments, vital signs, treatments, and handoffs, and which store and synchronize those records on Business Associate's cloud infrastructure.

1.2. In providing the Services, Business Associate creates, receives, maintains, or transmits Protected Health Information on behalf of Covered Entity. The parties enter into this Agreement to comply with the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act, and their implementing regulations at 45 CFR Parts 160 and 164 (together, "HIPAA").

1.3. This Agreement applies to Protected Health Information that Covered Entity's workforce members enter into the Services while acting on behalf of Covered Entity. It does not apply to records a user creates in a personal capacity outside Covered Entity's direction, or to records marked as practice or training in the Services.

2. Definitions

2.1. Terms used but not otherwise defined in this Agreement have the meanings given in HIPAA, including "Breach," "Data Aggregation," "Designated Record Set," "Individual," "Protected Health Information" (PHI), "Required by Law," "Secretary," "Security Incident," "Subcontractor," and "Unsecured PHI."

2.2. "PHI" in this Agreement means PHI that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity.

2.3. "Electronic PHI" or "ePHI" means PHI transmitted by or maintained in electronic media.

3. Permitted Uses and Disclosures by Business Associate

3.1. Business Associate may use and disclose PHI only as necessary to perform the Services for Covered Entity, as permitted or required by this Agreement, or as Required by Law. Business Associate shall not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, except as set out in Sections 3.2 through 3.4.

3.2. Business Associate may use PHI for its proper management and administration and to carry out its legal responsibilities.

3.3. Business Associate may disclose PHI for its proper management and administration or to carry out its legal responsibilities, provided the disclosure is Required by Law, or Business Associate obtains reasonable written assurances from the recipient that the PHI will be held confidentially, used or further disclosed only as Required by Law or for the purposes for which it was disclosed, and that the recipient will notify Business Associate of any instance of which it is aware in which confidentiality has been breached.

3.4. Business Associate may de-identify PHI in accordance with 45 CFR 164.514(a) through (c). De-identified information is not PHI and may be used by Business Associate for any lawful purpose, including improving the Services. Business Associate shall not use identifiable PHI to train or improve any software model without Covered Entity's separate written authorization.

3.5. Business Associate may provide Data Aggregation services relating to the health care operations of Covered Entity.

3.6. Business Associate shall request, use, and disclose only the minimum PHI necessary to accomplish the intended purpose.

4. Obligations of Business Associate

4.1. Safeguards. Business Associate shall use appropriate administrative, physical, and technical safeguards, and shall comply with Subpart C of 45 CFR Part 164 with respect to ePHI, to prevent use or disclosure of PHI other than as provided for by this Agreement. Without limiting the foregoing, Business Associate encrypts PHI in transit and at rest, restricts access to production systems to authorized personnel using multi-factor authentication, and maintains access and audit logs.

4.2. Reporting. Business Associate shall report to Covered Entity any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, including any Breach of Unsecured PHI as required by 45 CFR 164.410, and any Security Incident of which it becomes aware. Business Associate shall make such reports without unreasonable delay and in no case later than ten (10) business days after discovery. Reports of Breaches shall include, to the extent known, the identification of each Individual whose Unsecured PHI has been or is reasonably believed to have been accessed, acquired, used, or disclosed, and the other information Covered Entity needs to meet its notification obligations under 45 CFR 164.404. The parties acknowledge that this Section constitutes notice of unsuccessful Security Incidents such as pings, port scans, and unsuccessful log-in attempts, for which no further notice is required.

4.3. Subcontractors. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate shall ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to the same restrictions, conditions, and requirements that apply to Business Associate under this Agreement. As of the Effective Date, Business Associate's only Subcontractor with access to PHI is Amazon Web Services, Inc., under a business associate agreement between Business Associate and Amazon Web Services.

4.4. Access. To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate shall make that PHI available to Covered Entity, through the export and administrative functions of the Services or otherwise within fifteen (15) business days of a written request, as necessary for Covered Entity to meet its obligations under 45 CFR 164.524.

4.5. Amendment. To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate shall make the amendments to PHI directed or agreed to by Covered Entity under 45 CFR 164.526, or shall enable Covered Entity's workforce to make them through the Services, within fifteen (15) business days of a written request.

4.6. Accounting of disclosures. Business Associate shall maintain and, within fifteen (15) business days of a written request, make available to Covered Entity the information required to provide an accounting of disclosures of PHI as necessary to satisfy Covered Entity's obligations under 45 CFR 164.528.

4.7. Covered Entity's obligations. To the extent Business Associate is to carry out one or more of Covered Entity's obligations under Subpart E of 45 CFR Part 164, Business Associate shall comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligations.

4.8. Books and records. Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining compliance with HIPAA.

4.9. Mitigation. Business Associate shall mitigate, to the extent practicable, any harmful effect known to Business Associate of a use or disclosure of PHI by Business Associate in violation of this Agreement.

5. Obligations of Covered Entity

5.1. Covered Entity shall notify Business Associate of any limitation in its notice of privacy practices under 45 CFR 164.520, any change in or revocation of an Individual's permission to use or disclose PHI, and any restriction on the use or disclosure of PHI that Covered Entity has agreed to under 45 CFR 164.522, in each case to the extent the limitation, change, or restriction may affect Business Associate's use or disclosure of PHI.

5.2. Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Covered Entity, except as permitted under Sections 3.2 through 3.5.

5.3. Covered Entity is responsible for the accounts and conduct of its workforce members within the Services, including designating team administrators, removing access when workforce members leave, and choosing the recipients of any records its workforce shares out of the Services by message, file export, or device-to-device transfer. Business Associate does not control the content or destination of shares initiated by Covered Entity's workforce.

5.4. Covered Entity shall obtain any consents or authorizations required for its workforce members to record patient encounters using the audio features of the Services.

6. Term and Termination

6.1. Term. This Agreement is effective as of the Effective Date and remains in effect for as long as Business Associate maintains PHI on behalf of Covered Entity, unless terminated earlier under this Section.

6.2. Termination for cause. Either party may terminate this Agreement if it determines that the other party has violated a material term of this Agreement and the other party has not cured the violation within thirty (30) days of written notice. Covered Entity may terminate this Agreement and its use of the Services immediately if cure is not possible.

6.3. Effect of termination. Upon termination, Business Associate shall, at Covered Entity's election, return PHI to Covered Entity by making it available for export through the Services or by another mutually agreed method, or destroy it, and shall retain no copies, except as provided in Section 6.4. Covered Entity shall make its election in writing within thirty (30) days of termination; if it does not, Business Associate may destroy the PHI after that period.

6.4. Retention where return or destruction is infeasible. If return or destruction of PHI is infeasible, including because retention is Required by Law or because the PHI resides in backups scheduled for routine deletion, Business Associate shall extend the protections of this Agreement to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for so long as Business Associate maintains the PHI.

6.5. Survival. Sections 4, 6.3, 6.4, and 7 survive termination.

7. Miscellaneous

7.1. Regulatory references. A reference in this Agreement to a section of HIPAA means the section as in effect or as amended.

7.2. Amendment. The parties agree to take the action necessary to amend this Agreement from time to time as required for compliance with HIPAA. Business Associate may update its standard form for future customers; changes apply to Covered Entity only when signed by both parties.

7.3. Interpretation. Any ambiguity in this Agreement shall be resolved to permit compliance with HIPAA. In the event of a conflict between this Agreement and any other agreement between the parties concerning PHI, this Agreement controls.

7.4. No third-party beneficiaries. Nothing in this Agreement confers any rights on any person other than the parties and their successors and permitted assigns.

7.5. Notices. Notices under this Agreement shall be in writing and sent by email with confirmation of receipt, or by courier, to the addresses below or such other address as a party designates in writing.

7.6. Entire agreement; counterparts. This Agreement is the entire agreement of the parties regarding its subject matter. It may be signed in counterparts and by electronic signature.

Signatures

Covered Entity

Organization: ______________________________________

Signature: ______________________________________

Name: ______________________________________

Title: ______________________________________

Date: ______________________________________

Notice email: ______________________________________

Business Associate: Rescue Ally LLC

Signature: ______________________________________

Name: Jon Hieb

Title: Owner

Date: ______________________________________

Notice email: support@rescueally.org

Business Associate Agreement