Mosara ABA
Try the demo

Legal

Business Associate Agreement

Last updated: October 30, 2026

This is the standard Business Associate Agreement (BAA) Mosara ABA offers customer practices. For customers who put protected health information (PHI) into the Service, it is part of and incorporated into our Terms of Service (Section 6). To sign it or get a countersigned copy, contact us at [email protected].

Contents
  1. 1. Definitions
  2. 2. What Business Associate will do
  3. 3. How Business Associate may use and disclose PHI
  4. 4. What Covered Entity will do
  5. 5. Term and termination
  6. 6. General
  7. Exhibit A: Subprocessors
  8. Signatures

This Business Associate Agreement (the “BAA”) is between the customer identified below (“Covered Entity” or “Customer”) and Mosara ABA (“Business Associate” or “Mosara ABA”).

Background. Covered Entity uses the Mosara ABA service (the “Service”) under the Mosara ABA Terms of Service or an order form (together, the “Agreement”). In providing the Service, Business Associate may create, receive, maintain or transmit Protected Health Information on behalf of Covered Entity. This BAA sets out how Business Associate will protect that information, as required by HIPAA.

Who can get this BAA. Business Associate offers this BAA to every customer that will store PHI in the Service, whether on a paid plan, a trial or a free pass.

How this BAA takes effect. This BAA takes effect on the date Covered Entity accepts it, either by signing below or by accepting it electronically in the Service. Covered Entity may not put PHI into the Service until this BAA is in effect and Business Associate has confirmed in writing that Covered Entity’s account is enabled for PHI.

1. Definitions

1.1 General. Terms used but not defined in this BAA, such as Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information and Use, have the meanings given in HIPAA.

1.2 Specific terms.

2. What Business Associate will do

Business Associate will:

2.1 Limit use and disclosure. Not use or disclose PHI other than as permitted or required by this BAA or as Required by Law.

2.2 Safeguard PHI. Use appropriate administrative, physical and technical safeguards, and comply with the Security Rule with respect to electronic PHI, to prevent use or disclosure of PHI other than as this BAA provides.

2.3 Report problems. Report to Covered Entity: (a) any use or disclosure of PHI not provided for by this BAA of which it becomes aware; (b) any Security Incident of which it becomes aware; and (c) any Breach of Unsecured PHI, as required by 45 C.F.R. § 164.410. Business Associate will report any use or disclosure not permitted by this BAA, and any successful Security Incident, without unreasonable delay and in no case later than 10 calendar days after discovering it, even if it is not a Breach. Unsuccessful Security Incidents are covered by Section 2.5.

2.4 Timing and content of Breach notices. Notify Covered Entity of a Breach of Unsecured PHI without unreasonable delay and in no case later than 10 calendar days after discovery of the Breach. The notice will include, to the extent known, the identity of each affected Individual, a description of what happened, the types of PHI involved, the date of the Breach and of its discovery, the steps Business Associate is taking to investigate and mitigate it, and any other information Covered Entity reasonably needs to meet its own notification obligations. Business Associate will supplement the notice as more information becomes available.

2.5 Unsuccessful Security Incidents. The parties agree that this Section is notice that unsuccessful attempts to access the Service occur regularly, such as pings, port scans, blocked sign-in attempts and denial-of-service attempts that do not result in unauthorized access to PHI. No further notice of such unsuccessful attempts is required.

2.6 Mitigate. Mitigate, to the extent practicable, any harmful effect known to Business Associate of a use or disclosure of PHI in violation of this BAA.

2.7 Subcontractors. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractor that creates, receives, maintains or transmits PHI on behalf of Business Associate agrees in writing to the same restrictions, conditions and requirements that apply to Business Associate under this BAA. Business Associate will not allow any Subcontractor to create, receive, maintain or transmit PHI until that written agreement is signed; a vendor without one is kept away from PHI. Business Associate’s Subcontractors that may handle PHI include its cloud hosting provider and, only once it has signed such an agreement, its AI model provider. Business Associate will maintain a current list of its Subcontractors (see Exhibit A) and will give Covered Entity at least 30 days’ notice before a new Subcontractor is allowed to handle Covered Entity’s PHI, unless an urgent security, continuity or legal need requires shorter notice.

2.8 Access. Within 10 business days of a request from Covered Entity, make PHI in a Designated Record Set available to Covered Entity so that it can meet its obligations under 45 C.F.R. § 164.524. Covered Entity can generally do this itself through the Service’s export features. If an Individual asks Business Associate directly, Business Associate will forward the request to Covered Entity within 5 business days.

2.9 Amendment. Within 10 business days of a request from Covered Entity, make any amendment to PHI in a Designated Record Set that Covered Entity directs or agrees to under 45 C.F.R. § 164.526, or give Covered Entity the means to make it in the Service.

2.10 Accounting of disclosures. Keep the information required to provide an accounting of disclosures under 45 C.F.R. § 164.528 and provide it to Covered Entity within 10 business days of a request. If an Individual asks Business Associate directly, Business Associate will forward the request to Covered Entity.

2.11 Covered Entity’s Privacy Rule duties. To the extent Business Associate carries out any of Covered Entity’s obligations under the Privacy Rule, comply with the requirements of the Privacy Rule that apply to Covered Entity in performing those obligations.

2.12 Government access. Make its internal practices, books and records relating to PHI available to the Secretary for purposes of determining compliance with HIPAA.

2.13 Minimum necessary. Request, use and disclose only the minimum necessary PHI to accomplish the intended purpose, as required by HIPAA.

2.14 Location of PHI. Store and process PHI only in the United States, and not allow PHI to be accessed from outside the United States, unless Covered Entity agrees in writing.

2.15 Training and personnel. Ensure that its workforce members who have access to PHI are trained on HIPAA and bound by confidentiality obligations, and limit access to PHI to those who need it to provide the Service or support.

3. How Business Associate may use and disclose PHI

3.1 To provide the Service. Business Associate may use and disclose PHI as necessary to provide the Service to Covered Entity under the Agreement, including support that Covered Entity requests.

3.2 Management and administration. Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities. It may disclose PHI for those purposes only if the disclosure is Required by Law, or if Business Associate first obtains reasonable written assurances from the recipient that the PHI will be held confidentially, used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the recipient will notify Business Associate of any instance of which it is aware in which the confidentiality of the PHI has been breached.

3.3 De-identification. Business Associate may de-identify PHI in accordance with 45 C.F.R. § 164.514(a) through (c) and may use de-identified information to operate, secure and improve the Service. De-identified information is not PHI. Business Associate will not use de-identified information derived from PHI to train artificial intelligence models.

3.4 Data aggregation. Business Associate may provide Data Aggregation services relating to Covered Entity’s Health Care Operations only if Covered Entity requests them in writing.

3.5 Reporting violations of law. Business Associate may use PHI to report violations of law to appropriate federal and state authorities, consistent with 45 C.F.R. § 164.502(j)(1).

3.6 What Business Associate will not do. Business Associate will not: (a) sell PHI; (b) use or disclose PHI for marketing or advertising; (c) use PHI to train or improve artificial intelligence or machine-learning models, whether its own or a third party’s; or (d) use or disclose PHI in any manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except as Sections 3.2 through 3.5 allow.

4. What Covered Entity will do

Covered Entity will:

4.1 Notices and restrictions. Notify Business Associate of any limitation in its Notice of Privacy Practices, any change in or revocation of an Individual’s permission, and any restriction on the use or disclosure of PHI that Covered Entity has agreed to, to the extent it may affect Business Associate’s use or disclosure of PHI.

4.2 Permissible requests only. Not ask Business Associate to use or disclose PHI in any manner that would not be permissible under the Privacy Rule if done by Covered Entity, except as Sections 3.2 through 3.5 allow.

4.3 Its own setup. Put PHI into the Service only after this BAA is in effect and its account is enabled for PHI; provide only the PHI needed to use the Service; configure user roles, access and settings appropriately; use the security features the Service provides, including multi-factor authentication; and send PHI to Business Associate only through the Service, not through email, demo requests or other channels not intended for PHI.

4.4 Its own obligations. Remain responsible for its obligations as a covered entity, including obtaining any required authorizations and consents, giving required notices, and notifying Individuals, the Secretary and the media of Breaches as HIPAA and state law require.

5. Term and termination

5.1 Term. This BAA remains in effect for as long as the Agreement is in effect, and afterward until all PHI has been returned or destroyed as described in Section 5.4.

5.2 Termination for breach. If Covered Entity determines that Business Associate has violated a material term of this BAA, Covered Entity will give Business Associate written notice and a reasonable opportunity, not longer than 30 days, to cure the breach or end the violation, if cure is possible. If Business Associate does not cure the breach or end the violation within that time, or if cure is not possible, Covered Entity may terminate this BAA and the Agreement immediately by written notice, and Business Associate will refund any prepaid fees for the remaining paid period. If termination is not feasible, Covered Entity may report the problem to the Secretary. Business Associate may likewise terminate this BAA and the Agreement if Covered Entity violates a material term of this BAA and does not cure the violation within 30 days after written notice. These rights match the termination-for-breach terms of the Agreement.

5.3 Effect of termination. Termination of this BAA ends Covered Entity’s right to put PHI into the Service.

5.4 Return or destruction of PHI. For 30 days after the Agreement ends, Covered Entity may export its PHI using the Service’s export features or by request. After that, Business Associate will destroy all PHI in the live Service within 30 days, and copies in backups will be deleted or overwritten within 90 days after that. Business Associate will confirm destruction in writing on request. If returning or destroying any PHI is not feasible, or the law requires Business Associate to keep it, Business Associate will extend the protections of this BAA to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as it keeps the PHI.

6. General

6.1 Legal references. A reference to a section of HIPAA means that section as in effect or as amended.

6.2 Changes in the law. The parties will amend this BAA as needed for either party to comply with changes in HIPAA or other applicable law. Business Associate may update this BAA to reflect such changes by giving Covered Entity at least 30 days’ written notice, provided the update does not reduce the protection of PHI.

6.3 Interpretation. Any ambiguity in this BAA will be resolved to permit compliance with HIPAA.

6.4 Order of precedence. If this BAA conflicts with the Agreement regarding PHI, this BAA controls. In all other respects, the Agreement, including its limitation of liability, governs.

6.5 Independent contractor. Business Associate is an independent contractor and is not an agent of Covered Entity for any purpose, including under the federal common law of agency.

6.6 No third-party beneficiaries. Nothing in this BAA gives any rights to anyone other than the parties and their permitted successors and assigns.

6.7 Survival. Business Associate’s obligations under Section 5.4 and any other provision that by its nature should survive will survive termination.

6.8 Governing law. This BAA is governed by federal law, including HIPAA, and, to the extent not preempted, the laws of the State of Florida. Venue is as stated in the Agreement (Miami-Dade County, Florida).

6.9 Notices. Notices under this BAA go to Covered Entity’s account owner email address on file and to Business Associate at [email protected]. Breach notices to Covered Entity will also be made by telephone or another prompt method where practical.

6.10 Signatures. This BAA may be accepted electronically in the Service or signed in counterparts, including by electronic signature, each of which is an original.

Exhibit A: Subprocessors

Business Associate uses subprocessors in the categories below. No subprocessor may create, receive, maintain or transmit PHI until it has signed a business associate agreement with Business Associate; until then it is kept away from PHI. The named list, with each subprocessor’s purpose and business associate agreement status, will be completed before any account is enabled for PHI.

Signatures

Covered Entity

Practice legal name: ______________________________

Signature: ______________________________

Name and title: ______________________________

Date: ______________________________

Business Associate: Mosara ABA

Signature: ______________________________

Name and title: ______________________________

Date: ______________________________

Questions? [email protected]