Business Associate Agreement

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (the "Agreement") is entered into by and between Helfzen Enterprises LLC, a New York limited liability company ("Business Associate"), and the organization on whose behalf this Agreement is accepted through the Helfzen application ("Covered Entity"). It takes effect on the date Covered Entity's authorized administrator accepts it electronically (the "Effective Date"), as shown in the acceptance record Helfzen keeps for Covered Entity's account.

Recitals

A. Business Associate provides Covered Entity with a hosted software platform for claims follow-up, collections and payment reconciliation and, where separately engaged, revenue-management services (together, the "Services"), under a separate agreement (the "Underlying Agreement").

B. In performing the Services, Business Associate creates, receives, maintains or transmits Protected Health Information on Covered Entity's behalf, and is therefore a business associate under 45 CFR §160.103. The Parties enter into this Agreement to satisfy 45 CFR §164.504(e).

C. Where Covered Entity is itself a business associate of a health care provider or health plan — a billing company acting for its client agencies, for example — Business Associate is a subcontractor under §160.103, and this Agreement operates as the written contract required by 45 CFR §164.502(e)(1)(ii).

1. Definitions

1.1 Capitalized terms not defined here have the meanings given in the HIPAA Rules, including Breach, Designated Record Set, Disclosure, Electronic Protected Health Information, Individual, Minimum Necessary, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information and Use.

1.2 "HIPAA Rules" means 45 CFR Parts 160, 162 and 164.

1.3 "PHI" means Protected Health Information created, received, maintained or transmitted by Business Associate on Covered Entity's behalf under the Underlying Agreement.

1.4 "Subprocessor" means a Subcontractor engaged by Business Associate that creates, receives, maintains or transmits PHI on its behalf.

2. Permitted uses and disclosures

2.1 Business Associate may Use or Disclose PHI only as necessary to perform the Services, as required by this Agreement, or as Required by Law.

2.2 Business Associate may Use PHI for its own proper management and administration, and to carry out its legal responsibilities.

2.3 Business Associate may Disclose PHI for its own proper management and administration, or as Required by Law, only if the Disclosure is Required by Law, or Business Associate obtains reasonable assurances in writing that the recipient will hold it confidentially, use or disclose it only as required by law or for the purpose disclosed, and notify Business Associate of any breach.

2.4 Business Associate may de-identify PHI in accordance with 45 CFR §164.514(a)–(c). De-identified data is not PHI and is not subject to this Agreement.

2.5 Business Associate will not Use or Disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity.

2.6 Business Associate will not sell PHI, and will not Use or Disclose PHI for marketing, in either case as those terms are used in 45 CFR §164.502(a)(5) and §164.508(a).

3. Obligations of Business Associate

3.1 Safeguards. Business Associate will use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to ePHI, to prevent Use or Disclosure of PHI other than as provided for by this Agreement.

3.2 Minimum necessary. Business Associate will request, Use and Disclose only the minimum PHI necessary to accomplish the purpose, consistent with 45 CFR §164.502(b).

3.3 Mitigation. Business Associate will mitigate, to the extent practicable, any harmful effect known to it of a Use or Disclosure of PHI in violation of this Agreement.

3.4 Subprocessors. In accordance with 45 CFR §164.502(e)(1)(ii) and §164.308(b)(2), Business Associate will ensure that every Subprocessor agrees in writing to restrictions and conditions at least as restrictive as those applying to Business Associate under this Agreement. Business Associate remains responsible for its Subprocessors' acts and omissions with respect to PHI.

A mail relay, clearinghouse connection or payer portal that Covered Entity configures under its own credentials is Covered Entity's subprocessor, not Business Associate's, and Covered Entity is responsible for the agreements governing it.

3.5 Reporting. Business Associate will report to Covered Entity any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, any Security Incident of which it becomes aware, and any Breach of Unsecured PHI in accordance with §4.

Unsuccessful Security Incidents that do not result in unauthorized access — such as routine port scans, blocked login attempts and denied network traffic — are reported in aggregate on request rather than individually.

3.6 Individual access. Business Associate will make PHI in a Designated Record Set available to Covered Entity as necessary for Covered Entity to meet 45 CFR §164.524, within ten (10) business days of written request.

3.7 Amendment. Business Associate will make PHI in a Designated Record Set available for amendment and incorporate any amendment as directed by Covered Entity under 45 CFR §164.526, within ten (10) business days of written request.

3.8 Accounting of disclosures. Business Associate will document and make available the information required for Covered Entity to respond to a request for an accounting of disclosures under 45 CFR §164.528.

3.9 Covered Entity's obligations. To the extent Business Associate carries out an obligation of Covered Entity under Subpart E of 45 CFR Part 164, it will comply with the requirements that apply to Covered Entity in performing that obligation.

3.10 Books and records. Business Associate will make its internal practices, books and records relating to the Use and Disclosure of PHI available to the Secretary for purposes of determining Covered Entity's compliance with the HIPAA Rules.

4. Breach and incident notification

4.1 Business Associate will notify Covered Entity of a Breach of Unsecured PHI without unreasonable delay and no later than thirty (30) calendar days after Discovery, as that term is defined at 45 CFR §164.410(a)(2).

4.2 The notification will include, to the extent known at the time and supplemented as further information becomes available: the identification of each Individual whose PHI was or is reasonably believed to have been involved; a description of what happened and the date of the Breach and of its Discovery; the types of PHI involved; the steps taken to investigate, mitigate and protect against further Breach; and a contact for further information.

4.3 Business Associate will cooperate with Covered Entity's investigation and with any notification Covered Entity is required to make. Covered Entity is responsible for notifying Individuals, the Secretary and the media where required by 45 CFR §§164.404–164.408, unless the Parties agree otherwise in writing.

5. Obligations of Covered Entity

5.1 Covered Entity will notify Business Associate of any limitation in its notice of privacy practices, any change in or revocation of an Individual's permission, and any restriction agreed under 45 CFR §164.522, to the extent any of these affects Business Associate's Use or Disclosure of PHI.

5.2 Covered Entity will not request Business Associate to Use or Disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Covered Entity.

5.3 Covered Entity is responsible for obtaining any consent, authorization or permission required for Business Associate to perform the Services.

5.4 Free-text fields. The Services include note, comment and message fields that Covered Entity's workforce completes in its own words. Business Associate cannot control what is typed into them. Covered Entity is responsible for ensuring its workforce enters only the minimum necessary PHI into such fields.

5.5 42 CFR Part 2. If any record Covered Entity submits is a record of a federally assisted substance use disorder treatment program subject to 42 CFR Part 2, Covered Entity will notify Business Associate in writing before submitting it. Part 2 imposes obligations beyond the HIPAA Rules and is not addressed by this Agreement.

6. Term and termination

6.1 Term. This Agreement takes effect on the Effective Date and continues until terminated under this §6, or until all PHI is returned or destroyed under §6.4, whichever is later.

6.2 Termination for cause. Covered Entity may terminate this Agreement and the Underlying Agreement if Business Associate materially breaches this Agreement and fails to cure within thirty (30) calendar days of written notice.

6.3 Effect of termination of the Underlying Agreement. Termination of the Underlying Agreement terminates this Agreement, subject to §6.4 and §6.5.

6.4 Return or destruction. On termination for any reason, Business Associate will, at Covered Entity's written election, either return all PHI in a commercially reasonable machine-readable format or destroy it in a manner rendering it unreadable, indecipherable and unable to be reconstructed. Business Associate will complete the election within sixty (60) calendar days of termination, will extend the same requirement to its Subprocessors, and will certify destruction in writing on request. If Covered Entity makes no election within thirty (30) calendar days, Business Associate will destroy the PHI and certify accordingly.

6.5 Backups. PHI contained in routine, encrypted point-in-time database history is not individually retrievable — the history is a record of the whole database, and one organization's rows cannot be removed from it without discarding every other customer's recovery capability. Such PHI is therefore not deleted on the timetable in §6.4.

It remains subject to every protection of this Agreement, is used for no purpose other than disaster recovery, and expires automatically on the ordinary rolling of that history window, which does not exceed seven (7) days from the date the corresponding PHI is deleted under §6.4.

6.6 Survival. §3.10, §4, §6.4, §6.5, §7 and §8 survive termination.

7. Liability

7.1 Each Party is responsible for its own acts and omissions, and those of its workforce and subcontractors, with respect to PHI.

7.2 Except for a Party's gross negligence or willful misconduct, each Party's aggregate liability arising out of or relating to this Agreement is subject to the limitation of liability in the Underlying Agreement.

7.3 Nothing in this Agreement limits either Party's direct liability to the Secretary under the HIPAA Rules.

8. Miscellaneous

8.1 Conflict. Where this Agreement conflicts with the Underlying Agreement in respect of PHI, this Agreement controls.

8.2 Regulatory change. The Parties will negotiate in good faith to amend this Agreement as necessary to comply with any change to the HIPAA Rules.

8.3 Interpretation. Any ambiguity is resolved in favor of a meaning that permits compliance with the HIPAA Rules.

8.4 No third-party beneficiaries. Nothing in this Agreement confers rights on any person other than the Parties.

8.5 Amendment. Any amendment must be in writing and signed by both Parties.

8.6 Governing law. This Agreement is governed by the laws of the State of New York, without regard to its conflict-of-laws rules, except to the extent pre-empted by federal law.

9. Notices

Notices under this Agreement are given in writing to the addresses below, and are effective on receipt.

Electronic acceptance

This Agreement is accepted electronically. Covered Entity's authorized administrator accepts it by reviewing it in the Helfzen application and confirming acceptance on Covered Entity's behalf. The individual accepting represents that they are authorized to bind Covered Entity. Helfzen records the accepting administrator's name and email address, the organization, the date and time of acceptance, the network address the acceptance came from, the version of this Agreement and a cryptographic hash of its text, and makes that record and a copy of this Agreement available to Covered Entity's administrators within the application. Business Associate accepts this Agreement by making it available for acceptance. The Parties agree that this electronic acceptance satisfies any requirement that this Agreement be in writing and signed, and that Business Associate's signatory is Ephraim Hirschfeld, Founder, Helfzen Enterprises LLC.