Business Associate Agreement (BAA)

1. Purpose

This Agreement establishes the obligations of Business Associate when creating, receiving, maintaining, or transmitting PHI on behalf of Covered Entity in connection with the Services, including patient intake workflows, communications, messaging, form management, workflow automation, payment-related workflows, reporting, analytics, synchronization services, and related platform functionality.

2. Definitions

All capitalized terms not otherwise defined shall have the meanings set forth in HIPAA (45 C.F.R. Parts 160 and 164).

3. Permitted Uses and Disclosures

Business Associate may use and disclose PHI solely to:

• Perform services for Covered Entity;
• Provide customer support and technical assistance;
• Maintain, operate, administer, secure, support, troubleshoot, and improve the Services solely for purposes of providing the Services to Covered Entity and other customers in a manner permitted by HIPAA;
• Comply with legal and regulatory obligations;
• Prevent fraud and ensure system integrity;
• Operate, administer, support, monitor, troubleshoot, secure, and maintain the Services and related platform functionality; and
• De-identify PHI in accordance with HIPAA.

Business Associate shall not:

• Sell PHI;
• Use PHI for marketing without authorization; or
• Disclose PHI except as permitted by this Agreement or required by law.

4. Minimum Necessary Standard

Business Associate shall limit the use, disclosure, and access to PHI to the minimum necessary to accomplish the intended purpose, in accordance with 45 C.F.R. § 164.502(b), except where otherwise permitted or required by law.

5. Safeguards and Security Standards

Business Associate shall implement appropriate administrative, physical, and technical safeguards to protect PHI and ePHI in accordance with the HIPAA Security Rule, including:

• Encryption of PHI in transit and at rest using industry-standard methods where PHI is maintained within systems controlled by Business Associate;
• Access controls, authentication mechanisms, and role based permissions;
• Audit logging, monitoring, and incident detection capabilities;
• Workforce training and security awareness programs;
• Data backup, disaster recovery, and business continuity procedures; and
• Secure system development and maintenance practices.

Business Associate agrees to maintain commercially reasonable safeguards consistent with industry standards, including alignment with recognized frameworks such as SOC 2, NIST, ISO 27001, or equivalent standards, where applicable.

Nothing in this Agreement shall be construed as a representation or warranty that Business Associate maintains a SOC 2 certification unless expressly stated in writing.

6. Subcontractors

Business Associate shall ensure that any subcontractor that creates, receives, maintains, or transmits PHI on its behalf agrees in writing to comply with applicable HIPAA requirements and is bound by restrictions and conditions no less stringent than those set forth in this Agreement.

Business Associate may utilize cloud infrastructure providers, messaging providers, email delivery providers, payment service providers, monitoring providers, and other service providers as subcontractors or downstream service providers.

7. Breach Notification

Business Associate shall notify Covered Entity of any Breach of Unsecured PHI without unreasonable delay and in accordance with applicable law, and in no event later than sixty (60) days after discovery of the Breach, unless a shorter period is required by law.

Notification shall include, to the extent available:

• A description of the nature of the Breach;
• The types of PHI involved;
• The individuals affected, if known;
• Steps taken to mitigate potential harm; and
• Corrective actions implemented to prevent recurrence.

8. Security Incidents

Business Associate shall report Security Incidents of which it becomes aware. Routine unsuccessful attempts such as pings, port scans, and login attempts shall not constitute reportable incidents unless they result in unauthorized access.

9. Individual Rights

Business Associate shall, to the extent applicable:

• Provide access to PHI;
• Support amendments to PHI;
• Provide an accounting of disclosures; and
• Assist Covered Entity in complying with HIPAA obligations.

10. Availability of Records

Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the U.S. Department of Health and Human Services for purposes of determining HIPAA compliance.

11. Return or Destruction of PHI

Upon termination of this Agreement, Business Associate shall return or destroy PHI where feasible.

If return or destruction is not feasible, Business Associate shall continue to protect such PHI in accordance with HIPAA.

Business Associate may retain archival, backup, disaster recovery, security, audit, or legally required copies of PHI where deletion is not reasonably feasible, provided such information remains protected in accordance with HIPAA and this Agreement.

12. Indemnification

Each party shall indemnify, defend, and hold harmless the other party and its officers, directors, employees, agents, and affiliates from and against any third party claims, damages, liabilities, fines, penalties, costs, and expenses (including reasonable attorneys' fees) arising out of or related to:

• A material breach of this Agreement;
• A violation of HIPAA, HITECH, or applicable data protection laws;
• The negligence, gross negligence, or willful misconduct of the indemnifying party; or
• A Breach of Unsecured PHI caused by the indemnifying party.

To the extent permitted by law, these indemnification obligations shall be subject to the limitations of liability set forth in the governing Master Services Agreement, Terms of Service, or other applicable agreement between the parties.

13. Limitation of Liability

To the extent permitted by law, each party's liability arising under this Agreement shall be subject to the limitations of liability set forth in the governing Master Services Agreement, Terms of Service, or other applicable agreement between the parties.

14. HIPAA Omnibus Rule Compliance

Business Associate acknowledges that it is directly subject to and shall comply with the applicable provisions of the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules, as amended by HITECH and the HIPAA Omnibus Final Rule.

15. Relationship to Other Agreements

This Agreement supplements and is incorporated into the following documents, each of which is incorporated herein by reference:

Terms of Service

https://healthofyourspace.com/terms-of-service

Privacy Policy

https://healthofyourspace.com/privacy-policy

Master Services Agreement (MSA) — As executed between the parties, or where applicable:

https://healthofyourspace.com/master-service-agreement

Data Processing Addendum (DPA)

https://healthofyourspace.com/data-processing-addendum

Security Overview

https://healthofyourspace.com/security

In the event of a conflict, this Agreement shall control with respect to Protected Health Information.

16. Survival

The provisions of this Agreement that by their nature should survive termination shall survive, including but not limited to those relating to:

• Confidentiality;
• Indemnification;
• Limitation of liability;
• Breach notification;
• Return or destruction of PHI; and
• Regulatory compliance.

17. Governing Law

This Agreement shall be governed by and construed in accordance with the governing law provisions set forth in the applicable Master Services Agreement. To the extent the applicable Master Services Agreement does not contain governing law provisions, this Agreement shall be governed by and construed in accordance with the laws of the State of Florida, without regard to its conflict-of-law principles. Venue and jurisdiction for any dispute arising under this Agreement shall be determined in accordance with the applicable Master Services Agreement.

18. No Third-Party Beneficiaries

Nothing in this Agreement shall be construed to create any rights, remedies, obligations, or causes of action in favor of any person or entity other than the parties and their permitted successors and assigns.

19. Entire Agreement

This Agreement constitutes the complete and exclusive understanding between the parties with respect to the subject matter of this Agreement and supersedes all prior and contemporaneous Business Associate Agreements, negotiations, communications, representations, and understandings relating to such subject matter. This Agreement supplements, and does not replace, the Terms of Service, Privacy Policy, Master Services Agreement, Data Processing Addendum, and other agreements expressly incorporated herein. Any executed Non-Disclosure Agreement or other agreement between the parties that does not directly conflict with this Agreement shall remain in full force and effect unless expressly terminated or superseded in writing.