- Legal information
- Atlassian Business Associate Agreement
Atlassian Business Associate Agreement
The below BAA is for reference purposes only. If you wish to proceed with signing a BAA, please visit this page for additional information.
Atlassian Business Associate Agreement
This Business Associate Agreement (this “BAA”), dated as of the date of the last signature below (“Effective Date”), is entered into by and between Atlassian Pty Ltd (the “Business Associate”) and the customer entity identified in the signature block below (the “Customer”) (each, a “Party” and, collectively, the “Parties”). The Parties have entered into an Order for a HIPAA-Qualified Cloud Product pursuant to the Atlassian Customer Agreement or other written agreement governing Customer’s use of the HIPAA-Qualified Cloud Products (the “Agreement”).
The purpose of this BAA is to set forth the obligations of Business Associate and Customer to the extent PHI is created, received, maintained, or transmitted on behalf of Customer in connection with a HIPAA-Qualified Cloud Product, in accordance with Applicable Federal Laws, as defined below.
The Parties hereby agree as follows:
1. Definitions
1.1 Unless otherwise specified in this BAA, all capitalized terms that are used in this BAA but not otherwise defined have the meanings established for purposes of the Applicable Federal Laws, or, as applicable, the Agreement.
1.2 The terms below have the following meanings:
"Applicable Federal Laws” means, collectively, HIPAA and HITECH.
“Electronic Protected Health Information” or “ePHI” means PHI that is transmitted or maintained in electronic media.
"HIPAA” means the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, each, as amended from time to time.
“HIPAA-Qualified Cloud Products” means the Cloud Products specified on https://www.atlassian.com/trust/compliance/resources/hipaa and associated Support.
“HITECH” means Health Information Technology for Economic and Clinical Health Act, enacted as part of the American Recovery and Reinvestment Act of 2009, and its implementing regulations, each, as amended from time to time.
“PHI” means Protected Health Information, as defined in 45 C.F.R. § 160.103, limited to the Protected Health Information received from, or received or created on behalf of, Customer by Business Associate in the course of providing the HIPAA-Qualified Cloud Products pursuant to the Agreement.
“Privacy Rule” means the federal privacy regulations issued pursuant to HIPAA, as amended from time to time.
“Security Rule” means the federal security regulations issued pursuant to HIPAA, as amended from time to time.
“Unsecured PHI” means PHI that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary in the guidance issued under § 13402(h)(2) of Public Law 111-5.
2. Applicability of this BAA
2.1 Applicability. This BAA is applicable only to the extent that Customer has an active Subscription Term for a HIPAA-Qualified Cloud Product and has configured such HIPAA-Qualified Cloud Product in accordance with the specifications provided in Section 5 of this BAA. Customer must not provide PHI to any Cloud Product that is not a HIPAA-Qualified Cloud Product to which this BAA applies. For avoidance of doubt, Customer acknowledges and agrees that this BAA does not apply to (a) any Cloud Products or Support provided by Business Associate or its Affiliates other than the HIPAA-Qualified Cloud Products, (b) any Third-Party Product that Customer elects to integrate or enable for use with the HIPAA-Qualified Cloud Products, or (c) Customer’s own products and services used with any HIPAA-Qualified Cloud Products.