This Business Associate Agreement ("BAA") is entered into between the customer identified in the signature block ("Covered Entity") and SmileData LLC, a Georgia limited liability company ("Business Associate"), and is incorporated into and governed by the Smile Data Terms of Service (the "Agreement"). Capitalized terms used but not defined here have the meanings in the Agreement or in HIPAA.
1. DEFINITIONS
"HIPAA" means the Health Insurance Portability and Accountability Act of 1996 and the regulations at 45 C.F.R. Parts 160 and 164, as amended, including the HITECH Act.
"PHI" means Protected Health Information (as defined at 45 C.F.R. § 160.103) created, received, maintained, or transmitted by Business Associate for or on behalf of Covered Entity under the Agreement. PHI excludes information that has been de-identified in accordance with 45 C.F.R. § 164.514(b).
"Breach," "Security Incident," "Unsecured PHI," "Subcontractor," "Designated Record Set," "Required by Law," and similar terms have the meanings given in HIPAA.
2. PERMITTED USES AND DISCLOSURES
2.1 Business Associate may use and disclose PHI: (a) to perform the Services described in the Agreement, including analytics, dashboards, reports, worklists, audio summaries, and AI-generated Outputs derived from Covered Entity's practice data; (b) as Required by Law; (c) for the proper management and administration of Business Associate and to carry out its legal responsibilities, provided any disclosure for such purposes is Required by Law or made under reasonable assurances of confidentiality and breach notification from the recipient; and (d) to provide Data Aggregation services relating to the health care operations of Covered Entity as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B).
2.2 De-identification. Business Associate may de-identify PHI in accordance with 45 C.F.R. § 164.514(b). De-identified data is not PHI and Business Associate may use it as provided in the Agreement.
2.3 Minimum Necessary. Business Associate will make reasonable efforts to use, disclose, and request only the minimum necessary PHI to accomplish the intended purpose.
2.4 Business Associate will not use or disclose PHI other than as permitted by this BAA or as Required by Law, and will not sell PHI or use or disclose PHI for marketing purposes prohibited by HIPAA.
3. SAFEGUARDS
Business Associate will: (a) use appropriate administrative, physical, and technical safeguards, and comply with the Security Rule (45 C.F.R. Part 164, Subpart C) with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this BAA; and (b) ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to restrictions and conditions at least as protective as those in this BAA.
4. SUBCONTRACTORS
Covered Entity acknowledges and agrees that Business Associate uses third-party service providers to deliver the Services, including cloud hosting and infrastructure providers and AI model providers, and that such providers may process PHI as Subcontractors. Business Associate will maintain a list of Subcontractors that process PHI, available upon written request, and may update the list from time to time. Business Associate remains responsible for its Subcontractors' compliance with this BAA.
5. REPORTING
5.1 Security Incidents and Breaches. Business Associate will report to Covered Entity: (a) any Breach of Unsecured PHI without unreasonable delay and in no event later than ten (10) business days after discovery; and (b) any Security Incident of which it becomes aware, provided that this section constitutes notice, without further reporting, of routine unsuccessful attempts at unauthorized access (such as pings, port scans, and denied login attempts) that do not result in unauthorized access to PHI.
5.2 Content of Notice. The report will include, to the extent known and as it becomes available: the nature of the Breach, the types of PHI involved, the identification of affected individuals where practicable, and the steps being taken to investigate and mitigate.
5.3 Notification Responsibilities. As between the parties, Covered Entity is solely responsible for determining whether and how to notify affected individuals, HHS, the media, and any state regulators, and for the costs of such notifications, except to the extent a court or regulator of competent jurisdiction finally determines the Breach was caused by Business Associate's violation of this BAA. Business Associate will reasonably cooperate with Covered Entity's notification obligations.
5.4 No Waiver of Insurance. Nothing in this BAA requires either party to take any action that would void or impair its insurance coverage; each party may condition remediation offers on its insurer's consent.
6. INDIVIDUAL RIGHTS SUPPORT
To the extent Business Associate maintains PHI in a Designated Record Set: (a) Business Associate will, within fifteen (15) business days of written request from Covered Entity, make such PHI available to Covered Entity as necessary for Covered Entity to respond to an individual's request for access under 45 C.F.R. § 164.524; and (b) will make PHI available for amendment and incorporate amendments as directed by Covered Entity under 45 C.F.R. § 164.526. Business Associate will document and make available to Covered Entity the information required for an accounting of disclosures under 45 C.F.R. § 164.528. The parties acknowledge that Business Associate's systems are analytics copies of data whose system of record is Covered Entity's practice management system; individual rights requests are ordinarily fulfilled from the system of record.
7. ACCESS BY HHS
Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of HHS for purposes of determining compliance with HIPAA.
8. COVERED ENTITY OBLIGATIONS
Covered Entity will: (a) not request Business Associate to use or disclose PHI in any manner that would not be permissible under HIPAA if done by Covered Entity; (b) notify Business Associate of any limitation in its Notice of Privacy Practices, any changes in or revocation of individual permissions, and any restriction on use or disclosure of PHI it has agreed to, in each case to the extent it may affect Business Associate's use or disclosure; (c) maintain all rights and consents necessary to permit Business Associate and its Subcontractors to access and process the PHI made available through Covered Entity's systems; and (d) be responsible for the accuracy and lawfulness of PHI provided to Business Associate.
9. TERM AND TERMINATION
9.1 Term. This BAA takes effect on signature and continues until all PHI is returned or destroyed or the Agreement terminates, whichever is later.
9.2 Termination for Cause. Either party may terminate this BAA and the Agreement if the other party materially breaches this BAA and fails to cure within thirty (30) days of written notice, or immediately if cure is not possible.
9.3 Return or Destruction. Upon termination, Business Associate will return or destroy all PHI in its possession that it is feasible to return or destroy, within sixty (60) days. Where return or destruction is not feasible (including PHI in routine backups pending scheduled destruction), Business Associate will extend the protections of this BAA to such PHI and limit further use and disclosure to the purposes that make return or destruction infeasible, for as long as it is maintained.
10. LIABILITY; RELATIONSHIP TO THE AGREEMENT
10.1 THIS BAA IS SUBJECT TO THE DISCLAIMERS, EXCLUSIONS OF DAMAGES, AND LIMITATION OF LIABILITY IN THE AGREEMENT, WHICH APPLY TO CLAIMS ARISING UNDER OR RELATING TO THIS BAA TO THE FULLEST EXTENT PERMITTED BY LAW. NOTHING IN THIS SECTION LIMITS EITHER PARTY'S OBLIGATIONS UNDER HIPAA ITSELF.
10.2 Each party is independently responsible for its own compliance with HIPAA in its respective role. Nothing in this BAA creates an agency, partnership, or joint venture, and Business Associate is not the covered entity's workforce member.
10.3 No Third-Party Beneficiaries. Nothing in this BAA confers any right or remedy on any third party, including patients.
11. MISCELLANEOUS
11.1 Regulatory Amendment. The parties will amend this BAA as necessary to comply with changes to HIPAA. If the parties cannot agree on a required amendment within thirty (30) days, either party may terminate the Agreement on written notice.
11.2 Interpretation. Any ambiguity will be interpreted to permit compliance with HIPAA. In the event of a conflict between this BAA and the Agreement with respect to PHI, this BAA controls; in all other respects the Agreement controls (including Sections 12 and 13 of the Agreement, Limitation of Liability and Dispute Resolution, which apply to this BAA).
11.3 Governing Law; Disputes. Georgia law governs, and disputes are resolved as provided in the Agreement (binding arbitration in Atlanta; class-action waiver), except where HIPAA or other federal law controls.
DIGITAL SIGNATURE BLOCK
Name: [Signer Name]
Practice: [Practice Name]
Email: [Signer Email]
Date: [Date]
---