CONDITIONAL. Applies only to subscribers who are, or work for, a HIPAA covered entity. Not the default instrument and not required for most subscribers.

Business Associate Agreement

This Business Associate Agreement ("BAA") is a conditional instrument. It applies only to subscribers who are HIPAA covered entities or who act on behalf of a HIPAA covered entity. It is not part of the default signup process and is presented only when a subscriber self-identifies as requiring BAA coverage.

1. Definitions

Terms used in this BAA have the meanings set forth in 45 CFR Parts 160 and 164 (the HIPAA Rules). "Covered Entity" refers to you, the subscriber. "Business Associate" refers to Valor Hart LLC. "Protected Health Information" or "PHI" means individually identifiable health information received by Business Associate from or on behalf of Covered Entity in connection with the Service.

2. Permitted Uses and Disclosures

Business Associate may use and disclose PHI only as necessary to perform the services described in the Terms of Service, as required by law, or as otherwise permitted under this BAA. Business Associate shall not use or disclose PHI in a manner that would violate the HIPAA Rules if done by Covered Entity, except as expressly permitted herein.

3. Safeguards

Business Associate shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of PHI, including electronic PHI, in accordance with 45 CFR Part 164, Subpart C. These safeguards include encryption in transit and at rest, role-based access controls, audit logging, and regular security assessments.

4. Reporting

Business Associate shall report to Covered Entity any use or disclosure of PHI not permitted under this BAA, any security incident, and any breach of unsecured PHI, without unreasonable delay and in no event later than sixty (60) calendar days after discovery.

5. Subcontractors

Business Associate shall require any subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate to agree to the same restrictions and conditions that apply to Business Associate under this BAA, in accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2).

6. Access to PHI

Business Associate shall make PHI maintained in a designated record set available to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 CFR 164.524. Business Associate shall also make PHI available for amendment and provide an accounting of disclosures as required by the HIPAA Rules.

7. Availability of Books and Records

Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance with the HIPAA Rules.

8. Return or Destruction of PHI

Upon termination of this BAA, Business Associate shall, if feasible, return or destroy all PHI received from or created on behalf of Covered Entity. If return or destruction is not feasible, Business Associate shall extend the protections of this BAA to the retained PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible.

9. Termination

Either party may terminate this BAA if the other party materially breaches any provision of this BAA and fails to cure the breach within thirty (30) days of receiving written notice. Covered Entity may also terminate this BAA immediately if Business Associate has breached a material term and cure is not possible. The obligations of Business Associate under Section 8 survive termination.

10. Contact

For BAA-related inquiries: support@valorhartllc.com