Tallyvant
Request a Demo
Executed with enterprise customers

Business Associate Agreement

Version 1.0. Effective 31 October 2026.

Not yet legally approved. This document is a draft prepared for review. It has not been reviewed or approved by legal counsel and does not yet represent a binding commitment. It is published here so that an enterprise customer and its counsel can read it before it is offered for execution, and so that a clause can be cited by URL rather than by paraphrase.

The agreement that permits Protected Health Information to be processed by Tallyvant on a covered entity’s behalf, implementing the HIPAA Privacy, Security, Breach Notification and Enforcement Rules at 45 C.F.R. Parts 160 and 164.

This Business Associate Agreement (“BAA”) is entered into by and between CPvL Enterprise, Inc., a Delaware corporation trading as Tallyvant (“Business Associate” or “Company”), and the customer entity executing an Order Form or the Tallyvant Terms of Use with Business Associate (“Covered Entity” or “Customer”).

Recitals

WHEREAS, Covered Entity is a “covered entity” or “business associate” under the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, as amended by the HITECH Act (Public Law 111-5), and their implementing regulations at 45 C.F.R. Parts 160 and 164 (collectively, “HIPAA”); and

WHEREAS, Business Associate provides benefits financial reconciliation software (the “Service”) to Covered Entity pursuant to the Tallyvant Terms of Use or applicable master service agreement (the “Underlying Agreement”); and

WHEREAS, performance of the Service may require Business Associate to create, receive, maintain, or transmit Protected Health Information (“PHI”) on behalf of Covered Entity;

NOW, THEREFORE, the parties agree as follows:

Contents

  1. 1. Definitions
  2. 2. Permitted Uses and Disclosures by Business Associate
  3. 3. Obligations of Business Associate
  4. 4. Obligations of Covered Entity
  5. 5. Term and Termination
  6. 6. Incorporation, Precedence and Governing Law

1. Definitions

Capitalized terms used but not defined herein shall have the meanings ascribed to them in HIPAA (45 C.F.R. §§ 160.103, 164.304, and 164.501).

“Designated Record Set” shall have the meaning given under 45 C.F.R. § 164.501.

“PHI” shall mean Protected Health Information created, received, maintained, or transmitted by Business Associate from or on behalf of Covered Entity.

2. Permitted Uses and Disclosures by Business Associate

2.1 Service Provision. Business Associate may use or disclose PHI strictly to perform services set forth in the Underlying Agreement, provided that such use or disclosure would not violate HIPAA if done by Covered Entity.

2.2 Management and Administration. Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities.

2.3 Minimum Necessary. Business Associate will limit its requests, uses, and disclosures of PHI to the minimum necessary to accomplish the intended purpose, in accordance with 45 C.F.R. § 164.502(b).

2.4 Data De-Identification. Business Associate may de-identify PHI in strict accordance with 45 C.F.R. § 164.514(b). De-identified data shall no longer constitute PHI and may be used as permitted under Section 8.3 of the Underlying Agreement.

3. Obligations of Business Associate

3.1 Safeguards. Business Associate will implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic PHI, in compliance with the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C).

3.2 Subcontractor Flow-Down. Business Associate will ensure that any subcontractor or agent that creates, receives, maintains, or transmits PHI on its behalf agrees in writing to the same restrictions and conditions that apply to Business Associate under this BAA.

3.3 Reporting Unpermitted Disclosures and Security Incidents. Business Associate will report to Covered Entity any use or disclosure of PHI not provided for by this BAA, including any successful Security Incident or Breach of Unsecured PHI, within ten (10) business days of discovery. Pings, port scans, and unsuccessful log-in attempts are hereby deemed reported.

3.4 Breach Notification. In the event of a Breach of Unsecured PHI, Business Associate will notify Covered Entity without unreasonable delay and in no case later than thirty (30) calendar days after discovery, providing details required under 45 C.F.R. § 164.410.

3.5 Individual Rights. Business Associate will support Covered Entity’s obligations to individuals as follows:

  • Access. Within fifteen (15) days of a written request by Covered Entity, Business Associate will make PHI in a Designated Record Set available to Covered Entity to satisfy 45 C.F.R. § 164.524.
  • Amendment. Business Associate will incorporate amendments to PHI in a Designated Record Set as directed by Covered Entity under 45 C.F.R. § 164.526.
  • Accounting. Business Associate will maintain and make available the information required to provide an accounting of disclosures under 45 C.F.R. § 164.528.

3.6 Availability of Records to the Secretary. Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received on behalf of, Covered Entity available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining Covered Entity’s compliance with HIPAA, in accordance with 45 C.F.R. § 164.504(e)(2)(ii)(H). Business Associate will notify Covered Entity of any such request unless prohibited by law.

3.7 Carrying Out Covered Entity Obligations. To the extent Business Associate is to carry out an obligation of Covered Entity under 45 C.F.R. Part 164, Subpart E, Business Associate will comply with the requirements of Subpart E that apply to Covered Entity in the performance of that obligation, in accordance with 45 C.F.R. § 164.504(e)(2)(ii)(I).

4. Obligations of Covered Entity

Covered Entity shall notify Business Associate of any limitations in its notice of privacy practices, changes in permissions by individuals, or restrictions on use or disclosure that affect Business Associate’s performance.

Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would be unlawful if performed by Covered Entity.

5. Term and Termination

5.1 Term. This BAA becomes effective on the Effective Date and terminates when all PHI is destroyed or returned to Covered Entity.

5.2 Termination for Cause. Upon Covered Entity’s knowledge of a material breach of this BAA by Business Associate, Covered Entity shall provide thirty (30) days’ notice for cure. Failure to cure results in immediate termination.

5.3 Effect of Termination. Within sixty (60) days of termination of the Underlying Agreement, Business Associate shall return or destroy all PHI. Where return or destruction is infeasible, protections of this BAA extend indefinitely to such retained PHI.

6. Incorporation, Precedence and Governing Law

6.1 Incorporation. This BAA supplements and is incorporated into the Underlying Agreement. Section 17 of the Terms of Use (Governing Law and Dispute Resolution) applies to this BAA, which is governed by the internal laws of the State of Delaware.

6.2 Precedence. As to PHI, this BAA controls over any conflicting provision of the Underlying Agreement, including Section 8.3 of the Terms of Use. As to personal data that is not PHI, the Data Processing Addendum controls. In all other respects the Underlying Agreement is unchanged.

6.3 No PHI Before Execution. Section 6.3 of the Terms of Use prohibits the submission of PHI to the Service unless a fully executed BAA is then in force. Customer acknowledges that the Service enforces this prohibition as a technical control: until an executed BAA is recorded against Customer’s workspace, the Service refuses any upload in which it detects clinical or claims content, and records a warning against every other upload of a file category capable of carrying PHI. That control is a safeguard and not a guarantee of detection, and nothing in it limits Customer’s responsibility under Section 6.3 of the Terms of Use for the contents of Customer Data.

6.4 Counterparts and Authority. This BAA may be executed in counterparts, including by electronic signature or by a recorded in-product execution capturing the name, title, and corporate address of the signing officer. Each party represents that the individual executing it has authority to bind that party.

How this agreement is executed

This agreement is not accepted by a checkbox. An organisation owner requests execution from inside the Tallyvant application, supplying the legal name of the contracting entity and the name, title and corporate address of the signing officer. That produces a countersignable record naming the version of the agreement and the address at which this text is published, which the Company then countersigns. A request grants nothing: until a countersigned record exists, the application treats the agreement as absent, and the workspace stays as restricted as it was before.

This agreement supplements the Terms of Use accepted at sign-up. The other enterprise agreement is the Data Processing Addendum. What we collect and why is set out in the Privacy Notice, and what is implemented — and what is deliberately not claimed — on the security page.

Questions about this agreement, and requests to execute it, go to legal@tallyvant.com. Suspected vulnerabilities go to security@tallyvant.com.

For the reviewer. Counsel has not reviewed this document. Three clauses were added to the draft supplied and are listed at the top of the module that holds this text. Before this can be offered for execution: the Company must be able to perform §3.1 (a Security Rule safeguard programme, which today has no risk analysis on file), §3.5 (a fifteen-day access process), and §3.6 (records available to the Secretary). None of the three is a drafting question. A registered postal address for service is still unpublished, and §6.4 contemplates an in-product execution record whose retention period has not been set. The thirty-day PHI breach clock in §3.4 and the forty-eight-hour personal data clock in the Data Processing Addendum §3.2 are cumulative, not alternative. An incident touching both regimes is governed by the shorter.