Business Associate Agreement

This Business Associate Agreement (“BAA”) is incorporated into the Order Form between the Customer completing the Order Form (the “Covered Entity”) and Exponential Platform Inc. (the “Business Associate”). Pursuant to the Agreement, the Business Associate performs functions and activities involving the transmittal, use, and disclosure of Protected Health Information (as defined in 45 C.F.R. § 160.103, referred to hereafter as "PHI") for the Covered Entity. All capitalized terms used herein and not otherwise defined have the meanings set forth in 45 C.F.R. Parts 160-164 (the "HIPAA Rules"). This BAA is intended to meet the requirements of the "Business Associate" provisions of the HIPAA Rules and will govern the terms and conditions under which Business Associate may disclose PHI or have PHI disclosed to it by the Covered Entity.

1.             Business Associate Obligations
(a)           Business Associate will:
(i)            Use or disclose PHI only as permitted by this BAA or required by law.
(ii)           Implement administrative, physical, and technical safeguards to protect PHI per the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C) and Privacy Rule (Subpart E).
(iii)         Report to Covered Entity: (a) any unauthorized PHI use or disclosure; (b) any Security Incident; and (c) any Breach of Unsecured PHI within 60 days of discovery (45 C.F.R. § 164.410).
(iv)          Make PHI available to satisfy individuals’ access and amendment rights (45 C.F.R. §§ 164.526, 164.528).
(v)           Make books and records available to HHS for compliance review.
(vi)          Require subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate to agree in writing to the same restrictions, conditions, and requirements that apply to Business Associate under this BAA with respect to such PHI, in accordance with 45 C.F.R. §§ 164.504(e)(5) and 164.314(a)(2)(i)..
(vii)        To the extent Business Associate is to carry out one or more of the Covered Entity's obligations under Subpart E of 45 C.F.R. Part 164, Business Associate agrees to comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such obligations.
2.             Covered Entity Obligations
(a)           Notify Business Associate of any changes which may affect the Business Associate’s use or disclosure of the PHI, including but not limited to(A) changes to the EHR platform credentials or access permissions; (B) modifications to EHR platform policies or terms of use that impact Business Associate’s authorized access; (C) changes or revocation of permission of an individual to use his or her PHI; and (D) any restrictions on PHI that the Covered Entity has agreed to or is required to abide by. Covered entity shall provide such notification at least 48 hours in advance of any planned changes where practicable.
(b)           Promptly report to Business Associate: (A) any security incident or other use or disclosure of PHI not provided for by this Agreement of which the Covered Entity becomes aware; (B) any suspected unauthorized access or use of the EHR platform credentials provided to Business Associate; and (C) any changes to EHR platform security requirements or access protocols that could impact Business Associate’s authorized access. Such notification shall be made within 24 hours of the Covered Entity becoming aware of such incidents or changes.
3.             Term and Termination
(a)           This BAA remains in effect as long as the Agreement is in effect.
(b)           Upon termination, Business Associate will either return or destroy all PHI received from the Covered Entity or created or received by Business Associate on behalf of the Covered Entity within 30 days. Business Associate shall not retain any copies of such PHI. Notwithstanding the foregoing, in the event that Business Associate determines that returning or destroying the PHI is infeasible, Business Associate shall provide to the Covered Entity notification of the condition that makes return or destruction infeasible. To the extent that it is not feasible for Business Associate to return or destroy such PHI, the terms and provisions of this BAA shall survive such termination, and such PHI shall be used or disclosed solely as permitted by law for so long as Business Associate retains such PHI.
(c)           Business Associate may retain PHI which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities as approved by the Covered Entity in writing. Business Associate will continue to use all the safeguards set out in this BAA with regard to any PHI it retains after the termination of this Agreement.
(d)           Business Associate’s obligations under this Termination section shall survive the termination of this Agreement.
4.             Miscellaneous
Any ambiguity in this BAA shall be resolved to maintain compliance with the applicable HIPAA Rules. A reference in this BAA to a section in the HIPAA Rules means the section as in effect or as amended. The Parties agree that the terms of this BAA shall apply only to themselves and are not for the benefit of any third-party beneficiaries.