Business Associate Agreement

This Business Associate Agreement (“BAA”) is between Run Practice Inc., a Delaware corporation (“RunPractice” or “Business Associate”), 425 Madison Avenue, Floor 14, New York, NY 10017, and the customer that accepts the RunPractice Terms of Service and is a covered entity, or a business associate of a covered entity, under HIPAA (“Covered Entity”). It forms part of the Terms and takes effect on the date the Covered Entity accepts them (the “Effective Date”).

This BAA governs protected health information that Business Associate creates, receives, maintains or transmits on Covered Entity’s behalf through the Services. If it conflicts with the Terms or an Order about protected health information, this BAA controls.

If the customer is itself a business associate of a covered entity, “Covered Entity” refers to the customer in that role, and Business Associate acts as its subcontractor.

A countersigned copy is available on request at [email protected].

Catch-all definition. The following terms used in this BAA have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information (“PHI”), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

HIPAA Rules means the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Part 160 and Part 164.

Services, Terms and Order have the meanings given in the Terms of Service.

Business Associate agrees to:

1. not use or disclose PHI other than as permitted or required by this BAA or as Required By Law;
2. use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this BAA;
3. report incidents and breaches as described in Reporting incidents and breaches;
4. bind its Subcontractors as described in Subcontractors;
5. make available PHI in a Designated Record Set to Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.524;
6. make any amendments to PHI in a Designated Record Set as directed or agreed to by Covered Entity under 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526;
7. maintain and make available the information required to provide an accounting of disclosures to Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.528;
8. to the extent Business Associate carries out one or more of Covered Entity’s obligations under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to Covered Entity in the performance of those obligations; and
9. make its internal practices, books and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

Much of the PHI in a Designated Record Set is available to Covered Entity directly in the Services. For anything that isn’t, Business Associate will provide it promptly and in time for Covered Entity to meet its deadlines. If an Individual asks Business Associate directly for access, amendment or an accounting, Business Associate will promptly forward the request to Covered Entity.

Business Associate will report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which it becomes aware, including Breaches of Unsecured Protected Health Information as required at 45 CFR 164.410, and any Security Incident of which it becomes aware.

• Timing. Business Associate will notify Covered Entity of a Breach of Unsecured Protected Health Information without unreasonable delay and in no case later than 60 calendar days after discovery.
• Content. The notice will identify, to the extent possible, each Individual whose Unsecured Protected Health Information has been, or is reasonably believed to have been, accessed, acquired, used or disclosed. It will include any other available information Covered Entity needs for its own notifications, supplemented as more information becomes available.
• Mitigation. Business Associate will mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure of PHI in violation of this BAA.
• Unsuccessful attempts. This section is notice of the ongoing existence of unsuccessful Security Incidents, such as pings, port scans, blocked sign-in attempts and denial-of-service attempts that don’t result in unauthorized access, use or disclosure of PHI. No further notice of them is required.

Notices go to the email address on Covered Entity’s account.

In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate will ensure that any Subcontractors that create, receive, maintain or transmit PHI on its behalf agree in writing to the same restrictions, conditions and requirements that apply to Business Associate with respect to that information.

1. Business Associate may use or disclose PHI only as necessary to perform the Services under the Terms and any Order, including the AI Features and connected services that Covered Entity enables.
2. Business Associate may use or disclose PHI as Required By Law.
3. Business Associate will make uses, disclosures and requests for PHI consistent with Covered Entity’s minimum necessary policies and procedures.
4. Business Associate may not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, except for the specific uses and disclosures in (e) through (g).
5. Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities.
6. Business Associate may disclose PHI for its proper management and administration or to carry out its legal responsibilities, provided the disclosures are Required By Law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and be used or further disclosed only as Required By Law or for the purposes for which it was disclosed, and that the person will notify Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.
7. Business Associate may provide Data Aggregation services relating to the Health Care Operations of Covered Entity.

Business Associate will not sell PHI, use it for marketing, or use it to train AI models used for anyone other than Covered Entity. It will not de-identify PHI for its own purposes without Covered Entity’s written agreement.

1. Covered Entity will notify Business Associate of any limitations in its Notice of Privacy Practices under 45 CFR 164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI.
2. Covered Entity will notify Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes may affect Business Associate’s use or disclosure of PHI.
3. Covered Entity will notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI.
4. Covered Entity will not ask Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Covered Entity.
5. Covered Entity is responsible for obtaining any consents and authorizations its uses of the Services require, and for configuring the Services consistently with its own policies.

1. Term. This BAA is effective as of the Effective Date and ends when the Terms end, or on the date Covered Entity terminates it for cause under (b), whichever is sooner.
2. Termination for cause. Business Associate authorizes termination of this BAA and the Terms by Covered Entity if Covered Entity determines that Business Associate has violated a material term of this BAA and Business Associate has not cured the breach or ended the violation within 30 days after written notice.
3. Survival. Business Associate’s obligations under Return or destruction of PHI survive the termination of this BAA.

Covered Entity may export its data during the export period the Terms describe. Upon termination of this BAA for any reason, Business Associate, with respect to PHI received from Covered Entity, or created, maintained or received by Business Associate on behalf of Covered Entity, will:

1. retain only the PHI that is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities;
2. destroy the remaining PHI that Business Associate still maintains in any form, or return it to Covered Entity if Covered Entity asks;
3. continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent use or disclosure of the PHI other than as provided for in this section, for as long as Business Associate retains it;
4. not use or disclose the PHI it retains other than for the purposes for which it was retained and subject to the same conditions that applied before termination under (e) and (f) of Permitted uses and disclosures; and
5. destroy the retained PHI when Business Associate no longer needs it for its proper management and administration or to carry out its legal responsibilities.

Business Associate will do this after the export period in the Terms ends.

PHI in backups is destroyed in the normal backup cycle and remains protected under this BAA until then.

1. Regulatory references. A reference in this BAA to a section in the HIPAA Rules means the section as in effect or as amended.
2. Amendment. The parties agree to take such action as is necessary to amend this BAA from time to time as is necessary for compliance with the requirements of the HIPAA Rules and any other applicable law. Business Associate may update this BAA to reflect changes in law, with notice to Covered Entity.
3. Interpretation. Any ambiguity in this BAA shall be interpreted to permit compliance with the HIPAA Rules.
4. No third-party beneficiaries. Nothing in this BAA gives any right or remedy to anyone other than the parties.
5. Relationship to the Terms. Except as this BAA provides, the Terms apply, including their provisions on limitation of liability and governing law.