Business-associate agreement
The terms an organisation accepts when it signs up to send or receive referrals through Direct Axess.
This is a draft, not a final agreement.
The wording below is a placeholder pending legal review. Organisations that accept it will be asked to accept the final agreement before the platform carries live patient data — which is why the version recorded against you says “draft-2”.
Version draft-2 · Draft — pending legal review
1. Purpose
Direct Axess (the “Business Associate”) receives, stores, and transmits protected health information on behalf of your organisation (the “Covered Entity”) so that referrals can be sent, received, and worked on this platform. This agreement sets out how that information is handled.
It applies whichever side of a referral you are on. A primary-care practice discloses patient information when it sends a referral; a specialist practice receives and works it. In both cases the information is your organisation’s, and the platform handles it on your behalf.
This draft is a placeholder for the agreement your counsel and ours will settle before the platform carries live patient data. Accepting it records that you have read this page and agreed to proceed on these terms in the interim.
2. Who accepts, and on whose behalf
The person accepting does so on behalf of their organisation and confirms they are authorised to bind it. We record the version accepted, the date and time, the name given, and the network address it was accepted from.
Colleagues invited to the platform afterwards work under the agreement their organisation has already accepted; they are not asked to accept one of their own. The agreement is between two organisations, not with an individual.
3. Permitted uses
Protected health information is used only to provide the referral service, to secure and operate it, and as required by law. It is not sold, and it is not used for advertising.
4. Safeguards
Data is encrypted in transit and at rest. Access is restricted to your own organisation by row-level policies in the database, and every read and write by our staff is recorded in an audit log your organisation can read.
Support staff enter your organisation’s context only through a time-boxed, read-only session that is written to your own audit log while it is open, and that requires a second recorded reason before anything can be changed.
5. Subcontractors
Any subcontractor that handles protected health information on our behalf is bound by terms at least as protective as these.
6. Breach notification
We will notify your organisation without unreasonable delay, and in any event within the period required by law, of any use or disclosure of protected health information not permitted by this agreement.
7. Termination and return of data
On termination, protected health information is returned or destroyed where feasible. Where it is not feasible — for example, records retained to meet a statutory retention period — the protections in this agreement continue to apply for as long as the information is held.