Business Associate Agreement

PART B — HIPAA BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement ("BAA") supplements the Platform Services Agreement and governs Platform's handling of Protected Health Information. Where Merchant (or its Providers) is a Covered Entity or a Business Associate under HIPAA, Platform acts as Merchant's Business Associate (and, as applicable, subcontractor Business Associate). Capitalized terms not defined here have the meanings in 45 C.F.R. Parts 160 and 164 (the "HIPAA Rules") and the HITECH Act.

1. DEFINITIONS

"PHI" means Protected Health Information, limited to information Platform creates, receives, maintains, or transmits for or on behalf of Merchant. "ePHI" means PHI in electronic form. "Breach," "Covered Entity," "Business Associate," "Required by Law," "Security Incident," "Subcontractor," and "Unsecured PHI" have the meanings in the HIPAA Rules. "Covered Entity" here refers to Merchant and/or its Providers, as applicable.

2. PERMITTED USES AND DISCLOSURES

2.1 Platform may use and disclose PHI only: (a) to perform the Services and as permitted by the Agreement; (b) as Required by Law; (c) for Platform's proper management and administration or to carry out its legal responsibilities, provided disclosures are Required by Law or made under written assurances of confidentiality and breach notification from the recipient; and (d) to provide Data Aggregation services relating to Merchant's health-care operations as permitted by 45 C.F.R. 164.504(e)(2)(i)(B).

2.2 Platform may de-identify PHI in accordance with 45 C. F.R. 164.514(a)-(c) and use de-identified data.

2.3 Platform will not use or disclose PHI in a manner that would violate the HIPAA Rules if done by the Covered Entity, except as permitted in Section 2.1(c).

2.4 Minimum necessary. Platform will limit PHI uses, disclosures, and requests to the minimum necessary consistent with 45 C.F.R. 164.502(b).

3. SAFEGUARDS

3.1 Platform will use appropriate administrative, physical, and technical safeguards, and comply with the Security Rule (45 C.F.R. Part 164, Subpart C) with respect to ePHI, to prevent use or disclosure of PHI other than as permitted, including encryption of ePHI at rest and in transit, access controls, and audit logging.

4. REPORTING; BREACH NOTIFICATION

4.1 Platform will report to Merchant: (a) any use or disclosure of PHI not permitted by this BAA of which it becomes aware; (b) any Security Incident; and (c) any Breach of Unsecured PHI, in accordance with 45 C.F.R. 164.410, without unreasonable delay and no later than thirty (30) calendar days after discovery. Unsuccessful, routine Security Incidents (e.g., pings, port scans, and similar events that do not result in unauthorized access) are deemed reported by this sentence and need not be individually notified.

4.2 The Breach report will include, to the extent known, the individuals affected and the information required for Merchant to meet its notification obligations. Platform will cooperate in Merchant's breach analysis and mitigation.

5. SUBCONTRACTORS

5.1 Platform will ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on Platform's behalf agrees in writing to restrictions and conditions at least as protective as those in this BAA, consistent with 45 C.F.R. 164.502(e)(1)(ii) and 164.308(b)(2). This includes cloud hosting and any provider-network or pharmacy-integration subcontractors that handle PHI on Platform's behalf.

6. INDIVIDUAL RIGHTS

6.1 Access (164. 524). Platform will make PHI in a Designated Record Set available to Merchant (or, as directed, the individual) to enable Merchant to meet access requests.

6.2 Amendment (164. 526). Platform will make PHI available for amendment and incorporate amendments as directed by Merchant.

6.3 Accounting (164. 528). Platform will document and make available the information required for Merchant to provide an accounting of disclosures.

6.4 Restrictions/confidential communications. Platform will comply with restrictions and confidential-communication requests to which Merchant has agreed and communicated to Platform, to the extent applicable to Platform's Services.

6.5 HHS access. Platform will make its internal practices, books, and records relating to PHI available to the Secretary of HHS for determining Merchant's compliance.

6.6 Mitigation. Platform will mitigate, to the extent practicable, harmful effects known to it of a use or disclosure in violation of this BAA.

7. RETURN OR DESTRUCTION ON TERMINATION

7.1 On termination, Platform will, if feasible, return or destroy all PHI it maintains and retain no copies. If return or destruction is infeasible, Platform will extend the protections of this BAA to the retained PHI and limit further uses/disclosures to the purposes that make return/destruction infeasible, for so long as it retains the PHI (45 C.F.R. 164.504(e)(2)(ii)(J)).

8. OBLIGATIONS OF COVERED ENTITY (MERCHANT)

8.1 Merchant will: obtain any consents/authorizations and provide any notices required for the lawful collection and processing of PHI through the Platform; not request Platform to use or disclose PHI in a manner impermissible under the HIPAA Rules; and notify Platform of any limitation in its Notice of Privacy Practices, restriction, or revocation of authorization to the extent it affects Platform's use or disclosure of PHI.

9. TERM AND TERMINATION

9.1 This BAA is effective concurrently with the Agreement and terminates when all PHI is returned or destroyed (or protections extended per Section 7). Merchant may terminate the Agreement if Platform materially breaches this BAA and fails to cure within thirty (30) days, consistent with 45 C.F.R. 164.504(e)(2)(iii).

10. MISCELLANEOUS

10.1 Interpretation. Ambiguities are resolved to permit compliance with the HIPAA Rules. This BAA controls over any conflicting term in the Agreement as to PHI.

10.2 Amendment to comply. The Parties will amend this BAA as necessary to comply with changes to the HIPAA Rules.

10.3 No third-party beneficiaries. Except as the HIPAA Rules require, there are no third-party beneficiaries.