Business Associate Agreement

Signed before your patient information reaches us

Open Lab Solutions, Inc. acts as a business associate to every laboratory it serves. Tell us who should receive the agreement and we will send it for review.

What the agreement covers

What we may do with protected health information: produce, review, check, correct and deliver your reports; run the portals for your staff, the providers and facility staff you authorize and, if you offer it, your patients; manage our business and meet our legal duties; and make de-identified information to provide, check and improve our services. Any other disclosure only on your instruction, or where the law requires or protects it.
What we never do with it: sell it, use it for marketing or advertising, or use it to produce, check or improve another laboratory's reports unless it has first been de-identified.
Safeguards written into the agreement, including multi-factor sign-in for every portal user, encryption, a tamper-evident audit trail and encrypted backups. Notice to you within 72 hours of discovering a breach or any other use or disclosure the agreement does not allow (sooner where state law requires), a written report within 10 days, and notice within five business days of any other security incident beyond routine blocked attempts.
Subcontractors bound by the same terms, listed in the agreement and kept current with notice to you; help answering your patients' requests for access, amendment and an accounting of disclosures; and, when the agreement ends, return or destruction of the information, with continued protection for anything that cannot be returned or destroyed.

Have your own template? Send it along and our team will review it.

Read the security controls