Business Associate Agreement

Effective 25 October 2026 · Last updated 25 October 2026

This is the HIPAA Business Associate Agreement. It is executed between FlourishBx and the covered entity — the clinician or clinic — before any Protected Health Information is placed in the Service, and it prevails over the Subscription Agreement as to PHI. It is published here so it can be read before anyone is asked to sign it.

FlourishBx LLC d/b/a FlourishBx

Effective Date: the date of the later signature below, or, where no signature block is completed, the date the Customer first accepts this Agreement electronically.

PARTIES

This Business Associate Agreement (this "BAA" or this "Agreement") is entered into by and between:

FlourishBx LLC, a limited liability company organized and existing under the laws of the State of North Carolina, doing business as FlourishBx (the "Business Associate"); and

____________________ (the "Covered Entity").

Each a "Party" and together the "Parties."

RECITALS

A. The Covered Entity is a covered entity, or acts on behalf of a covered entity, within the meaning of HIPAA.

B. The Business Associate provides the FlourishBx Clinician Dashboard to the Covered Entity under the Subscription Agreement, and in doing so creates, receives, maintains and transmits Protected Health Information on the Covered Entity's behalf.

C. The Business Associate is accordingly a business associate within the meaning of 45 C.F.R. § 160.103.

D. HIPAA requires the Parties to enter into a written agreement containing the provisions set out at 45 C.F.R. §§ 164.504(e) and 164.314(a).

NOW, THEREFORE, in consideration of the mutual covenants below and of the Parties' performance of the Subscription Agreement, the Parties agree as follows.

ARTICLE 1 — DEFINITIONS

1.1 HIPAA definitions adopted. Capitalized terms used but not defined in this Agreement have the meanings given to them in HIPAA. Without limiting that, the following terms have the meanings given at the provisions cited: Breach (§ 164.402); Data Aggregation (§ 164.501); Designated Record Set (§ 164.501); Disclosure (§ 160.103); Electronic Protected Health Information (§ 160.103); Health Care Operations (§ 164.501); Individual (§ 160.103); Minimum Necessary (§ 164.502(b)); Protected Health Information (§ 160.103); Required By Law (§ 164.103); Secretary (§ 160.103); Security Incident (§ 164.304); Subcontractor (§ 160.103); Unsecured Protected Health Information (§ 164.402); and Use (§ 160.103).

1.2 "Caregiver" means an individual granted access to a Client's record through the Caregiver App at the direction of the Covered Entity.

1.3 "Caregiver App" means the FlourishBx mobile application for parents and caregivers.

1.4 "Client" means an Individual receiving services from the Covered Entity about whom a record is maintained in the Service. A Client is ordinarily a minor.

1.5 "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, as amended by the Health Information Technology for Economic and Clinical Health Act, Pub. L. No. 111-5, together with the regulations at 45 C.F.R. Parts 160, 162 and 164, in each case as amended.

1.6 "PHI" means Protected Health Information created, received, maintained or transmitted by the Business Associate for or on behalf of the Covered Entity under the Subscription Agreement. PHI does not include the Covered Entity's own account, contact and billing information, which the Business Associate holds on its own behalf and which is governed by the Privacy Policy.

1.7 "Privacy Policy" means the FlourishBx Clinician Dashboard Product Privacy Policy, as amended.

1.8 "Privacy Rule" means 45 C.F.R. Part 160 and Part 164, Subparts A and E.

1.9 "Security Rule" means 45 C.F.R. Part 160 and Part 164, Subparts A and C.

1.10 "Service" means the FlourishBx Clinician Dashboard, together with the Caregiver App to the extent Caregivers are granted access in respect of the Covered Entity's Clients.

1.11 "Subscription Agreement" means the FlourishBx Subscription Agreement between the Parties, as amended, including the Pricing Policy and any Order Form.

ARTICLE 2 — RULES OF CONSTRUCTION

2.1 Headings are for convenience only and do not affect construction.

2.2 "Including" means "including without limitation."

2.3 Statutory references are to the provision as amended, and to any successor provision.

2.4 Days means calendar days unless "Business Days" is stated, "Business Day" meaning a day other than a Saturday, Sunday or day on which national banking institutions in North Carolina are authorized or required to close.

2.5 Interpretation in favor of compliance. THIS AGREEMENT SHALL BE INTERPRETED AT ALL TIMES SO AS TO PERMIT EACH PARTY TO COMPLY WITH HIPAA. Where a provision is capable of two constructions, the construction consistent with HIPAA governs.

2.6 Regulatory citations. A reference to a regulatory provision incorporates its substance, and a renumbering of that provision does not diminish the obligation.

2.7 No construction against the drafter. Any rule requiring an ambiguity to be resolved against the drafting Party does not apply.

2.8 Conspicuous text. Capitalized or bold text is intended to be conspicuous within the meaning of N.C. Gen. Stat. § 25-1-201(b)(10).

ARTICLE 3 — RELATIONSHIP TO THE SUBSCRIPTION AGREEMENT

3.1 Incorporation. This Agreement supplements and forms part of the Subscription Agreement.

3.2 Precedence. THIS AGREEMENT GOVERNS AS TO PHI AND PREVAILS OVER THE SUBSCRIPTION AGREEMENT, THE PRICING POLICY AND THE PRIVACY POLICY TO THE EXTENT OF ANY CONFLICT CONCERNING PHI. Section 4.3.2 of the Subscription Agreement so provides.

3.3 Scope limited to PHI. This Agreement creates no right to use the Service, no fee, no service level and no support obligation. Those arise only under the Subscription Agreement.

3.4 No independent term. This Agreement terminates with the Subscription Agreement, subject to Articles 15 and 16.

3.5 Consistency of covenants. Where this Agreement and the Subscription Agreement each impose an obligation on the same subject matter, the obligations are cumulative and the more protective of PHI governs.

3.6 One Agreement per Covered Entity

3.6.1 This Agreement is executed once, by the legal entity that is the Covered Entity, acting through a person with authority to bind it. Section 1.3 of the Subscription Agreement governs that authority.

3.6.2 Workforce members do not sign. An individual Clinician who is a member of the Covered Entity's workforce within the meaning of 45 C.F.R. § 160.103 — an employee, volunteer, trainee, or other person whose conduct in performing work for the Covered Entity is under its direct control — is not a business associate and executes no separate agreement. Their access to the Service is access by the Covered Entity.

3.6.3 Clinic Accounts. On a Clinic Account, one Agreement covers every Clinician in that clinic's workforce, however many hold credentials to the Service.

3.6.4 Independent practitioners. A Clinician who subscribes individually, with no clinic, is themselves the Covered Entity and executes this Agreement in their own name.

3.6.5 Clinicians who are not workforce members. Whether a contracted Clinician is a workforce member, a separate covered entity, or a business associate of the Covered Entity is a determination for the Covered Entity, turning on its own arrangements. The Business Associate makes no such determination and contracts with the entity holding the Account.

3.6.6 Separate accounts require separate agreements. Where a Clinician holds an Account of their own for clients outside the clinic, that Account is a distinct Covered Entity relationship and requires its own execution of this Agreement.

ARTICLE 4 — PERMITTED USES AND DISCLOSURES BY THE BUSINESS ASSOCIATE

4.1 General limitation

The Business Associate shall not Use or Disclose PHI other than as this Agreement permits or requires, or as Required By Law. 45 C.F.R. § 164.504(e)(2)(ii)(A) and (B).

4.2 Use and disclosure to provide the Service

The Business Associate may Use and Disclose PHI as necessary to perform the Subscription Agreement, being: to host, store, transmit and display the Client record; to make it available to the Covered Entity's authorized users; to make it available to Caregivers under Article 13; to generate reports and displays within the Service at the Covered Entity's direction; to back up and restore; to secure and monitor the Service; and to provide technical support at the Covered Entity's request.

4.3 Management and administration

The Business Associate may Use PHI for its own proper management and administration, and to carry out its legal responsibilities. 45 C.F.R. § 164.504(e)(4)(i).

4.3.1 Disclosure for that purpose is permitted only where Required By Law, or where the Business Associate obtains reasonable assurances in writing from the recipient that the PHI will be held confidentially, Used or further Disclosed only as Required By Law or for the purpose for which it was disclosed, and that the recipient will notify the Business Associate of any breach of confidentiality of which it becomes aware. 45 C.F.R. § 164.504(e)(4)(ii).

4.4 Required By Law

The Business Associate may Use and Disclose PHI as Required By Law. Section 9.6 governs notice of such a disclosure.

4.5 Data Aggregation

The Business Associate may Use PHI to provide Data Aggregation services relating to the Health Care Operations of the Covered Entity, as 45 C.F.R. § 164.504(e)(2)(i)(B) permits, but only where the Covered Entity has instructed it in writing to do so. Absent such an instruction the Business Associate performs no Data Aggregation, and Article 5 is not limited by this Section.

4.6 No greater use than the Covered Entity

The Business Associate shall not Use or Disclose PHI in a manner that would violate the Privacy Rule if done by the Covered Entity, save as permitted at Sections 4.3 and 4.5. 45 C.F.R. § 164.504(e)(2)(i).

4.7 Compliance with the Covered Entity's restrictions

The Business Associate shall comply with any restriction to which the Covered Entity has agreed under 45 C.F.R. § 164.522, and with any limitation in the Covered Entity's notice of privacy practices under § 164.520, in each case to the extent the Covered Entity notifies the Business Associate of it in writing. Section 14.3 governs that notice.

ARTICLE 5 — PROHIBITED USES

This Article is not required by HIPAA. It is a covenant the Business Associate gives, and it narrows rights a business associate would ordinarily hold.

5.1 No de-identification

5.1.1 THE BUSINESS ASSOCIATE SHALL NOT DE-IDENTIFY PHI, whether by the expert determination method at 45 C.F.R. § 164.514(b)(1) or the safe harbor method at § 164.514(b)(2), and shall not create a limited data set under § 164.514(e).

5.1.2 This is a deliberate departure from ordinary practice. A business associate permitted to de-identify may thereafter Use and Disclose the resulting data without restriction, HIPAA ceasing to apply to it and the Covered Entity losing all control over it. The Business Associate declines that right.

5.2 No secondary exploitation

The Business Associate shall not Use or Disclose PHI, or any data derived from PHI, whether identified, pseudonymized, de-identified or aggregated:

5.2.1 to develop, train, fine-tune, evaluate or improve any artificial intelligence or machine learning model, whether its own or a third party's, and shall not transmit PHI to any third-party model provider;

5.2.2 for research, benchmarking, publication, or the development of any product or dataset offered to any person other than the Covered Entity;

5.2.3 for marketing within the meaning of 45 C.F.R. § 164.501, or for fundraising within the meaning of § 164.514(f); or

5.2.4 for sale, within the meaning of 45 C.F.R. § 164.502(a)(5)(ii) or otherwise, and the Business Associate shall not receive remuneration in exchange for PHI.

5.3 Operational metrics excepted

Sections 5.1 and 5.2 do not prevent the Business Associate from generating counts and measurements concerning the operation, performance, availability and security of the Service — for example the number of records created across the whole service in a period, or the frequency of an error — provided that such measurements contain no PHI, no Client identifier, and nothing capable of being linked to a Client.

5.4 Amendment

This Article may be amended only by a written instrument executed by both Parties. It is not subject to Section 19.2.

ARTICLE 6 — MINIMUM NECESSARY

6.1 The Business Associate shall limit its Use, Disclosure and request of PHI to the minimum necessary to accomplish the intended purpose, consistent with 45 C.F.R. §§ 164.502(b) and 164.514(d).

6.2 Workforce access is limited to those members who require it for a specific operational or support purpose, and only to the extent required. Section 7.4 governs.

6.3 Section 6.1 does not apply to a Use or Disclosure to which the minimum necessary standard does not apply under § 164.502(b)(2), including a disclosure to the Individual or made pursuant to an authorization.

ARTICLE 7 — SAFEGUARDS AND SECURITY

7.1 General obligation

The Business Associate shall use appropriate safeguards, and shall comply with Subpart C of 45 C.F.R. Part 164 with respect to Electronic PHI, to prevent Use or Disclosure of PHI other than as this Agreement provides. 45 C.F.R. §§ 164.504(e)(2)(ii)(A)–(B) and 164.314(a)(2)(i)(A).

7.2 Administrative, physical and technical safeguards

Without limiting Section 7.1, the Business Associate shall maintain: a written security management process and risk analysis under § 164.308(a)(1); workforce security and training under §§ 164.308(a)(3) and (a)(5); a sanction policy under § 164.308(a)(1)(ii)(C); access controls and unique user identification under § 164.312(a); audit controls under § 164.312(b); integrity controls under § 164.312(c); person or entity authentication under § 164.312(d); and transmission security under § 164.312(e).

7.3 Specific measures

7.3.1 Encryption in transit using TLS 1.2 or higher, and encryption at rest.

7.3.2 Access controls enforced at the database layer, such that a request for a record the requester is not entitled to returns no data, however the request is made.

7.3.3 Automatic session termination and throttling of repeated failed authentication attempts.

7.3.4 Recording of views of a Client record, in an append-only log which cannot be altered or deleted. The Business Associate does not represent that this recording covers every read path, and access by its personnel through administrative tooling is not presently recorded.

7.3.5 Multi-factor authentication available to clinician accounts, with single-use recovery codes and a remembered-browser period not exceeding thirty (30) days during which the account password remains required at every sign-in.

7.4 Workforce

7.4.1 The Business Associate shall ensure that each workforce member with access to PHI is trained on its obligations under this Agreement and under HIPAA.

7.4.2 The Business Associate shall apply sanctions against a workforce member who violates this Agreement, and shall maintain a record of sanctions applied.

7.4.3 Access is revoked promptly upon a workforce member ceasing to require it.

7.5 Data location

PHI is stored and Processed in the United States, and shall not be transferred outside the United States without the Covered Entity's prior written consent.

7.6 No guarantee

NO SYSTEM IS COMPLETELY SECURE. Nothing in this Article is a warranty that PHI will never be subject to unauthorized access, and Article 28 of the Subscription Agreement applies.

ARTICLE 8 — SUBCONTRACTORS

8.1 Written agreement required

The Business Associate shall ensure that each Subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to restrictions and conditions no less protective than those in this Agreement, as 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2) require.

8.2 Responsibility

The Business Associate remains responsible to the Covered Entity for the acts and omissions of its Subcontractors in respect of PHI as though they were its own. Directing the Covered Entity to a Subcontractor is not an answer the Business Associate will give.

8.3 Current Subcontractors

The Subcontractors engaged as at the Effective Date are listed at Exhibit A.

8.4 Notice of change

8.4.1 The Business Associate shall give the Covered Entity not less than thirty (30) days' written notice before engaging a new Subcontractor with access to PHI.

8.4.2 Where the Covered Entity reasonably objects on data protection grounds within that period, it may terminate the Subscription Agreement and this Agreement without penalty, and shall receive a refund of the unused portion of any prepaid fees.

8.5 Hosting

8.5.1 The hosting provider is a Subcontractor within the meaning of this Article.

8.5.2 The hosting provider is Google LLC. A Business Associate Agreement with Google covering Google Cloud Platform is executed, and a Business Associate Agreement covering Google Workspace was executed on 2 October 2026. Exhibit A lists both.

ARTICLE 9 — REPORTING

9.1 Impermissible use or disclosure

The Business Associate shall report to the Covered Entity any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, without unreasonable delay. 45 C.F.R. § 164.504(e)(2)(ii)(D).

9.2 Security Incidents

The Business Associate shall report to the Covered Entity any Security Incident of which it becomes aware, in accordance with Sections 9.3 and 9.4. 45 C.F.R. § 164.314(a)(2)(i)(C).

9.3 Unsuccessful Security Incidents

Routine unsuccessful attempts that result in no unauthorized access, Use, Disclosure, modification or destruction of PHI and no interference with system operations — including pings and other broadcast attacks on a firewall, port scans, unsuccessful log-on attempts, denial of service attempts that do not succeed, and malware that does not execute — require no individual report, and this Section 9.3 constitutes notice of them. The Business Associate shall furnish a summary of such activity upon the Covered Entity's reasonable written request.

9.4 Breach of Unsecured PHI

9.4.1 The Business Associate shall notify the Covered Entity of a Breach of Unsecured PHI without unreasonable delay and in no case later than sixty (60) calendar days after Discovery, as 45 C.F.R. § 164.410 requires.

9.4.2 Discovery has the meaning at § 164.410(a)(2): a Breach is treated as discovered on the first day on which it is known, or by exercising reasonable diligence would have been known, to the Business Associate.

9.5 Target of five Business Days

9.5.1 The Business Associate targets notice within five (5) Business Days of Discovery.

9.5.2 This target exists because the sixty-day maximum is of little use to the Covered Entity, whose own obligation to notify Individuals under § 164.404 runs from the same Discovery. A notice delivered on day fifty-nine leaves the Covered Entity one day.

9.5.3 The target does not extend the outer limit at Section 9.4.1, and a failure to meet the target is not excused by it.

9.6 Contents of a notice

A notice under Section 9.4 shall include, to the extent known and thereafter as it becomes known: the identification of each Individual whose PHI has been, or is reasonably believed to have been, accessed, acquired, Used or Disclosed; a description of what occurred; the date of the Breach and the date of Discovery; the types of PHI involved; the steps the Business Associate has taken to investigate, mitigate and prevent recurrence; and the contact details of a person who can answer questions.

9.7 Supplementation

The Business Associate shall not delay an initial notice in order to complete its investigation, and shall supplement the notice promptly as further information becomes available.

9.8 Mitigation

The Business Associate shall mitigate, to the extent practicable, any harmful effect known to it of a Use or Disclosure of PHI in violation of this Agreement. 45 C.F.R. § 164.530(f), applied by contract.

9.9 Notification of Individuals

Notification of Individuals under § 164.404, of the media under § 164.406, and of the Secretary under § 164.408 is the Covered Entity's obligation. The Business Associate shall not notify an Individual without the Covered Entity's written instruction, save where Required By Law, and shall cooperate reasonably with the Covered Entity in the making of such notifications, including by furnishing the information at Section 9.6 in a usable form.

9.10 Disclosure Required By Law

Where the Business Associate is compelled to Disclose PHI by subpoena, court order, warrant or other lawful process, it shall Disclose only what the process requires, and shall notify the Covered Entity before Disclosure where lawful and reasonably practicable, so that the Covered Entity may seek protective treatment.

9.11 Reporting contact

Notices under this Article shall be given to the Covered Entity at ____________________ and, where none is stated, to the administrative contact on the Account. The Covered Entity shall maintain that contact current.

ARTICLE 10 — INDIVIDUAL RIGHTS

10.1 Access — § 164.524

The Business Associate shall make PHI in a Designated Record Set available to the Covered Entity, within [10] Business Days of a written request, so as to permit the Covered Entity to respond to a request for access under 45 C.F.R. § 164.524. 45 C.F.R. § 164.504(e)(2)(ii)(E).

10.2 Amendment — § 164.526

The Business Associate shall make PHI in a Designated Record Set available to the Covered Entity for amendment, and shall incorporate any amendment the Covered Entity directs, within [10] Business Days of written direction. 45 C.F.R. § 164.504(e)(2)(ii)(F).

10.3 Accounting of disclosures — § 164.528

10.3.1 The Business Associate shall maintain, and make available to the Covered Entity, the information required to provide an accounting of disclosures under 45 C.F.R. § 164.528. 45 C.F.R. § 164.504(e)(2)(ii)(G).

10.3.2 The Business Associate shall retain that information for six (6) years from the date of the disclosure.

10.3.3 The record shall state, for each disclosure required to be accounted for: the date; the name and, where known, the address of the recipient; a brief description of the PHI disclosed; and a brief statement of the purpose.

10.3.4 The Business Associate shall furnish the information within [10] Business Days of written request.

10.4 Restrictions — § 164.522

The Business Associate shall give effect to any restriction on Use or Disclosure to which the Covered Entity has agreed and of which it has notified the Business Associate in writing, and to any request for confidential communications the Covered Entity has accommodated. Section 4.7 governs.

10.5 Requests received directly

10.5.1 Where the Business Associate receives a request under §§ 164.524, 164.526, 164.528 or 164.522 directly from an Individual or their personal representative, it shall not respond substantively.

10.5.2 It shall promptly forward the request to the Covered Entity and inform the requester that it has done so and to whom. It shall not simply tell the requester that the matter is not its concern.

10.6 No independent determination

The Business Associate makes no determination as to whether a request is valid, whether an exception applies, or who is a personal representative. Those are the Covered Entity's determinations, including a determination under § 164.502(g)(5) that a person should not be treated as a personal representative.

10.7 Fees

The Business Associate shall not charge the Covered Entity for performing its obligations under this Article, save that it may charge its reasonable cost for an extraordinary volume of requests, on prior written notice.

ARTICLE 11 — ACCESS TO BOOKS AND RECORDS

11.1 The Business Associate shall make its internal practices, books and records relating to the Use and Disclosure of PHI available to the Secretary for purposes of determining the Covered Entity's compliance with the Privacy Rule. 45 C.F.R. § 164.504(e)(2)(ii)(H).

11.2 The Business Associate shall notify the Covered Entity of any such request promptly, unless prohibited from doing so.

11.3 Nothing in this Article waives any legal privilege.

11.4 Covered Entity audit. Upon reasonable prior written notice and not more than once in any twelve (12) month period, the Business Associate shall respond to a written security questionnaire and furnish available third-party assessment reports. This Section confers no right of physical access to the Business Associate's systems or premises, and any on-site or penetration testing requires the Business Associate's prior written consent.

ARTICLE 12 — CARRYING OUT COVERED ENTITY OBLIGATIONS

To the extent the Business Associate is to carry out an obligation of the Covered Entity under Subpart E of 45 C.F.R. Part 164, it shall comply with the requirements of Subpart E that apply to the Covered Entity in the performance of that obligation. 45 C.F.R. § 164.504(e)(2)(ii)(I).

12.1 As at the Effective Date the Business Associate carries out no such obligation, and this Article operates only if and when the Parties agree in writing that it shall.

ARTICLE 13 — CAREGIVER ACCESS

A standard business associate agreement has no vocabulary for this, and without an express provision the disclosure described below would be unpermitted.

13.1 The disclosure. The Business Associate Discloses PHI to Caregivers through the Caregiver App. That Disclosure is made at the direction of the Covered Entity and is permitted under Section 4.2.

13.2 The Covered Entity directs it. The Covered Entity determines which Caregivers may access a Client's record, and for how long, through the invitation and removal controls in the Service. The Business Associate makes no determination as to who should have access and does not adjudicate a dispute about it.

13.3 Authorization is the Covered Entity's obligation. The Covered Entity represents that it holds any consent, authorization or personal-representative determination required to permit each Caregiver's access, including any determination under 45 C.F.R. § 164.502(g).

13.4 Caregivers are not business associates. A Caregiver receives PHI as a personal representative of the Client, or as a person involved in the Client's care within the meaning of § 164.510(b), and not as a business associate of either Party.

13.5 Caregiver credentials. A Caregiver holds credentials issued by the Business Associate and accepts the Caregiver App Terms of Use directly with it. That agreement is not a business associate agreement and confers no right upon the Covered Entity.

13.6 Segregation between Caregivers. A Caregiver may read only the behavior logs they themselves recorded. The Covered Entity may read all of them together with the identity of the recording Caregiver.

13.7 Removal. Upon the Covered Entity removing a Caregiver's access, the Business Associate shall cease Disclosing that Client's PHI to that Caregiver.

13.8 Records already disclosed. The Business Associate cannot retrieve PHI a Caregiver has already seen, and neither Party warrants that it can.

ARTICLE 14 — OBLIGATIONS OF THE COVERED ENTITY

14.1 Lawful instructions. The Covered Entity shall not instruct the Business Associate to Use or Disclose PHI in a manner that would violate the Privacy Rule if done by the Covered Entity, save as Sections 4.3 and 4.5 permit.

14.2 Consents and authorizations. The Covered Entity shall obtain and maintain every consent, authorization and permission required for the Business Associate to Process PHI as this Agreement contemplates.

14.3 Notice of restrictions. The Covered Entity shall notify the Business Associate in writing of: any limitation in its notice of privacy practices under § 164.520; any restriction agreed under § 164.522; and any revocation of a permission by an Individual, in each case to the extent it affects the Business Associate's Use or Disclosure of PHI. The Business Associate cannot give effect to a restriction of which it is unaware.

14.4 Minimum necessary. The Covered Entity shall not place PHI in the Service beyond what is reasonably necessary for the purpose.

14.5 No PHI in support channels. The Covered Entity shall not transmit PHI to the Business Associate by electronic mail or through a general support channel.

14.6 Account security. The Covered Entity shall maintain the confidentiality of credentials issued under its Account and shall deprovision a workforce member's access promptly upon their ceasing to require it.

14.7 Its own compliance. Nothing in this Agreement relieves the Covered Entity of any obligation of its own under HIPAA, including notification of Individuals under § 164.404.

ARTICLE 15 — TERM AND TERMINATION

15.1 Term. This Agreement takes effect on the Effective Date and continues until the later of the termination of the Subscription Agreement and the return or destruction of all PHI under Article 16.

15.2 Termination with the Subscription Agreement. Section 3.4 governs.

15.3 Termination for cause by the Covered Entity. Where the Business Associate materially breaches this Agreement, the Covered Entity may:

15.3.1 provide an opportunity to cure within thirty (30) days, and terminate the Subscription Agreement and this Agreement if the breach is not cured; or

15.3.2 terminate immediately where cure is not possible.

45 C.F.R. § 164.504(e)(2)(iii).

15.4 Termination for cause by the Business Associate. Where the Covered Entity materially breaches this Agreement, the Business Associate may terminate on the same basis, and may suspend the Account under Article 19 of the Subscription Agreement where continued Processing would place it in violation of HIPAA.

15.5 Reporting to the Secretary. Where neither termination nor cure is feasible, the Party not in breach shall report the violation to the Secretary, as § 164.504(e)(1)(ii) contemplates.

15.6 Effect on fees. Termination under Section 15.3 is a termination for the Business Associate's material breach for the purposes of Section 19.3.3 of the Pricing Policy, and the unused portion of any prepaid fees shall be refunded.

ARTICLE 16 — RETURN OR DESTRUCTION OF PHI

16.1 Obligation. Upon termination the Business Associate shall return or destroy all PHI it maintains in any form and shall retain no copies, and shall cause each Subcontractor to do likewise. 45 C.F.R. § 164.504(e)(2)(ii)(J).

16.2 Export window first. Before destruction the Business Associate shall afford the Covered Entity ninety (90) days from closure in which to export the Customer Data, as Article 12 of the Pricing Policy provides. The Business Associate shall not withhold export by reason of a dispute as to fees.

16.3 Certification. The Business Associate shall certify destruction in writing upon the Covered Entity's request, stating the date and the method.

16.4 Method. Destruction shall render PHI unusable, unreadable and indecipherable, consistent with the Secretary's guidance under § 164.402(2).

16.5 Where return or destruction is infeasible.

16.5.1 Where return or destruction is infeasible, the Business Associate shall notify the Covered Entity, identify the PHI concerned and the reason, and shall extend the protections of this Agreement to that PHI and limit further Uses and Disclosures to the purposes that make return or destruction infeasible, for so long as it is retained. 45 C.F.R. § 164.504(e)(2)(ii)(J).

16.5.2 Backups. PHI may persist in encrypted backups until those backups expire in the ordinary cycle, and shall not be restored to the live service save as part of a general disaster recovery. Section 16.5.1 applies to it.

16.5.3 Legal hold. PHI subject to a legal hold may be retained for that purpose only, and Section 16.5.1 applies to it.

ARTICLE 17 — LIABILITY AND INSURANCE

17.1 Limitation of liability. The limitations at Article 30 of the Subscription Agreement apply to liability arising under this Agreement, subject to Section 17.2.

17.2 Section 30.3 of the Subscription Agreement makes no enhanced cap for data incidents. The Business Associate's liability for a Breach it causes is therefore governed by the general cap at Section 30.2 of that agreement, save for the carve-outs at Section 30.4, which are not limited and include fraud, gross negligence and wilful misconduct. Section 17.3 is unaffected: direct liability under HIPAA is not a matter of contract.

17.3 Direct liability. The Business Associate acknowledges that it is directly liable under HIPAA for the provisions identified at 45 C.F.R. § 160.402(c) and for the requirements of Subpart C, independently of this Agreement, and nothing here limits the Secretary's enforcement.

17.4 Insurance. Article 31 of the Subscription Agreement governs.

ARTICLE 18 — STATE LAW

18.1 Where a state law is more stringent than HIPAA within the meaning of 45 C.F.R. § 160.202 and is not preempted, the Business Associate shall comply with it in respect of PHI to which it applies.

18.2 The Covered Entity shall notify the Business Associate in writing of any such requirement it expects the Business Associate to satisfy, the Business Associate not being in a position to know the licensure or practice jurisdiction of every Covered Entity.

18.3 Nothing in this Agreement requires either Party to act in a manner inconsistent with a more stringent state law.

ARTICLE 19 — GENERAL PROVISIONS

19.1 Amendment to comply with law. The Parties shall negotiate in good faith to amend this Agreement as necessary for either to comply with a change in HIPAA or other Applicable Law. Where the Parties fail to agree within thirty (30) days of a Party's written request, either may terminate on thirty (30) days' notice.

19.2 Other amendment. Save as Section 19.1 and Section 5.4 provide, this Agreement may be amended only by a written instrument executed by both Parties.

19.3 Survival. Articles 1, 2, 5, 9 (as to a Breach discovered before termination), 10.3, 11, 16, 17, 18 and 19 survive termination.

19.4 Severability. An invalid provision shall be modified to the minimum extent necessary to render it enforceable or, failing that, severed, provided that no modification or severance shall cause this Agreement to fail to satisfy 45 C.F.R. §§ 164.504(e) or 164.314(a). The remainder continues in force.

19.5 No waiver. A failure to enforce is not a waiver. A waiver is effective only in writing.

19.6 No third-party beneficiaries. This Agreement confers no right upon any person other than the Parties, and nothing in it creates a private right of action in any Individual.

19.7 Assignment. Section 34.5 of the Subscription Agreement governs. An assignee shall be bound by this Agreement, and by Article 5 in particular.

19.8 Notices. Notices shall be given as Section 34.9 of the Subscription Agreement provides, save that a report under Article 9 may additionally be given by electronic mail to the contact at Section 9.11 and is effective when sent.

19.9 Governing law. The laws of the State of North Carolina govern, without regard to conflict of laws principles, together with applicable federal law. Article 18 is not limited by this Section.

19.10 Counterparts and electronic signature. This Agreement may be executed in counterparts and by electronic signature, under 15 U.S.C. §§ 7001 et seq. and N.C. Gen. Stat. §§ 66-311 et seq.

19.11 Entire agreement on its subject matter. This Agreement is the entire agreement between the Parties as to the Use and Disclosure of PHI and supersedes any prior understanding on that subject.