Business Associate Agreement.

Terms used but not defined here have the meaning set out in the HIPAA Rules (45 CFR Parts 160, 162, and 164). “Covered Entity” refers to Customer; “Business Associate” refers to PracticeIQ.

Business Associate may use or disclose PHI only as necessary to perform Services, as required by law, or as otherwise permitted by this BAA. PHI is never sold, rented, or used for marketing.

Business Associate will maintain appropriate administrative, physical, and technical safeguards per 45 CFR § 164.308, 310, 312, and 316 to prevent unauthorized use or disclosure of PHI. Current safeguards are published at /security.

Business Associate will report to Covered Entity any use or disclosure of PHI not permitted by this BAA, and any breach of Unsecured PHI, within 15 calendar days of discovery (60-day statutory maximum applies).

Business Associate will ensure any agent or subcontractor that handles PHI on its behalf agrees in writing to the same restrictions. Current subprocessors are published at /legal/subprocessors.

Within 30 days of request, Business Associate will make PHI available to Covered Entity (or the subject individual) for access and amendment, and provide an accounting of disclosures per 45 CFR § 164.528.

Upon termination, Business Associate will return or destroy all PHI received from Covered Entity. Where return/destruction is infeasible, protections are extended for the duration PHI is retained.

Effective on execution; remains in effect until termination of the Services agreement. Obligations surrounding PHI survive termination.

This BAA is governed by the laws of Delaware, USA. Any conflict with the Services agreement is resolved in favor of protecting PHI.