Sign the BAA

This Business Associate Agreement ("Agreement") is between the customer named on the signature page ("Customer") and Splice Health ("Business Associate"). Customer is a covered entity or a business associate of a covered entity under HIPAA. If Customer is a business associate, this Agreement is a subcontractor business associate agreement under 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2).

1. Definitions

1.1 Terms used but not defined in this Agreement have the meanings given in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information and Use.

1.2 "HIPAA Rules" means the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Part 160 and Part 164.

1.3 "PHI" means Protected Health Information that Business Associate creates, receives, maintains or transmits for or on behalf of Customer.

2. Obligations of Business Associate

Business Associate will:

(a) Not use or disclose PHI other than as this Agreement permits or requires, or as Required by Law.

(b) Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 for electronic PHI, to prevent use or disclosure of PHI other than as this Agreement provides.

(c) Report to Customer any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, including Breaches of Unsecured PHI as 45 CFR 164.410 requires, and any Security Incident of which it becomes aware. Business Associate will report a Breach without unreasonable delay and no later than 30 calendar days after discovery. The parties agree that this section is notice of the ongoing existence of unsuccessful Security Incidents, such as pings, port scans and failed log-in attempts, for which no further notice is required.

(d) Under 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractor that creates, receives, maintains or transmits PHI on behalf of Business Associate agrees in writing to the same restrictions, conditions and requirements that apply to Business Associate.

(e) Make PHI in a Designated Record Set available to Customer within 15 business days of a request, as necessary to satisfy Customer's obligations under 45 CFR 164.524.

(f) Make amendments to PHI in a Designated Record Set as directed by Customer under 45 CFR 164.526, within 15 business days of a request.

(g) Maintain and make available, within 15 business days of a request, the information required for Customer to provide an accounting of disclosures under 45 CFR 164.528.

(h) To the extent Business Associate carries out an obligation of Customer under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to Customer in the performance of that obligation.

(i) Make its internal practices, books and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

3. Permitted Uses and Disclosures

3.1 Business Associate may use or disclose PHI as necessary to perform the services described in the agreement between the parties for EHR, practice management system and payer portal integrations ("Services").

3.2 Business Associate may use or disclose PHI as Required by Law.

3.3 Business Associate will make uses, disclosures and requests for PHI consistent with Customer's minimum necessary policies and procedures.

3.4 Business Associate will not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Customer, except as sections 3.5 to 3.7 permit.

3.5 Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities.

3.6 Business Associate may disclose PHI for its proper management and administration or to carry out its legal responsibilities, provided the disclosure is Required by Law, or Business Associate obtains reasonable assurances from the recipient that the information will remain confidential, will be used or further disclosed only as Required by Law or for the purposes for which it was disclosed to the recipient, and the recipient will notify Business Associate of any instance of which it is aware in which the confidentiality of the information has been breached.

3.7 Business Associate may provide Data Aggregation services relating to the Health Care Operations of Customer.

3.8 Business Associate may de-identify PHI in accordance with 45 CFR 164.514(a) to (c).

4. Obligations of Customer

4.1 Customer will notify Business Associate of any limitation in its Notice of Privacy Practices under 45 CFR 164.520, to the extent the limitation can affect Business Associate's use or disclosure of PHI.

4.2 Customer will notify Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose PHI, to the extent the change can affect Business Associate's use or disclosure of PHI.

4.3 Customer will notify Business Associate of any restriction on the use or disclosure of PHI that Customer has agreed to or must comply with under 45 CFR 164.522, to the extent the restriction can affect Business Associate's use or disclosure of PHI.

4.4 Customer will not request Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Customer.

5. Term and Termination

5.1 Term. This Agreement starts on the date Customer signs it and continues until all Services end and all PHI is returned or destroyed under section 5.3, unless terminated earlier under section 5.2.

5.2 Termination for cause. If either party determines that the other party has violated a material term of this Agreement, it may terminate this Agreement and the Services if the other party does not cure the violation within 30 days of written notice.

5.3 Obligations on termination. On termination of this Agreement for any reason, Business Associate will return to Customer or destroy all PHI that it still maintains in any form, and will retain no copies. If return or destruction is infeasible, Business Associate will extend the protections of this Agreement to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as Business Associate maintains the PHI.

5.4 Survival. The obligations of Business Associate under section 5.3 survive the termination of this Agreement.

6. Miscellaneous

6.1 Regulatory references. A reference in this Agreement to a section of the HIPAA Rules means the section as in effect or as amended.

6.2 Amendment. The parties will take such action as is necessary to amend this Agreement from time to time for compliance with the requirements of the HIPAA Rules and any other applicable law.

6.3 Interpretation. Any ambiguity in this Agreement will be resolved to permit compliance with the HIPAA Rules.

6.4 No third-party beneficiaries. Nothing in this Agreement gives any right or remedy to any person other than the parties.

6.5 Electronic signature. The parties agree that this Agreement can be signed electronically, and that an electronic signature has the same effect as a handwritten signature.

6.6 Order of precedence. If this Agreement conflicts with any other agreement between the parties about PHI, this Agreement controls.