Business Associate Agreement

Version v0-placeholder · Plain-language placeholder. When the final version is ready, every office will be asked to agree again.

1. Who this is between

This agreement is between your dental office (the "Office", a covered entity under HIPAA) and Retention Dental Laboratory, doing business as RDL Labs ("RDL"), which runs RDL Chairside and the RDL Labs website. RDL is the Office's business associate.

2. What information it covers

Protected health information ("PHI") the Office or its patients put into RDL Chairside or send to RDL: patient names, dates of birth, insurance details and card photos, case details, scans, photos and notes.

3. What RDL may do with PHI

• Only what is needed to run the services for the Office: lab cases, pickups and deliveries, insurance checklists, sharing the patient asked for, support and billing.
• RDL will not sell PHI or use it for marketing.
• RDL may use it as the law requires.

4. How RDL protects it

• Sign-in for every person, encrypted connections (https), files kept outside the public website, access logs.
• Only people who need it to do their job can see it.
• Patients decide which offices can see their insurance, and can stop sharing at any time.

5. If something goes wrong

RDL will tell the Office without unreasonable delay, and no later than 60 days after finding out, about any use or disclosure not allowed by this agreement, including a breach of unsecured PHI, and will help the Office meet its notice duties.

6. Helpers (subcontractors)

Any company that handles PHI for RDL (for example hosting or email) must agree to the same protections in writing.

7. Patient rights

RDL will help the Office give patients access to, copies of, or corrections to their PHI, and a record of disclosures when required.

8. Records and audits

RDL will make its practices and records about PHI available to the U.S. Department of Health and Human Services if asked.

9. Ending the agreement

This agreement lasts while the Office uses RDL services. When it ends, RDL will return or destroy the Office's PHI where possible, and keep protecting anything it must keep.

This placeholder is not legal advice and will be replaced by the final agreement from our attorney.