Business Associate Agreement

Terms used but not defined in this BAA, such as breach, covered entity, designated record set, disclosure, electronic protected health information, minimum necessary, protected health information ("PHI"), required by law, Secretary, security incident, subcontractor, unsecured PHI and use, have the meanings given in the HIPAA Rules. "HIPAA Rules" means the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Parts 160 and 164. PHI in this BAA means only PHI we create, receive, maintain or transmit for you.

We may use and disclose PHI only:

• to provide TranqBay for private practice to you under the Terms of Service, including the services described in the Data Processing Agreement;
• as required by law;
• for our proper management and administration, or to carry out our legal responsibilities, as allowed by section 3.

We will not use or disclose PHI in any way that would break Subpart E of 45 CFR Part 164 if you did it, except as section 3 allows. We will make reasonable efforts to limit uses, disclosures and requests to the minimum necessary.

We will not sell PHI, use it for marketing, or use it to train AI models. We will not provide data aggregation services or de-identify PHI unless you agree in writing.

We may use PHI for our proper management and administration and to carry out our legal responsibilities. We may disclose PHI for those purposes only if:

• the disclosure is required by law; or
• we get reasonable assurances from the person we disclose it to that they will keep it confidential, use or disclose it further only as required by law or for the purpose for which we disclosed it, and tell us of any instance they know of in which its confidentiality has been breached.

We will use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 for electronic PHI, to prevent use or disclosure of PHI other than as this BAA allows. The safeguards we use today are summarised in Annex 2 of the Data Processing Agreement; they include encryption of data in transit and at rest and end-to-end encryption of video sessions.

We will report to you:

• any use or disclosure of PHI not provided for by this BAA that we become aware of;
• any breach of unsecured PHI, as required by 45 CFR 164.410;
• any security incident we become aware of.

We will report a breach of unsecured PHI without unreasonable delay, and in any case no later than 10 business days after discovery, which is well inside the 60 calendar days HIPAA allows. A breach is treated as discovered on the first day it is known to us, or would have been known with reasonable diligence. Our report will include, to the extent we have it, the identity of each person whose unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used or disclosed, and the other information you need to notify them under 45 CFR 164.404(c). We will provide further information as it becomes available.

We will report other uses or disclosures not provided for by this BAA, and successful security incidents, within 10 business days after we become aware of them.

Unsuccessful security incidents. This section is our notice to you that unsuccessful attempts to get into our systems happen regularly, such as pings, port scans, blocked sign-in attempts and denial-of-service attempts that do not succeed. We will not report each of these, as long as none of them results in unauthorised access to, or use or disclosure of, PHI.

We will take reasonable steps to reduce any harmful effect that we know of from a use or disclosure of PHI by us that breaks this BAA.

In line with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), we will make sure that any subcontractor that creates, receives, maintains or transmits PHI for us agrees in writing to the same restrictions, conditions and requirements that apply to us under this BAA, including the Security Rule safeguards. If we learn of a pattern of activity or practice by a subcontractor that is a material breach of its agreement, we will take reasonable steps to cure it or, if that fails, end the subcontract where feasible. The companies we use that may handle your clients' information are listed on our Sub-processor list.

To the extent we hold PHI in a designated record set:

• Access: we will make it available to you, or as you direct to the individual, within 10 business days of your request, so you can meet 45 CFR 164.524. Much of it you can access and download in your account yourself;
• Amendment: we will make any amendment you direct under 45 CFR 164.526, or help you to make it in your account, within 10 business days of your request;
• Accounting of disclosures: we will record the information about our disclosures of PHI that you need, and provide it to you within 10 business days of your request, so you can meet 45 CFR 164.528.

If an individual asks us directly for any of these, we will pass the request to you within 5 business days.

To the extent we carry out any of your obligations under Subpart E of 45 CFR Part 164, we will comply with the requirements of Subpart E that apply to you in carrying them out.

We will make our internal practices, books and records relating to the use and disclosure of PHI available to the Secretary of the US Department of Health and Human Services, for the purpose of determining compliance with the HIPAA Rules.

You will:

• tell us about any limitation in your notice of privacy practices, any restriction you agree to under 45 CFR 164.522, and any change to or revocation of an individual's permission, to the extent it affects our use or disclosure of PHI;
• not ask us to use or disclose PHI in any way that would not be allowed under Subpart E of 45 CFR Part 164 if you did it;
• use the settings in your account, such as turning AI session notes on or off, in line with your clients' permissions and your notice of privacy practices.

This BAA starts when you accept the Terms of Service as a covered entity and lasts until the Terms of Service end and all PHI has been returned or destroyed under section 12.

If you find that we have broken a material term of this BAA, you may give us written notice and 30 days to cure it. If we do not cure it within that time, you may end this BAA and the Terms of Service. If we find that you have broken a material term, the same applies the other way.

When this BAA ends, we will, at your request, return to you or destroy all PHI that we, or our subcontractors, still hold in any form, and keep no copies, within 90 days of your request. You can ask us for a copy before your account closes or within 30 days after (Terms of Service, section 15). Until PHI is returned or destroyed, the protections of this BAA continue to apply to it.

If returning or destroying PHI is not feasible, for example because it is in backups that have not yet expired, we will tell you why, extend the protections of this BAA to it, and limit further uses and disclosures to the purposes that make its return or destruction not feasible, for as long as we hold it.

• Changes in law: we will update this BAA as needed to keep it in line with changes to the HIPAA Rules, and tell you before an update takes effect.
• Interpretation: any unclear wording in this BAA is read in the way that lets both of us comply with the HIPAA Rules. A reference to a section of the HIPAA Rules means that section as in effect or as amended.
• Conflicts: if this BAA conflicts with the Terms of Service or the Data Processing Agreement about PHI, this BAA applies.
• Survival: section 12 and our obligations to protect any PHI we still hold survive the end of this BAA.
• No third-party beneficiaries: nothing in this BAA gives rights to anyone other than you, us and our permitted successors.
• Contact: send notices under this BAA to [email protected].