BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (“BAA”) is entered into by and between Accrue Technologies LLC, an Illinois limited liability company (“Business Associate” or “Accrue”), and the healthcare provider, clinic, practice, organization, or other entity accepting this Agreement (“Covered Entity”).

This BAA becomes effective on the date it is accepted or executed by Covered Entity (“Effective Date”).

This BAA supplements the applicable subscription agreement, Terms of Service, order form, or other agreement governing Covered Entity’s use of the AccrueABA platform (the “Services”).

1. Purpose

Covered Entity may disclose Protected Health Information (“PHI”) to Accrue, and Accrue may create, receive, maintain, or transmit PHI on behalf of Covered Entity in connection with the Services.

The parties intend for this BAA to satisfy the requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (“HITECH Act”), and applicable implementing regulations.

2. Definitions

Terms not otherwise defined in this BAA shall have the meanings assigned to them under HIPAA and its implementing regulations, including:

• “Breach”
• “Covered Entity”
• “Electronic Protected Health Information” or “ePHI”
• “Individual”
• “Protected Health Information” or “PHI”
• “Required by Law”
• “Security Incident”
• “Subcontractor”
• “Unsecured Protected Health Information”

References to HIPAA include applicable provisions of 45 C.F.R. Parts 160 and 164, as amended.

3. Permitted Uses and Disclosures of PHI

Accrue may use or disclose PHI only:

1. To provide, operate, maintain, secure, support, and improve the Services provided to Covered Entity;
2. To perform functions or activities on behalf of Covered Entity as authorized by the parties’ underlying agreement;
3. As Required by Law;
4. For Accrue’s proper management and administration or to carry out its legal responsibilities, when permitted by HIPAA;
5. As otherwise expressly authorized in writing by Covered Entity and permitted by applicable law.

Accrue shall not use or disclose PHI in a manner that would violate the HIPAA Privacy Rule if performed by Covered Entity, except as expressly permitted for a business associate under HIPAA.

4. Prohibited Uses and Disclosures

Accrue shall not use or further disclose PHI except as permitted by this BAA, the underlying services agreement, or as Required by Law.

Accrue shall not sell PHI or use PHI for advertising or marketing purposes except where specifically authorized by Covered Entity and permitted by applicable law.

Accrue shall apply the HIPAA minimum-necessary standard where applicable.

5. Safeguards

Accrue shall implement appropriate administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of PHI and ePHI.

For ePHI, Accrue shall comply with the applicable requirements of the HIPAA Security Rule.

Such safeguards may include, as applicable:

• role-based access controls;
• authentication and multi-factor authentication controls;
• tenant and organization isolation;
• access logging and audit controls;
• secure data transmission;
• restricted storage access;
• workforce access controls;
• incident response procedures;
• data retention and deletion controls;
• reasonable protections against unauthorized access, use, alteration, or disclosure.

6. Reporting Improper Uses, Disclosures, and Breaches

Accrue shall report to Covered Entity any use or disclosure of PHI that is not permitted by this BAA of which Accrue becomes aware.

Accrue shall also report any Breach of Unsecured PHI as required by 45 C.F.R. §§ 164.400–414.

Notice shall be provided without unreasonable delay and within the period required by applicable law.

To the extent reasonably available, notice shall include:

• the nature of the incident;
• the date of the incident and date of discovery;
• the types of PHI involved;
• the identities of affected Individuals, if known;
• mitigation measures taken or planned;
• other information reasonably required for Covered Entity to satisfy its legal obligations.

7. Security Incidents

Accrue shall report Security Incidents involving Covered Entity’s ePHI as required by HIPAA.

The parties acknowledge that unsuccessful security events that do not result in unauthorized access, use, disclosure, modification, or destruction of PHI may occur in the ordinary course of operating internet-connected systems.

Routine unsuccessful events such as automated scans, blocked login attempts, pings, unsuccessful attacks, and similar activity do not require separate individual reporting unless otherwise required by law or unless they result in a reportable Security Incident.

8. Subcontractors

Accrue may use subcontractors and service providers in providing the Services.

Accrue shall ensure that any subcontractor that creates, receives, maintains, or transmits PHI on behalf of Accrue agrees in writing to restrictions, conditions, and safeguards that are no less protective of PHI than those applicable to Accrue under this BAA, as required by HIPAA.

Accrue shall remain responsible for managing its business-associate subcontractor relationships as required by applicable law.

9. Access to PHI

To the extent Accrue maintains PHI within a Designated Record Set on behalf of Covered Entity, Accrue shall make such PHI available to Covered Entity as reasonably necessary for Covered Entity to satisfy its obligations under 45 C.F.R. § 164.524.

Unless otherwise agreed, Covered Entity shall remain responsible for communicating directly with Individuals regarding requests for access.

10. Amendment of PHI

To the extent applicable, Accrue shall make PHI available for amendment and shall incorporate amendments or corrections as reasonably directed by Covered Entity in accordance with 45 C.F.R. § 164.526.

11. Accounting of Disclosures

Accrue shall document disclosures of PHI and provide information reasonably necessary to enable Covered Entity to respond to a request for an accounting of disclosures as required by 45 C.F.R. § 164.528.

12. Covered Entity Privacy Rule Obligations

To the extent Accrue has expressly agreed to carry out an obligation of Covered Entity under the HIPAA Privacy Rule, Accrue shall comply with the requirements of the Privacy Rule applicable to Covered Entity in performing that obligation.

13. Government Access

Accrue shall make its internal practices, books, and records relating to the use and disclosure of PHI received from, created for, or maintained on behalf of Covered Entity available to the Secretary of the U.S. Department of Health and Human Services as required for purposes of determining compliance with HIPAA.

14. Covered Entity Responsibilities

Covered Entity agrees to:

1. Use the Services in accordance with HIPAA and other applicable laws;
2. Configure user access appropriately;
3. Maintain appropriate workforce policies and procedures;
4. Protect account credentials;
5. Promptly disable access for individuals who should no longer have access;
6. Obtain any authorizations, consents, or permissions required for Covered Entity’s use or disclosure of PHI;
7. Notify Accrue of any restrictions or limitations relating to PHI that materially affect Accrue’s performance of the Services;
8. Not direct Accrue to use or disclose PHI in a manner prohibited by HIPAA.

Covered Entity remains responsible for its own HIPAA compliance and for determining whether its use of the Services complies with applicable federal and state law.

15. Data Return and Destruction

Upon termination of the Services or this BAA, Accrue shall, where feasible and as required by applicable law, return or destroy PHI received from Covered Entity or created, received, or maintained on Covered Entity’s behalf.

If return or destruction is not feasible, Accrue shall continue to extend the protections of this BAA to the retained PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible.

Nothing in this section requires destruction of information that Accrue is legally required to retain.

16. Term and Termination

This BAA begins on the Effective Date and remains in effect for as long as Accrue creates, receives, maintains, or transmits PHI on behalf of Covered Entity.

Covered Entity may terminate this BAA and the associated Services if Covered Entity determines that Accrue has materially violated this BAA and Accrue fails to cure the violation within a reasonable period after receiving notice, where cure is possible.

Where termination is not feasible, the parties shall take any actions required by applicable law.

17. Changes in Law

The parties agree that this BAA shall be interpreted and, where necessary, amended to remain consistent with applicable changes to HIPAA, HITECH, and related regulations.

18. State Law

Where applicable state privacy or health-information law imposes requirements more stringent than HIPAA, the parties shall comply with such requirements to the extent applicable to their respective activities.

19. No Third-Party Beneficiaries

Nothing in this BAA is intended to create rights in any person or entity other than Accrue and Covered Entity, except as otherwise required by law.

20. Relationship to Other Agreements

If a provision of this BAA conflicts with a provision of the parties’ underlying agreement regarding the use or protection of PHI, this BAA shall control with respect to PHI.

All other provisions of the underlying agreement remain in effect.

21. Electronic Acceptance

The parties agree that this BAA may be executed electronically.

Electronic acceptance, including acceptance through the AccrueABA platform by an authorized representative of Covered Entity, shall constitute a valid signature to the extent permitted by applicable law.

The platform may record evidence of acceptance including:

• organization name;
• authorized representative;
• representative title;
• date and time of acceptance;
• BAA version;
• user account associated with acceptance;
• electronic signature or acknowledgement.

22. Parties

BUSINESS ASSOCIATE

Accrue Technologies LLC

AccrueABA

accrueaba.com

Authorized Representative:

Name: ______________________________

Title: _______________________________

Signature: ____________________________

Date: ________________________________

COVERED ENTITY

Legal Organization Name: ______________________________

Authorized Representative: _____________________________

Title: _______________________________________________

Address: _____________________________________________

Email: _______________________________________________

Signature: ____________________________________________

Date: ________________________________________________