Need a BAA? We’ve made it simple.
If you’re based in the U.S. and work with patient health information, HIPAA rules require you to have a Business Associate Agreement (BAA) with any company that helps you manage that information.
The U.S. Department of Health & Human Services explains that a business associate is anyone outside your team who handles protected health information (PHI) on your behalf. HIPAA requires a signed agreement to make sure that information is properly protected.
That’s where Zanda comes in. Since we process health information for your practice, a BAA is required—but don’t worry, we’ve already got it covered and made it easy for you.
The BAA is now incorporated into our Global Data Processing Agreement (DPA), and is also available via Zanda’s Terms of Use, which we recommend you review. It becomes effective upon your subscription to the Services and remains in effect for the duration of your subscription.
If you have any questions about this, please let us know.
Extracted PDF: bad81c4d33301cf9.pdf
Zanda Global Data Processing Agreement (“DPA”) This Global Data Processing Agreement (“DPA”) is an agreement between you and the entity you represent (collectively referred to as “Customer,” “you,” or “your”) and Zanda Health Pty Ltd (“Zanda”, “we”, “us”, or “our”). This DPA supplements the Zanda Platform Terms of Use (“Terms of Use”) and governs the Processing of Personal Data by Zanda on behalf of the Customer in connection with the Customer’s use of the Services. The following appendices are attached and are an integral part of this DPA. Each appendix applies as required by the Customer’s local regulations: ● APPENDIX I – EU STANDARD CONTRACTUAL CLAUSES: CONTROLLER TO PROCESSOR: Governs the transfer of Personal Data from the EU to Zanda as a data processor in compliance with EU data protection laws. ● APPENDIX II – UK INTERNATIONAL DATA TRANSFER ADDENDUM TO THE EU COMMISSION STANDARD CONTRACTUAL CLAUSES: Provides additional safeguards and terms for data transfers from the UK to Zanda in compliance with UK data protection laws. ● APPENDIX III – US HIPAA BUSINESS ASSOCIATE AGREEMENT: Outlines Zanda’s obligations as a Business Associate when handling Protected Health Information (PHI) under the US Health Insurance Portability and Accountability Act (HIPAA). By accessing or using the Services you acknowledge that you have read, understood, and agree to be bound by this DPA. This DPA becomes effective upon your subscription to the Services and remains in effect for the duration of your subscription. All capitalised terms used in this DPA will have the meanings given to them in Section 14 of this DPA.
Docusign Envelope ID: C257CC82-01E9-4DA0-A39D-6D53E07FCEF2
1. Details of Data Processing 1.1. Scope and Roles This DPA applies to Processing Customer Data to provide the Services. Zanda acts as the Data Processor on behalf of the Customer, the Data Controller. 1.2. Data Processing Activities 1.2.1. Subject Matter: The…