Dhruani home

Dhruani Business Associate Agreement

Draft for attorney review. Not in effect. Version 2026-11-15. Effective date: [to be set]. Provider: [Company name] ("Dhruani", "Business Associate").

This agreement is between Dhruani and the pharmacy that accepts it when it signs up ("Covered Entity"). It is part of the Dhruani Pharmacy Agreement. The person who signs it, by typing their full name and title, confirms they have authority to bind the pharmacy.

1. Why this agreement exists

Dhruani is designed so that prescription information stays on the tag and on the pharmacy's own devices, and isn't sent to Dhruani. Some parts of the service may still involve protected health information ("PHI"), as defined by HIPAA: for example, a summary a patient chooses to share with the pharmacy through Dhruani, or details in an error report a pharmacy chooses to send. This agreement covers any PHI that Dhruani creates, receives, keeps, or sends for the pharmacy.

Terms used here, such as "breach", "security incident", and "unsecured PHI", have the meanings given in the HIPAA Rules at 45 CFR Parts 160 and 164.

2. What Dhruani may do with PHI

  • Use or disclose PHI only to provide the Dhruani service to the pharmacy, as the Pharmacy Agreement describes, or as required by law.
  • Use or disclose only the minimum PHI necessary.
  • Not use or disclose PHI in a way that would break the HIPAA Privacy Rule if the pharmacy did it, and not sell PHI or use it for marketing.
  • Use PHI for Dhruani's own proper management and administration, or legal duties, only as 45 CFR 164.504(e)(4) allows.

3. Dhruani's duties

  • Safeguards: use appropriate administrative, physical, and technical safeguards, and comply with the HIPAA Security Rule for electronic PHI, to prevent any use or disclosure not allowed by this agreement.
  • Reporting: report to the pharmacy any use or disclosure not allowed by this agreement, including any breach of unsecured PHI, without unreasonable delay and no later than [number] days after discovering it, with the details 45 CFR 164.410 requires. Unsuccessful attempts that don't result in access, such as blocked log-ins or scans, need no separate report.
  • Subcontractors: make sure any subcontractor that handles PHI for Dhruani agrees in writing to the same restrictions and conditions.
  • Access and amendment: if Dhruani holds PHI in a designated record set, make it available to the pharmacy, and make amendments the pharmacy directs, within [number] days of a request, so the pharmacy can meet 45 CFR 164.524 and 164.526.
  • Accounting: keep the information needed for the pharmacy to give an accounting of disclosures under 45 CFR 164.528, and provide it within [number] days of a request.
  • Government access: make Dhruani's internal practices, books, and records about PHI available to the Secretary of Health and Human Services, to determine compliance with the HIPAA Rules.
  • Pharmacy's duties: where Dhruani carries out a duty of the pharmacy under the Privacy Rule, comply with the requirements that apply to the pharmacy in doing so.

4. The pharmacy's duties

  • Tell Dhruani of any limitation in its notice of privacy practices, any change in or revocation of a patient's permission, or any restriction it agreed to, to the extent it affects Dhruani's use or disclosure of PHI.
  • Not ask Dhruani to use or disclose PHI in any way the Privacy Rule wouldn't allow the pharmacy to.
  • Send Dhruani only the minimum PHI necessary, and none through channels not meant for it, such as support emails.

5. Term and termination

  • This agreement starts when it's accepted and lasts as long as the Pharmacy Agreement, unless ended sooner under this section.
  • If either party learns the other has materially broken this agreement, it may give the other [number] days to fix it, and end this agreement and the Pharmacy Agreement if it isn't fixed.
  • When it ends: Dhruani returns to the pharmacy, or destroys, all PHI it still holds for the pharmacy, and keeps no copies, unless returning or destroying it isn't feasible. In that case, this agreement's protections continue for as long as Dhruani keeps it, and Dhruani uses it only for the purposes that make return or destruction infeasible.

6. Other terms

  • A reference to a HIPAA section means that section as in effect or as amended. The parties will amend this agreement as needed to keep it in line with the HIPAA Rules.
  • Any unclear wording is read to allow compliance with the HIPAA Rules.
  • Where this agreement and the Pharmacy Agreement differ about PHI, this agreement governs.