Business Associate Agreement

Capitalized terms not defined here, including Breach, Protected Health Information ("PHI"), Electronic PHI, Security Incident, Subcontractor, and Unsecured PHI, have the meanings given in the HIPAA Rules at 45 C.F.R. Parts 160 and 164, as amended by the HITECH Act. "PHI" means only PHI that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity.

2.1 Business Associate may use and disclose PHI to operate the Platform for Covered Entity, including to transmit referrals to the Members Covered Entity selects, store referral records, produce Priority Records, and process Representation Preference requests.

2.2 Business Associate may use and disclose PHI for its proper management and administration and to carry out its legal responsibilities, as permitted by 45 C.F.R. 164.504(e)(4).

2.3 Business Associate will not use PHI to train any artificial intelligence model, including any general-purpose, third-party, or publicly available model. Business Associate may de-identify PHI in accordance with 45 C.F.R. 164.514(b) and may use such de-identified information to operate, analyze, improve, and develop the Platform and Business Associate's internal models and services. Business Associate will not attempt to re-identify such de-identified information.

2.4 Business Associate will limit its uses, disclosures, and requests for PHI to the minimum necessary to the extent the minimum necessary standard applies under the HIPAA Rules, and will not sell PHI or use PHI for marketing except as expressly permitted by the HIPAA Rules and this Agreement.

Business Associate will:

1. not use or disclose PHI except as permitted by this Agreement or required by law;
2. use appropriate safeguards, and comply with Subpart C of 45 C.F.R. Part 164 for Electronic PHI, to prevent uses or disclosures not permitted by this Agreement;
3. report to Covered Entity any use or disclosure not permitted by this Agreement, any Security Incident, and any Breach of Unsecured PHI without unreasonable delay, and no later than 10 business days after discovery, with the information required by 45 C.F.R. 164.410 to the extent available. This Agreement serves as notice of unsuccessful Security Incidents, such as pings, port scans, and blocked log-in attempts, for which no further report is required;
4. mitigate, to the extent practicable, any harmful effect of a use or disclosure not permitted by this Agreement;
5. ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on its behalf, including hosting and AI service providers, agrees in writing to the same restrictions and conditions that apply to Business Associate. Business Associate will not permit any Subcontractor or AI service provider to use PHI received through the Platform to train or improve models or services for that Subcontractor's or provider's own independent purposes;
6. within 15 days of a request from Covered Entity, make PHI in a Designated Record Set available for access or amendment as required by 45 C.F.R. 164.524 and 164.526, if Business Associate maintains a Designated Record Set;
7. maintain and provide the information needed for Covered Entity to give an accounting of disclosures under 45 C.F.R. 164.528;
8. to the extent it carries out Covered Entity's obligations under Subpart E of 45 C.F.R. Part 164, comply with the requirements that apply to Covered Entity; and
9. make its internal practices, books, and records relating to PHI available to the Secretary of Health and Human Services to determine compliance with the HIPAA Rules.

4.1 Covered Entity will notify Business Associate of any limitation in its notice of privacy practices, any restriction it agrees to, and any revocation of a patient's authorization, to the extent it affects Business Associate's use or disclosure of PHI.

4.2 Covered Entity is solely responsible for determining that each disclosure it makes through the Platform is permitted by the HIPAA Rules, including obtaining any patient authorization required before referring a patient to a Member that is not a covered entity, such as a placement agent.

4.3 Covered Entity will send only the minimum necessary PHI through the Platform and will not ask Business Associate to use or disclose PHI in any way that would violate the HIPAA Rules if done by Covered Entity.

5.1 This Agreement begins on its effective date and ends when Covered Entity's membership ends and all PHI has been returned, destroyed, or protected under Section 5.3.

5.2 If either party materially breaches this Agreement, the other party may terminate it, and the membership, if the breach is not cured within 30 days after written notice.

5.3 When this Agreement ends, Business Associate will return or destroy PHI where feasible. To the extent return or destruction is infeasible, including where retention is required by applicable law or reasonably necessary for the establishment, exercise, or defense of legal claims, audit, regulatory compliance, or dispute resolution, Business Associate will continue to protect the retained PHI under this Agreement and will limit further uses and disclosures to those purposes that make return or destruction infeasible.

6.1 The parties will amend this Agreement as needed to comply with changes in the HIPAA Rules.

6.2 Any ambiguity will be interpreted to permit compliance with the HIPAA Rules. If this Agreement conflicts with the Member Terms regarding PHI, this Agreement controls.

6.3 Nothing in this Agreement creates rights for any third party.

6.4 Sections 5.3 and 6 survive the end of this Agreement.

6.5 Notices to Business Associate: Mildred Enterprises, LLC, 7014 E Camelback Rd, Suite B100A, Scottsdale, AZ 85251, support@askmildred.ai.

6.6 This Agreement may be signed electronically and in counterparts, each of which is an original.