HIPAA Business Associate Agreement

Between:
Covered Entity (“Practice”): [The referring practice]
Business Associate: Verora AI, Inc. (“Verora AI”)

1. Purpose. This Business Associate Agreement (“BAA”) is entered into to comply with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the HITECH Act, and their implementing regulations at 45 CFR Parts 160 and 164 (the “HIPAA Rules”). This BAA supplements the Terms of Service.

2. Definitions. “Protected Health Information” (“PHI”) means individually identifiable health information as defined in 45 CFR 160.103. “Electronic PHI” (“ePHI”) means PHI in electronic media.

3. Business Associate Obligations.

3.1 Permitted Uses. Business Associate shall use or disclose PHI only as permitted by this BAA, the Terms of Service, or as required by law. Business Associate shall not use PHI in a manner that would violate the HIPAA Rules if done by the Covered Entity.

3.2 Safeguards. Business Associate implements administrative, physical, and technical safeguards to protect ePHI, including:

• Encryption at Rest: AES-256-GCM for all cached data.
• Encryption in Transit: TLS 1.3 for all transmissions.
• Zero PHI at Rest: Patient data is processed in encrypted temporary cache only. No PHI is persisted to permanent storage or databases.
• Access Controls: Role-based authentication with full audit logging.
• Automatic Expiration: All cached patient data expires within 24 hours.

3.3 Breach Notification. Business Associate shall report any Breach of Unsecured PHI to Covered Entity without unreasonable delay, and no later than 60 calendar days after discovery.

3.4 Subcontractors. Business Associate ensures that subcontractors handling PHI agree to the same restrictions. Current subprocessors include: an EDI clearinghouse provider, an encrypted cache provider, and a cloud compute platform.

3.5 Individual Rights. Business Associate shall make PHI available for access (45 CFR 164.524), amendment (45 CFR 164.526), and accounting of disclosures (45 CFR 164.528) as required.

3.6 Government Access. Business Associate shall make practices, books, and records available to the Secretary of HHS for compliance determinations.

4. Covered Entity Obligations. Covered Entity shall notify Business Associate of privacy practice limitations, authorization changes, and shall not request uses of PHI not permitted under the HIPAA Rules.

5. Term and Termination. This BAA is effective upon signing and continues for the service relationship duration. Either party may terminate for material breach with 30 days written notice. Upon termination, Business Associate shall return or destroy all PHI, or extend BAA protections to retained PHI.

6. Miscellaneous. This BAA may only be amended in writing. Governed by Delaware law. Together with the Terms of Service, this constitutes the entire agreement.