Basic BAA vs Comprehensive BAA
| BASIC BAA | COMPREHENSIVE BAA | |
| VSee forwards an individual’s request to restrict his or her PHI to Covered Entity pursuant to 45 CFR § 164.522 | Within 10 days | Within 5 days |
| VSee forwards an individual’s request to access his or her PHI to Covered Entity pursuant to 45 CFR § 164.524 | Within 10 days | Within 5 days |
| VSee forwards an individual’s request to amend his or her PHI to Covered Entity pursuant to 45 CFR § 164.526 | Within 10 days | Within 5 days |
| VSee forwards an individual’s request for an accounting of disclosures of PHI to Covered Entity pursuant to 45 CFR § 164.528 | Within 10 days | Within 5 days |
| VSee provides breach notice to Covered Entity | Within 10 days | Within 5 days |
| Written notice to affected individuals pursuant to 45 CFR § 164.404(c)-(d) | Covered Entity responsible for the notice. | VSee responsible for the notice. |
| Written notice to the media pursuant to 45 CFR § 164.406 | Covered Entity responsible for the notice. | VSee responsible for the notice. |
| Written notice to the Secretary of U.S. Department of Health and Human Services pursuant to 45 CFR § 164.408 | Covered Entity responsible for the notice. | VSee responsible for the notice. |
| Maintain log of breach of Unsecured PHI pursuant to 45 CFR § 164.408 (for breach involving fewer than 500 individuals) | Covered Entity responsible for maintaining the log. | VSee responsible for maintaining the log and providing to Covered Entity. |