HIPAA Business Associate Agreement

This Business Associate Agreement ("BAA") is entered into and effective as of the date of the last signature below ("Effective Date") by and between [COVERED ENTITY LEGAL NAME] ("Covered Entity") and SANCTA, LLC "Business Associate") (each a "Party" and collectively, the "Parties").

RECITALS

WHEREAS, Covered Entity is a “Covered Entity” as that term is defined under the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”), and the regulations promulgated thereunder by the Secretary of the U.S. Department of Health and Human Services (“Secretary”), including, without limitation, the regulations codified at 45 C.F.R. Parts 160 and 164 (“HIPAA Regulations”);

WHEREAS, Business Associate performs software, technology, customer relationship management, communications, automation, website, funnel, marketing, support, implementation, and related services for or on behalf of Covered Entity (“Services”), and in performing such Services Business Associate may create, receive, maintain, or transmit Protected Health Information (“PHI”) or Electronic Protected Health Information (“ePHI”);

WHEREAS, Business Associate may use subcontractors and technology infrastructure providers in connection with the Services, including HighLevel Inc. and other applicable vendors, and Business Associate will require any Subcontractor that creates, receives, maintains, or transmits PHI on its behalf to comply with applicable HIPAA requirements through written agreements as required by law;

WHEREAS, the Parties intend to protect the privacy and provide for the security of PHI and ePHI disclosed by Covered Entity to Business Associate, or received or created by Business Associate, when providing Services in compliance with HIPAA, the HIPAA Regulations, the Health Information Technology for Economic and Clinical Health Act (“HITECH Act”), and other applicable state and federal laws, as amended from time to time; and

WHEREAS, Covered Entity is required under HIPAA to enter into a Business Associate Agreement with Business Associate that meets applicable requirements with respect to the Use and Disclosure of PHI.

AGREEMENT

In consideration of the above Recitals and for other good and valuable consideration, the receipt and adequacy of which are hereby acknowledged, the Parties agree as follows:

ARTICLE I

DEFINITIONS

1.1. Breach. “Breach” shall have the meaning given under 42 U.S.C. § 17921(1) and 45 C.F.R. § 164.402.

1.2. Data Aggregation. “Data Aggregation” shall have the meaning given under 45 C.F.R. § 164.501.

1.3. Designated Record Set. “Designated Record Set” shall have the meaning given under 45 C.F.R. § 164.501.

1.4. Disclose and Disclosure. “Disclose” and “Disclosure” mean, with respect to PHI, the release, transfer, provision of access to, or divulging in any other manner of PHI outside Business Associate or to persons other than members of its Workforce, as set forth in 45 C.F.R. § 160.103.

1.5. Electronic PHI. “Electronic PHI” or “ePHI” means PHI transmitted or maintained in electronic media, as set forth in 45 C.F.R. § 160.103.

1.6. Protected Health Information. “Protected Health Information” or “PHI” shall have the meaning given under 45 C.F.R. § 160.103 and includes ePHI.

1.7. Security Incident. “Security Incident” shall have the meaning given under 45 C.F.R. § 164.304.

1.8. Services. “Services” means the services or functions performed by Business Associate on behalf of Covered Entity pursuant to any applicable master subscription agreement, terms of service, order, membership agreement, service agreement, or other agreement between the Parties (collectively, the “Underlying Agreement”), including, as applicable, software, CRM, communications, automation, websites, funnels, marketing technology, implementation, support, and related services.

1.9. Subcontractor. “Subcontractor” means a person or entity to whom Business Associate delegates a function, activity, or service, other than in the capacity of a member of Business Associate’s Workforce.

1.10. Unsecured PHI. “Unsecured PHI” shall have the meaning given under 42 U.S.C. § 17932(h), 45 C.F.R. § 164.402, and applicable guidance issued pursuant to the HITECH Act.

1.11. Use or Uses. “Use” or “Uses” mean, with respect to PHI, the sharing, employment, application, utilization, examination, or analysis of PHI within Business Associate’s internal operations, as set forth in 45 C.F.R. § 160.103.

1.12. Workforce. “Workforce” shall have the meaning given under 45 C.F.R. § 160.103.

ARTICLE II

OBLIGATIONS OF BUSINESS ASSOCIATE

2.1. Permitted Uses and Disclosures of Protected Health Information. Business Associate shall not Use or Disclose PHI other than for the purposes of performing the Services, as permitted or required by this BAA, or as Required by Law. Business Associate shall not Use or Disclose PHI in a manner that would constitute a violation of Subpart E of 45 C.F.R. Part 164 if so Used or Disclosed by Covered Entity. Business Associate may Use or Disclose PHI for its proper management and administration or to carry out its legal responsibilities, provided that, with respect to such Disclosure, either the Disclosure is Required by Law or Business Associate obtains reasonable written assurances from the recipient that the PHI will be held confidentially and Used or further Disclosed only as Required by Law or for the purpose for which it was disclosed, and that the recipient will notify Business Associate of breaches of confidentiality of which it becomes aware. Business Associate may also Use PHI for Data Aggregation for the health care operations of Covered Entity as permitted by 45 C.F.R. § 164.501. To the extent Business Associate carries out one or more of Covered Entity’s obligations under Subpart E of 45 C.F.R. Part 164, Business Associate shall comply with the requirements of Subpart E that apply to Covered Entity in performing those obligations.

2.2. Prohibited Marketing and Sale of PHI. Business Associate shall not Use or Disclose PHI for fundraising or marketing purposes except to the extent expressly authorized or permitted by this BAA and applicable law, including 42 U.S.C. § 17936 and 45 C.F.R. §§ 164.514(f) and 164.508(a)(3). Business Associate shall not directly or indirectly receive remuneration in exchange for PHI except with the prior written consent of Covered Entity and as permitted by applicable law. The availability of marketing, advertising, email, SMS, website, funnel, social media, automation, or similar technology through the Services does not constitute a representation that every communication or campaign created by Covered Entity is permissible under HIPAA. Covered Entity remains responsible for determining whether its particular marketing Uses or Disclosures of PHI require an authorization or other legal permission.

2.3. Adequate Safeguards of PHI. Business Associate shall implement and maintain appropriate administrative, physical, and technical safeguards to prevent Use or Disclosure of PHI other than as provided by this BAA. Business Associate shall reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI that it creates, receives, maintains, or transmits on behalf of Covered Entity in compliance with Subpart C of 45 C.F.R. Part 164.

2.4. Mitigation. Business Associate agrees to mitigate, to the extent practicable, any harmful effect known to Business Associate resulting from a Use or Disclosure of PHI by Business Associate in violation of this BAA.

2.5. Reporting Non-Permitted Use or Disclosure. 2.5.1 Reporting Security Incidents and Non-Permitted Use or Disclosure. Business Associate shall report to Covered Entity in writing each Security Incident or Use or Disclosure made by Business Associate, members of its Workforce, or Subcontractors that is not specifically permitted by this BAA, no later than three (3) business days after becoming aware of such Security Incident or non-permitted Use or Disclosure. Business Associate shall investigate each such event involving Covered Entity’s PHI to determine whether it constitutes a reportable Breach of Unsecured PHI and shall document and retain records of its investigation. Upon reasonable request, Business Associate shall furnish Covered Entity documentation reasonably necessary to understand the investigation and assessment.

2.5.2 Breach of Unsecured PHI. If Business Associate determines that a reportable Breach of Unsecured PHI has occurred, Business Associate shall provide a written report to Covered Entity without unreasonable delay, but no later than thirty (30) calendar days after discovery of the Breach. To the extent information is available to Business Associate, the report shall contain the information required by 45 C.F.R. § 164.410(c). Business Associate shall cooperate with Covered Entity in meeting Covered Entity’s obligations under HIPAA and the HITECH Act. Covered Entity shall have control over the timing and method of notification to affected individuals, the Secretary, and, if applicable, the media, except to the extent applicable law requires otherwise.

Business Associate shall reimburse Covered Entity for reasonable costs and expenses of legally required Breach notification to the extent such costs arise from a Breach caused by Business Associate’s violation of this BAA, negligence, or wrongful acts or omissions. This provision is subject to any limitation of liability or indemnification terms in the Underlying Agreement to the extent enforceable and not inconsistent with HIPAA

2.6. Availability of Internal Practices, Books, and Records to Government. Business Associate shall make its internal practices, books, and records relating to the Use and Disclosure of PHI received from, created, or received on behalf of Covered Entity available to the Secretary for purposes of determining Covered Entity’s compliance with HIPAA, the HIPAA Regulations, and the HITECH Act. Except to the extent prohibited by law, Business Associate shall notify Covered Entity of requests served upon Business Associate for such information or documentation by or on behalf of the Secretary.

2.7. Access to and Amendment of Protected Health Information. To the extent Business Associate maintains a Designated Record Set on behalf of Covered Entity, and within fifteen (15) days of a request by Covered Entity, Business Associate shall make the PHI it maintains, or which is maintained by its Subcontractors, available to Covered Entity for inspection and copying, or to an individual as directed by Covered Entity, to enable Covered Entity to fulfill its obligations under 45 C.F.R. § 164.524. Business Associate shall amend PHI it maintains in a Designated Record Set as reasonably directed by Covered Entity to enable Covered Entity to fulfill its obligations under 45 C.F.R. § 164.526. If PHI is maintained electronically in a Designated Record Set, Business Associate shall provide it in the electronic form and format requested by Covered Entity if readily reproducible in that form and format, or otherwise in a mutually agreed form and format. Business Associate shall notify Covered Entity within fifteen (15) days of receipt of a request from an individual for access to PHI.

2.8. Accounting. To the extent Business Associate maintains information required for an accounting of Disclosures, Business Associate and its Subcontractors shall make such information available to Covered Entity within thirty (30) days of receipt of Covered Entity’s request to enable Covered Entity to fulfill its obligations under 45 C.F.R. § 164.528 and applicable provisions of the HITECH Act. Business Associate shall notify Covered Entity within fifteen (15) days of receipt of a request from an individual or other requesting party for an accounting of Disclosures of PHI.

2.9. Use of Subcontractors. Business Associate may use Subcontractors in providing the Services. Business Associate shall require each Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate to enter into a written Business Associate Agreement or other agreement that imposes the same restrictions, conditions, and requirements that apply to Business Associate under this BAA with respect to PHI, as required by 45 C.F.R. §§ 164.308(b) and 164.502(e). Business Associate may use HighLevel Inc. and other applicable technology or service providers as Subcontractors where such providers are appropriately contracted to handle PHI.

2.10. Minimum Necessary. Business Associate and its Subcontractors shall, to the extent required by HIPAA, limit requests for, Uses of, and Disclosures of PHI to the minimum amount of PHI necessary to accomplish the intended purpose, in accordance with 42 U.S.C. § 17935(b), 45 C.F.R. § 164.502(b), and applicable guidance.

2.11. Workforce Access and Confidentiality. Business Associate shall limit Workforce access to PHI to persons who require such access to perform authorized duties. Business Associate shall maintain reasonable procedures governing access credentials, passwords, authentication, user permissions, confidentiality, and termination or modification of access when no longer required. Business Associate shall require Workforce members with access to PHI to comply with applicable privacy, security, and confidentiality obligations.

ARTICLE III

OBLIGATIONS OF COVERED ENTITY

3.1. Lawful Use of Services. Covered Entity shall Use the Services in compliance with HIPAA and other applicable federal and state privacy and security laws. Covered Entity acknowledges that Business Associate provides technology and related Services but does not control every manner in which Covered Entity configures or Uses those Services.

3.2. Notices, Consents, and Authorizations. Covered Entity is responsible for obtaining and maintaining all notices, consents, authorizations, permissions, and other documentation required by applicable law for Covered Entity’s collection, Use, Disclosure, communication, and processing of PHI through the Services.

3.3. Restrictions and Changes in Permission. Covered Entity shall notify Business Associate of any restriction on the Use or Disclosure of PHI to which Covered Entity has agreed, and any change in or revocation of permission by an individual, to the extent such restriction or change may affect Business Associate’s permitted Uses or Disclosures.

3.4. Impermissible Requests. Covered Entity shall not request Business Associate to Use or Disclose PHI in a manner that would violate HIPAA if performed by Covered Entity, except where HIPAA permits such Use or Disclosure by a Business Associate.

3.5. User Access and Credentials. Covered Entity is responsible for controlling access to its Sancta account by its Workforce and authorized users, maintaining appropriate safeguards for usernames, passwords, authentication credentials, devices, and permissions under its control, and promptly disabling or modifying access when no longer required.

3.6. Communications, Features, and Integrations. Covered Entity is responsible for determining whether its particular Uses of email, SMS, voice, advertising, social media, websites, forms, funnels, automations, artificial intelligence tools, integrations, or other features are appropriate for the PHI involved and permitted by applicable law. Covered Entity shall not transmit PHI through a third-party application, integration, or service that Covered Entity independently connects or enables unless Covered Entity has determined that the transmission is legally permissible and any required Business Associate Agreement or other privacy arrangement is in place.

ARTICLE IV

TERM AND TERMINATION

4.1. Term. This BAA shall be effective as of the Effective Date and shall remain in effect until all PHI provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is returned or destroyed, or, if return or destruction is infeasible, protections are extended to such information in accordance with Section 4.3, or until terminated for cause as provided below.

4.2. Termination for Cause. Upon Covered Entity’s knowledge of a material breach or violation of this BAA by Business Associate, Covered Entity may notify Business Associate of the breach in writing and provide Business Associate an opportunity to cure the breach or end the violation within ten (10) business days. If Business Associate fails to cure the breach or end the violation within such period, Covered Entity may terminate this BAA upon written notice. Covered Entity may immediately terminate this BAA upon written notice if Covered Entity determines that the breach cannot be cured.

4.3. Disposition of Protected Health Information Upon Termination or Expiration. Upon termination or expiration of this BAA, Business Associate shall, if feasible, return or destroy all PHI received from Covered Entity or created, maintained, or received on behalf of Covered Entity that Business Associate still maintains and retain no copies except as required or permitted by law. If Covered Entity requests return of PHI, the Parties shall use a mutually agreed format and timeframe. If return or destruction is infeasible, Business Associate shall retain only PHI necessary for its proper management and administration or legal responsibilities, continue to extend the protections of this BAA to retained PHI, limit further Uses and Disclosures to the purposes making return or destruction infeasible, and return or destroy retained PHI when no longer necessary.

4.4. Account Closure and Data Retention. Covered Entity is responsible for exporting or preserving information it is legally required to retain before account closure, except to the extent otherwise expressly agreed in writing. Business Associate’s retention and deletion of information following termination shall be governed by applicable law, the Underlying Agreement, Business Associate’s then-current retention procedures, and the technical or contractual requirements of applicable Subcontractors.

ARTICLE V

MISCELLANEOUS

5.1. Amendment to Comply with Law. This BAA shall be deemed amended to incorporate mandatory obligations of Covered Entity or Business Associate under HIPAA, the HITECH Act, and implementing regulations. The Parties agree to take such action as is reasonably necessary to amend this BAA from time to time to maintain compliance with applicable law.

5.2. Indemnification. Covered Entity shall defend, indemnify, and hold harmless Business Associate its parent companies, affiliates, subsidiaries, officers, directors, employees, agents, successors, and assigns (collectively, "Business Associates Indemnitees") from and against any and all claims, actions, suits, proceedings, losses, damages, liabilities, judgments, costs, and expenses (including reasonable attorneys' fees and costs of litigation) (collectively, "Losses") arising out of or relating to any of the following:

Any unauthorized access, use, disclosure, or breach of Protected Health Information caused by or attributable to Covered Entity's acts or omissions, including without limitation failure to implement required administrative, physical, or technical safeguards, failure to train workforce members, failure to obtain required patient authorizations, failure to provide required breach notifications, or any HIPAA violation arising from Covered Entity's configuration of the Platform, Covered Entity's workflows, or Covered Entity’'s selection of non-compliant third-party applications;

5.3. Notices. Any notice required under this BAA shall be provided in writing in accordance with the notice provisions of the Underlying Agreement, unless applicable law requires another method. Notices concerning Security Incidents or Breaches may be provided by electronic mail to the privacy, security, legal, or other designated contact supplied by the receiving Party.

5.4. Relationship of Parties. Business Associate is an independent contractor and not an agent, employee, partner, or joint venturer of Covered Entity under this BAA. Business Associate has the sole right and obligation to supervise, manage, contract, direct, procure, perform, or cause to be performed its obligations under this BAA.

5.5. Survival. The respective rights and obligations of the Parties relating to PHI retained following termination, and any provisions that by their nature are intended to survive, shall survive termination of this BAA.

5.6. Conflict and Order of Precedence. If a provision of this BAA conflicts with a provision of the Underlying Agreement concerning the privacy, security, Use, or Disclosure of PHI, this BAA shall control solely with respect to PHI and the Parties’ HIPAA obligations. Otherwise, the Underlying Agreement remains in full force and effect.

5.7. Governing Law and Venue. This BAA shall be governed by applicable federal law and, to the extent state law applies, the governing law and venue specified in the Underlying Agreement.

5.8. Interpretation. Any ambiguity in this BAA shall be interpreted to permit compliance with HIPAA and the HITECH Act. References to statutes or regulations include amendments and successor provisions as applicable.

5.9. No Third-Party Beneficiaries. Nothing in this BAA is intended to create rights in any person or entity other than the Parties, except as required by applicable law.