Business Associate Agreement

1.1 HIPAA Terms. The following terms have the meanings assigned to them in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Electronic Protected Health Information, Health Care Operations, Individual, Minimum Necessary, Protected Health Information, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

1.2 HIPAA Rules. "HIPAA Rules" means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Parts 160 and 164, as amended, together with applicable provisions of the Health Information Technology for Economic and Clinical Health Act ("HITECH").

1.3 Protected Health Information. "PHI" means Protected Health Information that Business Associate creates, receives, maintains, or transmits from or on behalf of Covered Entity. "ePHI" means PHI maintained in or transmitted by electronic media.

1.4 Services. "Services" means the AI-assisted phone, messaging, scheduling, clinical documentation, insurance coordination, patient-retention, integration, onboarding, support, and related services described in the Underlying Agreement.

2.1 Services and Required Disclosures. Business Associate may Use or Disclose PHI only as necessary to provide the Services, as permitted or required by this Agreement, as directed in writing by Covered Entity, or as Required by Law. Business Associate will not Use or Disclose PHI in a manner that would violate the HIPAA Rules if done by Covered Entity, except for the specific management, administration, Data Aggregation, and de-identification activities permitted below.

2.2 Management and Administration. Business Associate may Use PHI for its proper management and administration or to carry out its legal responsibilities. Business Associate may Disclose PHI for those purposes only if the Disclosure is Required by Law or Business Associate obtains reasonable written assurances that the recipient will keep the PHI confidential, Use or further Disclose it only as Required by Law or for the purpose for which it was disclosed, and notify Business Associate of any breach of confidentiality.

2.3 Data Aggregation and De-identification. Business Associate may provide Data Aggregation services relating to Covered Entity's Health Care Operations. Business Associate may de-identify PHI in accordance with 45 C.F.R. section 164.514(a)-(c) and may Use or Disclose the resulting de-identified information only as permitted by the Underlying Agreement and applicable law.

2.4 Restricted Uses. Business Associate will not sell PHI, Use PHI for advertising or marketing except as expressly authorized by Covered Entity and permitted by the HIPAA Rules, or Use PHI to train or improve generalized artificial intelligence models for Business Associate's or a third party's independent benefit. This restriction does not prohibit a Subcontractor from processing PHI solely to provide the Services on Business Associate's behalf under a written agreement that satisfies Section 3.5.

2.5 Minimum Necessary. Business Associate will limit its Uses, Disclosures, and requests for PHI to the Minimum Necessary to accomplish the intended purpose and will follow Covered Entity's reasonable Minimum Necessary policies communicated to Business Associate.

3.1 Safeguards. Business Associate will use appropriate administrative, physical, and technical safeguards to prevent Uses or Disclosures of PHI other than as provided by this Agreement and will comply with Subpart C of 45 C.F.R. Part 164 with respect to ePHI.

3.2 Incident and Breach Reporting. Business Associate will report to Covered Entity, without unreasonable delay and no later than forty-eight (48) hours after discovery, any Use or Disclosure of PHI not permitted by this Agreement, any Breach of Unsecured PHI as required by 45 C.F.R. section 164.410, and any Security Incident of which Business Associate becomes aware.

3.3 Routine Unsuccessful Security Incidents. The Parties acknowledge that routine unsuccessful Security Incidents, such as unsuccessful log-in attempts, port scans, pings, denial-of-service attempts that do not result in unauthorized access, and attacks blocked by security controls, occur regularly. These events are deemed reported by this Section unless they result in unauthorized access, Use, Disclosure, modification, destruction, or material interference with system operations.

3.4 Breach Information and Mitigation. To the extent known at the time of notice, Business Associate will identify each affected Individual and provide the information reasonably required for Covered Entity to investigate and make notifications under 45 C.F.R. sections 164.404, 164.406, and 164.408. Business Associate will supplement its notice as additional information becomes available and mitigate, to the extent practicable, harmful effects of an impermissible Use or Disclosure known to Business Associate.

3.5 Subcontractors. In accordance with 45 C.F.R. sections 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate will ensure that each Subcontractor that creates, receives, maintains, or transmits PHI on Business Associate's behalf agrees in writing to the same restrictions, conditions, and requirements that apply to Business Associate with respect to that PHI.

3.6 Access. Within five (5) business days after Covered Entity's request, Business Associate will make PHI in a Designated Record Set available to Covered Entity or, if directed by Covered Entity, to the Individual or the Individual's designee, as necessary to satisfy Covered Entity's obligations under 45 C.F.R. section 164.524. Business Associate will promptly forward to Covered Entity any access request received directly from an Individual unless the Parties agree otherwise in writing.

3.7 Amendment. Within five (5) business days after Covered Entity's request, Business Associate will make PHI available for amendment and will make or incorporate amendments to PHI in a Designated Record Set as directed or agreed to by Covered Entity under 45 C.F.R. section 164.526. Business Associate will promptly forward to Covered Entity any amendment request received directly from an Individual.

3.8 Accounting of Disclosures. Business Associate will document Disclosures and maintain information necessary to satisfy Covered Entity's obligations under 45 C.F.R. section 164.528. Within five (5) business days after Covered Entity's request, Business Associate will provide the required accounting information and will promptly forward any accounting request received directly from an Individual.

3.9 Government Access. Business Associate will make its internal practices, books, and records relating to the Use and Disclosure of PHI available to the Secretary for purposes of determining compliance with the HIPAA Rules. To the extent legally permitted, Business Associate will notify Covered Entity of a request received directly from the Secretary.

3.10 Delegated Privacy Obligations. To the extent Business Associate carries out one or more of Covered Entity's obligations under Subpart E of 45 C.F.R. Part 164, Business Associate will comply with the requirements of Subpart E that apply to Covered Entity in performing those obligations.

4.1 Privacy Practices and Restrictions. Covered Entity will notify Business Associate of any limitation in its Notice of Privacy Practices, any change in or revocation of an Individual's permission, and any restriction on the Use or Disclosure of PHI to which Covered Entity has agreed or is required to abide, to the extent the limitation, change, revocation, or restriction may affect Business Associate's Use or Disclosure of PHI.

4.2 Permissible Requests. Covered Entity will not request Business Associate to Use or Disclose PHI in a manner that would violate the HIPAA Rules if done by Covered Entity, except for the management, administration, Data Aggregation, and de-identification activities expressly permitted by this Agreement.

4.3 Authority and Contact Information. Covered Entity represents that it has authority to provide PHI to Business Associate for the Services and will maintain accurate privacy, security, and breach-notification contact information with Business Associate.

5.1 Term. This Agreement begins on the Effective Date and remains in effect for as long as Business Associate creates, receives, maintains, or transmits PHI on behalf of Covered Entity, unless terminated in accordance with this Agreement.

5.2 Termination for Cause. Covered Entity may terminate this Agreement and the applicable Underlying Agreement if Business Associate violates a material term of this Agreement and does not cure the violation or end the violation within the time reasonably specified by Covered Entity. Covered Entity may terminate immediately if cure is not possible. If termination is not feasible, Covered Entity may report the violation to the Secretary.

5.3 Return or Destruction. Upon termination, Business Associate will return to Covered Entity or, if agreed to by Covered Entity, destroy all PHI that Business Associate still maintains in any form. Business Associate may retain only PHI necessary for its proper management and administration or to carry out its legal responsibilities. For retained PHI, Business Associate will continue the safeguards required by this Agreement, limit further Uses and Disclosures to the purpose requiring retention, and return or destroy the PHI when no longer needed. Business Associate will apply these requirements to PHI maintained in backups and by Subcontractors, subject to documented backup-rotation and legal-retention schedules.

5.4 Survival. Business Associate's obligations concerning retained PHI survive termination of this Agreement.

6.1 Covered Entity Notifications. Unless the Parties expressly agree otherwise in writing, Covered Entity is responsible for notifications to Individuals, the Secretary, and the media required by the HIPAA Rules. Business Associate will reasonably cooperate with Covered Entity and provide available information needed for those notifications.

6.2 Costs and Other Remedies. Responsibility for investigation, notification, remediation costs, indemnification, liability limitations, and other remedies is governed by the Underlying Agreement and applicable law.

7.1 Regulatory References. A reference to the HIPAA Rules means the provision as in effect or as amended. The Parties will amend this Agreement as necessary to comply with changes in applicable law.

7.2 Interpretation and Priority. Any ambiguity will be interpreted to permit compliance with the HIPAA Rules. If this Agreement conflicts with the Underlying Agreement regarding PHI, this Agreement controls. A more protective obligation in the Underlying Agreement remains effective.

7.3 Governing Law. Except to the extent preempted by federal law, this Agreement is governed by the laws of Texas, without regard to conflict-of-law rules.

7.4 Notices. Notices to Covered Entity will be sent to the privacy, security, or administrative contact maintained for Covered Entity's account. Notices to Business Associate concerning this Agreement may be sent to support@savvyagents.ai and must identify the Covered Entity and the nature of the notice.

7.5 Electronic Acceptance and Counterparts. This Agreement may be accepted electronically and executed in counterparts. Electronic acceptance, electronic signatures, and copies have the same effect as originals to the extent permitted by applicable law.

7.6 No Third-Party Beneficiaries. This Agreement is for the benefit of the Parties and does not create rights in any other person, except as required by the HIPAA Rules.