Business Associate Agreement

This Business Associate Agreement (the "Agreement") is entered into as of the date of electronic acceptance (the "Effective Date") by and between the health care practice identified during account registration (the "Covered Entity" or "Practice") and [Company legal name], doing business as Nuvanei Health, a [State] [entity type] with its principal place of business at [address] ("Business Associate"). The Practice and Business Associate are each a "Party" and together the "Parties."

Recitals

A. The Practice is a Covered Entity, or a Business Associate acting on behalf of a Covered Entity, under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, as amended by the Health Information Technology for Economic and Clinical Health Act ("HIPAA").

B. Business Associate provides a hosted practice-management, patient-engagement, billing and workflow platform (the "Services") under the Nuvanei Health Terms of Service (the "Service Agreement"), and in doing so creates, receives, maintains or transmits Protected Health Information on behalf of the Practice.

C. The Parties enter into this Agreement to satisfy the requirements of 45 C.F.R. §§ 164.502(e), 164.504(e), 164.308(b) and 164.314(a), and to set out Business Associate's obligations with respect to Protected Health Information.

Article 1. Definitions

1.1 Capitalized terms used but not defined in this Agreement have the meanings given in 45 C.F.R. Parts 160 and 164 (the "HIPAA Rules"), including "Breach," "Data Aggregation," "Designated Record Set," "Electronic Protected Health Information" ("ePHI"), "Individual," "Minimum Necessary," "Protected Health Information" ("PHI"), "Required by Law," "Secretary," "Security Incident," "Subcontractor" and "Unsecured PHI."

1.2 "PHI" as used in this Agreement is limited to PHI that Business Associate creates, receives, maintains or transmits on behalf of the Practice.

1.3 "Platform Safeguards" means the technical measures described in Article 3, as updated from time to time in Business Associate's published security documentation.

Article 2. Permitted and Required Uses and Disclosures

2.1 Services. Business Associate may use and disclose PHI only as necessary to perform the Services for the Practice as described in the Service Agreement, including scheduling, clinical documentation, laboratory and prescription workflows through connected partners, billing and membership management, secure messaging, the patient application, analytics and AI-assisted drafting functions, and as otherwise permitted or required by this Agreement or Required by Law.

2.2 Management and administration. Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities, and may disclose PHI for those purposes if (a) the disclosure is Required by Law or (b) Business Associate obtains reasonable written assurances from the recipient that the PHI will be held confidentially, used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the recipient will notify Business Associate of any instance of which it becomes aware in which the confidentiality of the PHI has been breached.

2.3 Data Aggregation and de-identification. Business Associate may provide Data Aggregation services relating to the health care operations of the Practice, and may de-identify PHI in accordance with 45 C.F.R. § 164.514(a)–(c). De-identified information is not PHI and may be used by Business Associate to operate, maintain and improve the Services.

2.4 Prohibited uses. Business Associate will not (a) use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by the Practice, except as permitted by Sections 2.2 and 2.3; (b) sell PHI; (c) use or disclose PHI for marketing or fundraising; or (d) use PHI, or permit any model provider to use PHI, to train, retrain or evaluate machine-learning models intended for use outside the Practice's tenant.

2.5 Minimum Necessary. Business Associate will limit its uses, disclosures and requests of PHI to the Minimum Necessary to accomplish the intended purpose, and will apply role-based access so that members of its workforce access PHI only to the extent required to deliver and support the Services.

Article 3. Safeguards

3.1 Security Rule compliance. Business Associate will implement and maintain administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of ePHI, and will comply with Subpart C of 45 C.F.R. Part 164, including 45 C.F.R. §§ 164.308, 164.310, 164.312 and 164.316, with respect to ePHI.

3.2 Platform Safeguards. Without limiting Section 3.1, the Services implement the following controls:

3.3 Workforce. Business Associate will train its workforce on the requirements of this Agreement and the HIPAA Rules, and will apply appropriate sanctions against workforce members who violate them.

3.4 Mitigation. Business Associate will mitigate, to the extent practicable, any harmful effect known to Business Associate of a use or disclosure of PHI in violation of this Agreement.

Article 4. Subcontractors

4.1 Business Associate will ensure that any Subcontractor that creates, receives, maintains or transmits PHI on behalf of Business Associate, including cloud infrastructure, communications, payment, laboratory, e-prescribing and model-hosting providers, agrees in writing to restrictions and conditions at least as protective as those that apply to Business Associate under this Agreement, in accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2).

4.2 Business Associate will maintain a current list of Subcontractors that handle PHI and will make it available to the Practice on request.

Article 5. Reporting

5.1 Impermissible uses and disclosures. Business Associate will report to the Practice any use or disclosure of PHI not permitted by this Agreement of which it becomes aware.

5.2 Security Incidents. Business Associate will report Security Incidents of which it becomes aware. The Parties agree that this Section constitutes notice of unsuccessful Security Incidents that do not result in unauthorized access, use, disclosure, modification or destruction of ePHI, such as pings, port scans, denied log-in attempts and blocked malware, and that no further notice of such events is required.

5.3 Breaches of Unsecured PHI. Business Associate will notify the Practice of any Breach of Unsecured PHI without unreasonable delay and in no case later than ten (10) business days after discovery, as "discovery" is defined in 45 C.F.R. § 164.410(a)(2). The notice will include, to the extent known, the identification of each Individual affected and the information required by 45 C.F.R. § 164.410(c), and Business Associate will supplement the notice as additional information becomes available.

5.4 Cooperation. Business Associate will cooperate with the Practice's investigation, risk assessment and notification obligations, and will not notify Individuals, the media or the Secretary on the Practice's behalf unless requested in writing by the Practice or Required by Law.

Article 6. Individual Rights

6.1 Access. Within ten (10) business days of a request from the Practice, Business Associate will make PHI maintained in a Designated Record Set available to the Practice as necessary for the Practice to satisfy its obligations under 45 C.F.R. § 164.524, including, where the Practice so directs, in the electronic form and format requested by the Individual if readily producible.

6.2 Amendment. Business Associate will make PHI in a Designated Record Set available for amendment and will incorporate amendments directed by the Practice in accordance with 45 C.F.R. § 164.526.

6.3 Accounting of disclosures. Business Associate will document disclosures of PHI and the information related to such disclosures that would be required for the Practice to respond to a request for an accounting under 45 C.F.R. § 164.528, and will provide that information to the Practice within ten (10) business days of a request.

6.4 Requests received directly. If Business Associate receives a request from an Individual under this Article, it will forward the request to the Practice within five (5) business days.

6.5 Delegated obligations. To the extent Business Associate carries out one or more of the Practice's obligations under Subpart E of 45 C.F.R. Part 164, Business Associate will comply with the requirements of Subpart E that apply to the Practice in the performance of those obligations.

Article 7. Books and Records

Business Associate will make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining the Practice's and Business Associate's compliance with the HIPAA Rules, subject to applicable attorney-client and other legal privileges.

Article 8. Obligations of the Practice

8.1 The Practice will notify Business Associate of any limitation in its Notice of Privacy Practices, any change in or revocation of an Individual's authorization, and any restriction on the use or disclosure of PHI agreed to by the Practice, in each case to the extent such limitation, change or restriction may affect Business Associate's use or disclosure of PHI.

8.2 The Practice will not request Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by the Practice, except as provided in Sections 2.2 and 2.3.

8.3 The Practice is responsible for obtaining any consents or authorizations required for the Services, including patient consent to electronic communication through the patient application and, where applicable, telehealth consent.

Article 9. Term and Termination

9.1 Term. This Agreement is effective on the Effective Date and continues until all PHI is returned or destroyed in accordance with Section 9.4, or, if return or destruction is infeasible, for so long as Business Associate retains PHI.

9.2 Termination for cause. Either Party may terminate this Agreement and the Service Agreement if it determines that the other Party has violated a material term of this Agreement and the breaching Party fails to cure the violation within thirty (30) days of written notice.

9.3 Effect on Service Agreement. Termination of the Service Agreement terminates this Agreement, subject to Sections 9.1 and 9.4.

9.4 Return or destruction. On termination, Business Associate will, at the Practice's election, make the Practice's PHI available for export in a commonly used electronic format for a period of thirty (30) days, and will thereafter destroy all PHI in its possession, including PHI held by Subcontractors, and retain no copies, except that where return or destruction is infeasible Business Associate will extend the protections of this Agreement to the retained PHI and limit further uses and disclosures to those purposes that make return or destruction infeasible. Backup media are destroyed in the ordinary course of Business Associate's backup rotation, not to exceed ninety (90) days.

9.5 Survival. Articles 5, 6, 7 and 9 and Section 10.4 survive termination.

Article 10. Miscellaneous

10.1 Regulatory references. A reference in this Agreement to a section of the HIPAA Rules means the section as in effect or as amended.

10.2 Amendment. The Parties will take such action as is necessary to amend this Agreement from time to time to comply with changes in the HIPAA Rules. Business Associate may publish an updated version of this Agreement through the Services, and continued use of the Services after acceptance of the updated version constitutes agreement to it.

10.3 Interpretation. Any ambiguity in this Agreement will be resolved to permit compliance with the HIPAA Rules. In the event of a conflict between this Agreement and the Service Agreement with respect to PHI, this Agreement controls.

10.4 No third-party beneficiaries. Nothing in this Agreement confers any right, remedy or obligation on any person other than the Parties and their respective successors and permitted assigns.

10.5 Governing law. This Agreement is governed by the laws of the State of [State], without regard to its conflict-of-laws principles, except to the extent preempted by federal law.

10.6 Notices. Notices under this Agreement will be sent to the Practice at the owner email address on file and to Business Associate at [legal notice email], with a copy to [address].

Article 11. Electronic Signature

By typing their name and title below, the signatory represents that they are duly authorized to bind the Practice to this Agreement, and agrees that the electronic acceptance record maintained by Business Associate, including the version identifier, timestamp, network address and cryptographic fingerprint of this text, constitutes a valid signature under the Electronic Signatures in Global and National Commerce Act and applicable state law.

This document is a pre-release draft provided for review and has not yet been approved by legal counsel. A final version will be published and, where required, re-acceptance requested.