Business Associate Agreement

This Business Associate Agreement ("Agreement") is between the clinic ("Covered Entity") and Emba Digital Pty Ltd (ACN 683 319 486; ABN 89 683 319 486) of 14 Christmas Street, Northcote VIC 3070, Australia, which operates Daobook ("Business Associate"). It takes effect when a person authorised to bind Covered Entity (the owner of Covered Entity's Daobook account) accepts it in Daobook ("Effective Date"). The parties agree that electronic acceptance in Daobook is a signed writing, and Business Associate keeps a record of who accepted, when, and which version.

1. Definitions

1.1 Catch-all. These terms have the meanings given in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

1.2 Specific definitions.

• (a) "Business Associate" has the meaning at 45 CFR 160.103 and, here, means Emba Digital Pty Ltd, operating Daobook.
• (b) "Covered Entity" has the meaning at 45 CFR 160.103 and, here, means the clinic named above.
• (c) "HIPAA Rules" means the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Parts 160 and 164.
• (d) "Services" means the Daobook practice-management service and its features as Covered Entity uses them under the Daobook Terms of Service ("Terms").
• (e) "PHI" means Protected Health Information that Business Associate creates, receives, maintains or transmits for Covered Entity in providing the Services. It includes electronic PHI.

2. Obligations and activities of Business Associate

Business Associate agrees to:

2.1 Use and disclosure. Not use or disclose PHI other than as this Agreement permits or requires, or as Required by Law.

2.2 Safeguards. Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 for electronic PHI, to prevent use or disclosure of PHI other than as this Agreement provides. Without limiting that:

• (a) Encrypt electronic PHI at rest and in transit, consistent with NIST SP 800-111 and SP 800-52, with keys managed apart from the data.
• (b) Require multi-factor authentication for every user of the Services and for Business Associate's own administrative access.
• (c) Record access to, and changes of, PHI in the Services, and make the access record for Covered Entity's patients available to Covered Entity in the Services.
• (d) Store PHI, including backups, only in the United States, through Business Associate and the Subcontractors under §2.5. Business Associate's personnel may view PHI from outside the United States only as §2.11 provides. Correspondence that Covered Entity sends to Business Associate's support and privacy mailboxes is held by Business Associate's email Subcontractor in Australia under a Subcontractor agreement.

2.3 Reporting. Report to Covered Entity:

• (a) Breaches of Unsecured PHI, as 45 CFR 164.410 requires, without unreasonable delay and in any case within seventy-two (72) hours of discovery. The report includes, to the extent known: the identity of each affected Individual; a description of what happened, including the date of the Breach and the date of discovery; the types of PHI involved; the steps Individuals should take; and what Business Associate is doing to investigate, mitigate and prevent recurrence. Business Associate supplements the report as further information becomes available. Covered Entity gives the notices to Individuals, the Secretary and the media that 45 CFR 164.404 to 164.408 require; Business Associate supplies what those notices need as it becomes known, and notifies Individuals itself only if Covered Entity asks it to in writing.
• (b) Any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, within the same seventy-two (72) hours.
• (c) Security Incidents not reported under (a) or (b), within ten (10) business days. The parties agree that this section is notice, given now and needing no further notice, of attempted but Unsuccessful Security Incidents: pings and other broadcast attacks on firewalls, port scans, unsuccessful log-on attempts, denial-of-service attacks, and any combination of these, so long as none results in unauthorised access to, or use or disclosure of, PHI.
• (d) Activation of its contingency plan (a disaster-recovery or emergency-mode event affecting the Services) within twenty-four (24) hours of activation.

2.4 Mitigation. Mitigate, to the extent practicable, any harmful effect known to Business Associate of a use or disclosure of PHI in breach of this Agreement.

2.5 Subcontractors. Under 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractor that creates, receives, maintains or transmits PHI for Business Associate agrees in writing to the same restrictions, conditions and requirements that apply to Business Associate. Business Associate keeps a current list of Subcontractors at https://daobook.health/trust and gives Covered Entity at least thirty (30) days' notice before a new Subcontractor receives PHI. Covered Entity may end the Terms before that Subcontractor receives its PHI.

2.6 Access. Make PHI in a Designated Record Set available to Covered Entity, or as Covered Entity directs to an Individual or the Individual's designee, within ten (10) business days of Covered Entity's request, in the electronic form and format requested where readily producible. This lets Covered Entity meet 45 CFR 164.524 and shorter state deadlines. If an Individual asks Business Associate directly, Business Associate refers the Individual to Covered Entity and sends no PHI.

2.7 Amendment. Make any amendment to PHI in a Designated Record Set that Covered Entity directs or agrees to under 45 CFR 164.526, or otherwise act as needed for Covered Entity to meet 164.526, within ten (10) business days of Covered Entity's request. An Individual who asks Business Associate directly is referred to Covered Entity.

2.8 Accounting of disclosures. Keep the information required for Covered Entity to give an accounting of disclosures under 45 CFR 164.528, for six (6) years from the date of each disclosure, including disclosures by Business Associate. Provide it to Covered Entity within ten (10) business days of request.

2.9 Covered Entity's obligations carried out by Business Associate. To the extent Business Associate carries out one of Covered Entity's obligations under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to Covered Entity in carrying out that obligation.

2.10 Books and records. Make its internal practices, books and records available to the Secretary for determining compliance with the HIPAA Rules.

2.11 Minimum necessary. Limit its own uses, disclosures and requests of PHI to the minimum necessary. Business Associate's personnel access PHI only to provide the Services and to support Covered Entity, and support access requires Covered Entity's grant in the Services. Every such access is recorded (§2.2(c)).

2.12 Annual verification. On request, once in any twelve months, provide Covered Entity with a written description of the technical safeguards Business Associate has in place under 45 CFR 164.312 and of how the Services support 45 CFR 164.524, 164.526 and 164.528, and a certification by an authorised officer that they are in place.

3. Permitted uses and disclosures by Business Associate

3.1 The Services. Business Associate may use and disclose PHI as necessary to provide the Services to Covered Entity under the Terms. This includes booking, reminders and messages to patients, clinical records, prescriptions, invoicing and payments, transcription and drafting of notes, letters and case reports at the practitioner's request, data import and export, and support.

3.2 Required by Law. Business Associate may use or disclose PHI as Required by Law.

3.3 Minimum necessary. Business Associate agrees to make uses, disclosures and requests of PHI consistent with Covered Entity's minimum-necessary policies and procedures.

3.4 Nothing beyond the Covered Entity. Business Associate may not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, except for the purposes in §3.5.

3.5 Management and administration. Business Associate may use PHI for its proper management and administration, or to carry out its legal responsibilities. It may disclose PHI for those purposes only if:

• the disclosure is Required by Law, or
• Business Associate obtains reasonable assurances from the recipient that the PHI will remain confidential and be used or further disclosed only as Required by Law or for the purposes for which it was disclosed, and that the recipient will notify Business Associate of any instance of which it is aware in which the confidentiality of the PHI has been breached.

3.6 Data aggregation. Not used. Business Associate does not combine Covered Entity's PHI with the PHI of other covered entities.

3.7 Artificial intelligence and secondary use. Business Associate:

• (a) Will not use PHI to train, fine-tune or otherwise improve any machine-learning model, its own or a third party's.
• (b) Sends PHI to an AI model provider only to perform a feature of the Services at a user's request, under a BAA with that provider (§2.5), with the provider's no-training terms.
• (c) Will not de-identify PHI for its own or any third party's purposes, nor use PHI for any purpose other than providing the Services to Covered Entity and the purposes in §3.2 and §3.5. A de-identification tool within the Services acts for Covered Entity under §3.1.

3.8 No sale, no marketing. Business Associate will not sell PHI, and will not use or disclose PHI for its own marketing or that of any third party. Messages the Services send to Covered Entity's patients at Covered Entity's direction (reminders, newsletters) are sent on Covered Entity's behalf.

4. Covered Entity's obligations

4.1 Notice of Privacy Practices. Covered Entity shall notify Business Associate of any limitation in its Notice of Privacy Practices under 45 CFR 164.520, to the extent it may affect Business Associate's use or disclosure of PHI.

4.2 Changes in permission. Covered Entity shall notify Business Associate of any changes in, or revocation of, an Individual's permission to use or disclose PHI, to the extent it may affect Business Associate's use or disclosure of PHI.

4.3 Restrictions and preferences. Covered Entity shall notify Business Associate in writing of any restriction it has agreed to under 45 CFR 164.522(a) that affects Business Associate's use or disclosure of PHI, and shall record in the Services any confidential-communication preference under 164.522(b), so that the Services honour it.

4.4 Permissible requests. Covered Entity shall not ask Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Covered Entity, except for the uses §3.5 permits Business Associate.

4.5 Connected services. Where Covered Entity connects its own third-party accounts to the Services (a calendar, a payment processor, a CRM, an API integration it authorises), Covered Entity is responsible for its own agreements with those providers. Business Associate sends PHI to them only as Covered Entity configures.

5. Term and termination

5.1 Term. This Agreement runs from the Effective Date until the Terms end, or until terminated under §5.2, whichever is earlier; §§2, 3 and 5.3 continue to apply for as long as Business Associate holds PHI.

5.2 Termination for cause. Covered Entity may terminate this Agreement and the Terms if it determines Business Associate has violated a material term of this Agreement and Business Associate has not cured the breach within thirty (30) days of written notice.

5.3 On termination: return and destruction.

• (a) Export. For thirty (30) days after termination Covered Entity may sign in to the Services in read-only mode and export all of its data, PHI included, in machine-readable form (the Services' full data export). For the rest of the Retention Period, Covered Entity may ask Business Associate in writing for a copy, which Business Associate supplies within ten (10) business days.
• (b) Retention Period. Business Associate holds Covered Entity's data for about three (3) months after termination, as the Terms describe, so that Covered Entity may reactivate or export; Covered Entity may extend that period by electing paid retention under the Terms, and this Agreement continues to apply to the PHI while it does.
• (c) Deletion. Within thirty (30) days after the Retention Period ends, or sooner at Covered Entity's written request, Business Associate deletes PHI from the Services' live systems, stored files included, keeps no copies except as (d) provides, and confirms the deletion to Covered Entity in writing.
• (d) Backups. PHI remains in encrypted, access-restricted backups that cannot be altered or deleted before their retention ends: daily recovery points for up to thirty-five (35) days, monthly recovery points for up to one hundred and eighty (180) days, and non-current versions of deleted files for up to thirty (30) days. Return or destruction of that PHI before then is infeasible. Business Associate extends the protections of this Agreement to it, uses it only to restore the Services, and reapplies every deletion before a restored system serves anyone.
• (e) §5.3 survives termination.

6. Miscellaneous

6.1 Regulatory references. A reference to a section of the HIPAA Rules means the section as in effect or as amended.

6.2 Amendment. The parties agree to take action to amend this Agreement as necessary for compliance with the HIPAA Rules and any other applicable law. Business Associate may update this Agreement for that purpose on thirty (30) days' notice. Covered Entity may terminate the Terms if it does not accept the update.

6.3 Interpretation. Any ambiguity is resolved to permit compliance with the HIPAA Rules.

6.4 State law. Where a state law gives Individuals greater protection than the HIPAA Rules, the parties comply with it. For Covered Entities in California, Business Associate also:

• maintains the confidentiality standards of a provider of health care under Civil Code 56.06(f);
• keeps the audit trail of changes required by Civil Code 56.101(b);
• notifies Covered Entity of a breach as §2.3(a) provides, which the parties agree satisfies Civil Code 1798.82(b)'s requirement of notice immediately following discovery.

6.5 Precedence. If this Agreement conflicts with the Terms on the handling of PHI, this Agreement governs, and §6.7 governs over the Terms' choice of law for any dispute under this Agreement.

6.6 No third-party beneficiaries. Nothing in this Agreement gives any person other than the parties any rights.

6.7 Governing law. This Agreement is governed by the laws of the United States and of the state in which Covered Entity's principal place of business is located.

6.8 Notices. A notice to Covered Entity goes to the email address of the owner of its Daobook account, and for §2.3(a) also by telephone to the number on that account. A notice to Business Associate under §2.3 or §5.2 goes to security@daobook.health, and any other notice to support@daobook.health. A notice is given when sent, if sent within business hours in the recipient's time zone, and otherwise at the start of the next business day.

6.9 Severability. If any provision of this Agreement is held invalid or unenforceable, the rest of the Agreement stands and the provision is read as narrowly as needed to make it enforceable.

6.10 Entire agreement as to PHI. This Agreement, with the Terms and any addendum Business Associate attaches to it for Covered Entity's state, is the parties' whole agreement about PHI and replaces any earlier understanding about it.

The state addenda (California, Washington and Nevada) are attached to this agreement for every clinic in the United States.