Business Associate Agreement

Why a BAA for P&C claim files

HIPAA applies to health plans, health care clearinghouses, health care providers and their business associates. Liability, auto and workers' compensation coverage are generally excepted benefits outside the definition of a health plan in 45 C.F.R. 160.103, so many P&C carriers are not HIPAA covered entities for their claim files. Some Ishqkala customers are, however: TPAs that also administer group health plans, self-insured employers and public entities that sponsor health plans, and organizations that receive health information as business associates of others.

Medical records in bodily injury files also carry state medical privacy and insurance data security obligations. Ishqkala therefore signs the same BAA with every customer that sends health information and applies its protections to all medical information in claim files, whether or not HIPAA strictly governs that customer. In this summary, "PHI" means that information.

Parties and roles

The customer is the covered entity, or a business associate of a covered entity, and ISHQKALA PRIVATE LIMITED is its business associate or subcontractor business associate. The BAA sits alongside the customer's Master Subscription Agreement and Data Processing Addendum. For PHI, the BAA controls if the documents conflict.

Permitted uses and disclosures

Ishqkala uses and discloses PHI only to perform the services in the customer agreement: ingesting and extracting claim documents, scoring liability, tracking deadlines and assembling demand package drafts in the customer's tenant. Ishqkala may also use PHI for its own proper management and administration and to meet its legal responsibilities, as 45 C.F.R. 164.504(e)(4) permits.

Ishqkala applies the minimum necessary standard, never sells PHI, never uses it for marketing and never uses it to train AI models. Ishqkala does not send demand packages or any PHI to adverse parties: the customer decides what each demand contains and sends it. De-identification of PHI requires the customer's prior written permission.

Safeguards

Ishqkala implements administrative, physical and technical safeguards that comply with Subpart C of 45 C.F.R. Part 164, the HIPAA Security Rule. These include an annual risk analysis, AES-256 encryption at rest, TLS 1.3 in transit, role-based access, multi-factor authentication, audit logging of every access to PHI, workforce training and sanctions, and storage only in AWS US regions.

Reporting incidents and breaches

Ishqkala reports to the customer any use or disclosure of PHI the BAA does not permit, any security incident, and any breach of unsecured PHI under 45 C.F.R. 164.410. Breach reports go out without unreasonable delay and no later than five business days after discovery, well inside HIPAA's 60-day outer limit, with the identity of affected individuals and the other details 164.410(c) requires as they become available.

Routine unsuccessful attempts, such as blocked sign-ins, pings and port scans, are covered by a standing notice in the BAA rather than individual reports. Ishqkala mitigates harmful effects it knows of, cooperates with the customer's own notification duties, and reimburses reasonable notification costs when a breach results from Ishqkala's failure to meet the BAA.

Subcontractors

As 45 C.F.R. 164.502(e)(1)(ii) and 164.308(b)(2) require, Ishqkala obtains written agreements from any subcontractor that creates, receives, maintains or transmits PHI, binding it to the same restrictions and conditions. Amazon Web Services, which hosts all claim data, signs a business associate agreement with Ishqkala. Current subcontractors are listed on our Subprocessors page.

Individual rights and HHS access

Within ten business days of a customer request, Ishqkala makes PHI available so the customer can meet access requests under 45 C.F.R. 164.524, makes amendments the customer directs under 164.526, and provides the disclosure information the customer needs for an accounting under 164.528. If an individual contacts Ishqkala directly, Ishqkala forwards the request to the customer within five business days.

Ishqkala makes its internal practices, books and records relating to PHI available to the Secretary of Health and Human Services for purposes of determining compliance with HIPAA.

Term, termination and return of PHI

The BAA runs for the life of the customer agreement. Either party may terminate if the other commits a material breach that is not cured within 30 days of notice. Within 30 days after termination, Ishqkala returns or destroys all PHI and certifies destruction in writing. Encrypted backups age out within a further 35 days, and the BAA's protections continue to apply to any PHI until it is destroyed.

Requesting or reviewing a BAA

Customers can request the Ishqkala BAA, or send their own BAA form for review, at legal@ishqkala.si. Questions about how PHI is handled in the platform can go to privacy@ishqkala.si.