Review a clinical-tool contract for privacy limits
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- Extract the clauses on what information the vendor receives, whether it trains on inputs, who else can see them, and any clause that calls the vendor a business associate. Quote the page. Do not approve the contract.
- What the lawyer must review
- You decide whether the contract may be signed. 45 CFR § 164.502 provides that a covered entity or business associate may not use or disclose protected health information except as that subpart, or subpart C of part 160, permits or requires. The section refers to business-associate arrangements. The required contract terms in § 164.504(e) were not opened, so do not recite them. The HHS covered-entity page is the guide to who is a covered entity or a business associate. Formal Opinion 512 requires informed consent before information relating to a representation goes into a self-learning tool. No device regulator's advertising or classification rule was opened.
- Written for / version
- United States versionUS
Who does what
| Role | What they do |
|---|---|
| Assistance | Potential support includes extracting and organising information and preparing preliminary structure or wording. Confirm the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Review operative clauses in the complete document, including definitions, cross-references, schedules and inconsistencies with the instructions.
- Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions.
- Verify the applicable jurisdiction and the version of each relevant law, rule or instrument in force at the material time.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.
Forms and precedents for this task
| Form or precedent | Kind | AI use | Summary |
|---|---|---|---|
| HIPAA business associate agreement checklist | Checklist | AI use Yellow | Checklist for the written terms in a HIPAA business associate contract under 45 CFR 164.504(e) and 164.502(e). |
| HIPAA use and disclosure limits checklist | Checklist | AI use Yellow | Checklist of the use and disclosure limits in 45 CFR 164.502 that a reviewer applies to a business associate contract and a privacy notice. |
| Business associate subcontractor assurance checklist | Checklist | AI use Yellow | Checklist for satisfactory assurances when a business associate uses a subcontractor, and for the other arrangements in 45 CFR 164.504(e)(3). |
Signed-in accounts can read the full text of each one. All precedents.