Business Associate Agreement

This Business Associate Agreement (“BAA”) is incorporated into the Peerlogic Master Service Agreement (“MSA”) under its Section 7 and applies whenever Peerlogic Technologies, Inc. (“Business Associate”) creates, receives, maintains or transmits Protected Health Information (“PHI”) on behalf of Customer (“Covered Entity”) in providing the Services, including call recordings, transcripts and AI-generated summaries that contain PHI. Terms used but not defined here have the meanings given in HIPAA, 45 C.F.R. Parts 160 and 164, as amended, including by the HITECH Act.

1. Permitted uses and disclosures

Business Associate may use and disclose PHI only (a) to perform the Services and its obligations under the MSA, (b) for its proper management and administration or to carry out its legal responsibilities, provided any disclosure for those purposes is required by law or made with reasonable written assurances that the PHI will be held confidentially and that the recipient will notify Business Associate of any breach of confidentiality, (c) to provide data aggregation services relating to Covered Entity’s health care operations, (d) to de-identify PHI in accordance with 45 C.F.R. § 164.514(a)–(b), after which the de-identified data is no longer PHI and may be used and disclosed for any lawful purpose, including as described in MSA Section 5.3, and (e) as required by law. Business Associate will not use or disclose PHI in any manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except as permitted in (b) and (c), and will request, use and disclose only the minimum necessary PHI. Business Associate will not sell PHI, use or disclose PHI for marketing, or receive remuneration in exchange for PHI, except as permitted by 45 C.F.R. § 164.502(a)(5)(ii) and with any authorization HIPAA requires.

2. Safeguards

Business Associate will use appropriate administrative, physical and technical safeguards, and will comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided by this BAA. The security measures summarized in the Data Processing Addendum apply to PHI.

3. Reporting

Business Associate will report to Covered Entity any use or disclosure of PHI not permitted by this BAA, any Security Incident of which it becomes aware, and any Breach of Unsecured PHI, without unreasonable delay and no later than seventy-two (72) hours after discovery. The report will include, to the extent known, the identity of each affected individual and the information required by 45 C.F.R. § 164.410(c), supplemented as it becomes available. Unsuccessful Security Incidents (pings, port scans, blocked login attempts and similar activity that does not result in unauthorized access) are reported through this paragraph without further notice. Covered Entity is responsible for notifying individuals, HHS and the media as required by 45 C.F.R. §§ 164.404–164.408, unless the parties agree otherwise in writing; Business Associate will reasonably cooperate and will bear the reasonable cost of notifications required by a Breach it caused. A report under this Section is not an admission of fault or liability, and Covered Entity will indemnify Business Associate against third-party claims arising from a report made in good faith.

4. Subcontractors

Business Associate will ensure that any subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to restrictions, conditions and requirements at least as protective as those in this BAA, as required by 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2). Current subcontractors are listed on the Subprocessors page.

5. Individual rights

Within 10 business days of a written request, Business Associate will make PHI in a Designated Record Set available to Covered Entity so that Covered Entity can meet its obligations under 45 C.F.R. § 164.524, will make PHI available for amendment and incorporate amendments under § 164.526, and will document and provide the information needed for an accounting of disclosures under § 164.528. Business Associate will forward to Covered Entity any such request it receives directly from an individual. The parties acknowledge that call recordings and transcripts are generally not part of a Designated Record Set unless Covered Entity uses them to make decisions about individuals.

6. Covered Entity obligations

To the extent Business Associate carries out an obligation of Covered Entity under Subpart E, Business Associate will comply with the requirements that apply to Covered Entity in performing it. Covered Entity will (a) notify Business Associate of any limitation in its notice of privacy practices, any change in or revocation of an individual’s authorization, and any restriction on use or disclosure agreed under § 164.522, to the extent it affects Business Associate’s use or disclosure of PHI; (b) obtain any consents and give any notices required for the recording and transcription of calls; and (c) not request Business Associate to use or disclose PHI in a manner that would not be permissible under HIPAA if done by Covered Entity.

7. Access to records

Business Associate will make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary of HHS for purposes of determining Covered Entity’s compliance with HIPAA.

8. Term and termination

This BAA continues for as long as Business Associate holds PHI received from or created for Covered Entity. Covered Entity may terminate the affected Services under the MSA if Business Associate materially breaches this BAA and fails to cure within thirty (30) days of written notice, or immediately if cure is not possible. On termination of the Services, Business Associate will return or destroy all PHI, retaining no copies, within thirty (30) days after Covered Entity’s export period under the Data Processing Addendum ends; where return or destruction is infeasible (including PHI in routine backups), Business Associate will extend the protections of this BAA to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as it is retained.

9. Miscellaneous

Any ambiguity is resolved to permit compliance with HIPAA. The parties will amend this BAA as needed to comply with changes in HIPAA; Business Associate may publish an updated version under MSA Section 7, provided the update does not reduce the protections for PHI. Nothing in this BAA confers rights on any third party. Where this BAA conflicts with the MSA or the Data Processing Addendum regarding PHI, this BAA controls.