DRAFT v0.1 (2026-09-30) — for attorney review. REMS Wizard is designed so that no BAA is required (see Terms of Service §4.2 and the Privacy Policy). This agreement exists for customers whose compliance programs require one from every software vendor. It is written to be safe to sign because the vendor never receives PHI: the operative obligations are to keep it that way.
This Business Associate Agreement (“BAA”) is entered into as of [date] between [Customer legal name], a covered entity (“Covered Entity”), and Automation Wizard LLC, a Massachusetts limited liability company (“Business Associate”), and supplements the REMS Wizard Terms of Service (the “Agreement”).
Terms used but not defined here have the meanings given in HIPAA, meaning the Health Insurance Portability and Accountability Act of 1996, the HITECH Act, and their implementing regulations at 45 C.F.R. Parts 160 and 164, as amended. “PHI” means protected health information received from, or created, received, maintained or transmitted on behalf of, Covered Entity by Business Associate.
2.1 The REMS Wizard browser extension (the “Software”) operates entirely within Covered Entity’s web browser. It reads information from Covered Entity’s electronic medical record page as displayed on Covered Entity’s computer and enters that information into the SPRAVATO® REMS portal page into which Covered Entity’s authorized user is logged in. The Software does not transmit patient information to Business Associate or to any system operated by Business Associate. 2.2 The parties acknowledge that, as designed, Business Associate does not create, receive, maintain or transmit PHI on behalf of Covered Entity and is therefore not a “business associate” under 45 C.F.R. § 160.103. The parties enter this BAA to (a) memorialize Business Associate’s commitment to maintain that design, and (b) govern any PHI Business Associate may receive inadvertently, for example through a support communication. 2.3 The only information the Software transmits to Business Associate is: the subscription key, Software version, browser version, and monthly counts of forms completed, all of which contain no PHI. Business Associate will not change the Software to transmit PHI without first amending the Agreement and this BAA in writing.
Business Associate will: (a) not use or disclose PHI other than as permitted or required by this BAA or by law; (b) use appropriate safeguards, and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided by this BAA; (c) report to Covered Entity, without unreasonable delay and in no case later than [10] business days after discovery, any use or disclosure of PHI not provided for by this BAA, including Breaches of Unsecured PHI as required by 45 C.F.R. § 164.410, and any Security Incident of which it becomes aware; (d) ensure that any subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees to the same restrictions and conditions (Business Associate represents that it currently uses no such subcontractor); (e) make available PHI in a Designated Record Set, and make amendments to PHI, as necessary for Covered Entity to meet its obligations under 45 C.F.R. §§ 164.524 and 164.526, to the extent Business Associate holds any such PHI; (f) maintain and make available the information required to provide an accounting of disclosures under 45 C.F.R. § 164.528; (g) to the extent Business Associate carries out any of Covered Entity’s obligations under Subpart E of 45 C.F.R. Part 164, comply with the requirements of Subpart E that apply to Covered Entity in the performance of those obligations; (h) make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary of Health and Human Services for purposes of determining compliance with HIPAA.
If Covered Entity or its users send PHI to Business Associate (for example, a screenshot, note snapshot or email containing patient information), Business Associate will (a) use it only to the extent necessary to provide the requested support, (b) not store it beyond the resolution of the support request, (c) delete it securely and confirm deletion on request, and (d) treat it as PHI under Section 3. Covered Entity agrees to instruct its users to use test-patient data for support requests.
Business Associate may use or disclose PHI only (a) as necessary to perform the services in the Agreement, (b) as required by law, and (c) for its proper management and administration, provided that any disclosure for that purpose is required by law or Business Associate obtains reasonable written assurances from the recipient that the PHI will be held confidentially and the recipient will notify Business Associate of any breach of confidentiality. Business Associate will not de-identify PHI, aggregate PHI, or use PHI for marketing or sale.
Covered Entity will (a) notify Business Associate of any limitation in its notice of privacy practices, any changes in or revocation of patient permission, and any restriction on use or disclosure of PHI, to the extent it could affect Business Associate’s use; (b) not request Business Associate to use or disclose PHI in a manner not permitted under HIPAA if done by Covered Entity; (c) maintain the security of its own computers, browser profiles, EMR and REMS portal credentials, which the Software relies upon and which Business Associate cannot access.
7.1 This BAA is effective on the date above and continues while the Agreement is in effect. 7.2 Either party may terminate this BAA and the Agreement if the other party materially breaches this BAA and fails to cure within [30] days of written notice. 7.3 On termination, Business Associate will return or destroy all PHI it holds, if any, and retain no copies, except where retention is required by law, in which case the protections of this BAA continue for as long as the PHI is retained.
8.1 This BAA will be interpreted to permit compliance with HIPAA; any ambiguity is resolved in favor of that result. It will be amended as necessary to comply with changes in HIPAA. 8.2 Nothing in this BAA creates rights in any third party. Massachusetts law governs to the extent not preempted by federal law. 8.3 In case of conflict between this BAA and the Agreement regarding PHI, this BAA controls.
| Covered Entity | Business Associate |
|---|---|
| [Customer legal name] | Automation Wizard LLC |
| By: ________________ | By: ________________ |
| Name/Title: | Name/Title: Joseph Benedict, MD, Manager |
| Date: | Date: |
