Do you sign a HIPAA business associate agreement for medical accounts?
Yes. For accounts from healthcare providers, BestPair signs a Business Associate Agreement as your business associate or subcontractor, and your signature on the Order Form accepts it with the rest of the agreement. It applies when protected health information is provided, limits BestPair to the minimum necessary, bars any sale or marketing use, and requires a breach of unsecured protected health information to be reported within five business days of discovery.
New to BestPair? See what it is and how it works
When the Business Associate Agreement applies
The Business Associate Agreement applies when your agency, as a covered entity or as the business associate of a covered entity, provides BestPair with protected health information. BestPair is then your business associate or subcontractor. The Security Overview puts it in one line: for accounts from healthcare providers, BestPair signs a Business Associate Agreement as your subcontractor.
There is no separate signature. Your signature on the Order Form accepts the Business Associate Agreement along with the Standard Terms and the Data Processing Addendum, and all of them are in the signing package. Where the documents differ, the Business Associate Agreement prevails for protected health information. What agencies sign, and in what order.
Whether the files you send count as protected health information is a question for your privacy officer or counsel. If they do, the Business Associate Agreement covers them. BestPair does not provide legal or compliance advice.
What BestPair commits to
| Area | What the Business Associate Agreement says |
|---|---|
| Use | Only to perform the services, as required by law, or for BestPair’s own proper management and administration on the agreement’s conditions |
| Minimum necessary | BestPair limits its use and disclosure of protected health information to the minimum necessary |
| Sale and marketing | BestPair will not sell protected health information or use it for marketing |
| Safeguards | Appropriate safeguards, and the HIPAA Security Rule’s requirements for electronic protected health information |
| Breach reporting | A breach of unsecured protected health information is reported without unreasonable delay and within five business days of discovery |
| Subcontractors | Any subcontractor that handles protected health information agrees in writing to the same restrictions and conditions |
| Location | Stored only in the United States. BestPair personnel in Australia may access it remotely, only from company-managed devices and under the safeguards in the Business Associate Agreement and the Data Processing Addendum |
| Individual requests | Forwarded to your agency within five business days |
| Records | Internal practices, books and records on protected health information made available to the Secretary of Health and Human Services |
| End of contract | Returned or destroyed within the deletion period, with no copies kept |
De-identification is allowed only in line with the HIPAA Rules, and aggregated data drawn from protected health information is created only as the Business Associate Agreement permits.
What BestPair asks for on medical accounts
The data is pseudonymised only, the same as on any other account. BestPair never asks for consumer names, Social Security numbers, phone numbers, email or street addresses, or bank or card details. Account IDs are your own, so BestPair cannot tell who a consumer is.
The account fields BestPair asks for are balance, days delinquent, placement date, consumer age band, state and ZIP code. With them come call records, payment dates and amounts, and an agent roster keyed to your own agent IDs. Files arrive by encrypted SFTP to a folder BestPair provides, never by email, and are encrypted in transit (TLS 1.2 or higher, and SFTP) and at rest (AES-256). What BestPair receives and never asks for.
What stays with your agency
- Your own agreement with the provider. Your business associate agreement with each healthcare provider sets what your agency may pass on, and to whom. Your counsel reads it. BestPair’s agreement asks your agency to tell BestPair of any restriction in it, or in a provider’s notice of privacy practices, that affects BestPair’s use of the data.
- Instructions within the rules. Your agency agrees not to ask BestPair to use or disclose protected health information in a way the HIPAA Rules would not allow your agency or the provider to.
- Every contact with consumers. People make every call. BestPair does not contact consumers, and it does not change whether an account is worked, what a consumer is offered or any collection terms.
The vendor file BestPair provides for client reviews is set out in do creditor clients have to approve a vendor.
Common follow-up questions
Do we sign the BAA separately?
No. One signature on the Order Form accepts the Order Form, the Standard Terms, the Data Processing Addendum and, where protected health information is involved, the Business Associate Agreement. It is signed electronically: your agency signs first and BestPair countersigns.
How fast are we told about an incident?
For a security incident affecting your data, without undue delay and within 72 hours of BestPair confirming it. For a breach of unsecured protected health information, without unreasonable delay and within five business days of discovery, under the Business Associate Agreement.
What account data does BestPair ask for on medical accounts?
The same fields as on any other account: balance, days delinquent, placement date, consumer age band, state and ZIP code, with call and payment history and an agent roster. Those are the fields BestPair asks for. If a file arrives with anything else, BestPair deletes the upload and asks for a resend.
What happens to the protected health information at the end?
BestPair returns or destroys all of it within the deletion period in the Data Processing Addendum and keeps no copies. If return or destruction is not feasible, the agreement’s protections extend to what remains. Data and models at contract end.
What it could mean on your floor
Two minutes
Watch the explainer
What your dialer does with the next account, what pairing changes, and what the Floor Assessment measures. With captions.
Watch the videoYour floor
Try the calculator
Four numbers off your dialer and collections reports give an illustrative figure for your floor. It is at best informed guesswork until your own history is measured.
Open the calculatorA live test
Read the case study
170,000 telecom accounts split at random before the first call, and how the result was counted.
Read it
Would it be a bad idea to spend 45 minutes finding out?
If your shop does not qualify, you will hear it on the call, not after you have paid for a report.
Book a 45-minute fit call