Business Associate Agreement

This Business Associate Agreement (the "Agreement") is between the Customer (the "Covered Entity") and the Agency (the "Business Associate", the "Agency"). The Agency provides an AI voice receptionist and related services to the Covered Entity using the Kintara platform operated by Kintara Group ("Kintara"). Kintara acts as the Agency's subcontractor and is named in this Agreement as a subcontractor business associate.

This Agreement is intended to satisfy the business associate requirements of the Health Insurance Portability and Accountability Act of 1996 and the HITECH Act, and their implementing regulations at 45 CFR Parts 160 and 164 (together, "HIPAA"), in particular 45 CFR 164.504(e) and 164.314(a).

Capitalized terms not defined here (including Breach, Business Associate, Covered Entity, Designated Record Set, Individual, Protected Health Information, Required by Law, Secretary, Security Incident, Subcontractor and Unsecured Protected Health Information) have the meanings given in HIPAA. "PHI" means Protected Health Information, including electronic PHI, that the Agency creates, receives, maintains or transmits for or on behalf of the Covered Entity under the services agreement between the parties.

the Agency may use and disclose PHI only to provide the services described in the services agreement (answering and placing calls, scheduling, messaging, transcription and related support), as permitted or required by this Agreement, or as Required by Law. the Agency will not use or disclose PHI in a way that would violate 45 CFR Part 164 Subpart E if done by the Covered Entity, except that the Agency may use PHI for its own proper management and administration and to carry out its legal responsibilities, and may disclose it for those purposes if disclosure is Required by Law or the recipient gives reasonable assurances of confidentiality and prompt notice of any breach of confidentiality.

the Agency will limit uses, disclosures and requests of PHI to the minimum necessary, will not sell PHI or use it for marketing or fundraising, and will not use PHI to train models for the benefit of anyone other than the Covered Entity. De-identification of PHI is permitted only if it meets 45 CFR 164.514(b) and the Covered Entity has approved it in writing.

the Agency will use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 CFR Part 164 (164.308, 164.310, 164.312, 164.314 and 164.316) with respect to electronic PHI, to prevent use or disclosure of PHI other than as this Agreement provides. These include encryption of PHI in transit and at rest, role-based access limited to people who need it, multi-factor authentication for staff, audit logging of access to PHI, a documented risk analysis and workforce training.

the Agency will report to the Covered Entity, copying privacy@kintaragroup.com any use or disclosure of PHI not permitted by this Agreement, any Security Incident, and any Breach of Unsecured PHI (45 CFR 164.410), without unreasonable delay and in any case no later than 10 business days after discovery. The report will include, to the extent known, the individuals affected, what happened, the PHI involved, and the steps taken or planned to contain and mitigate the harm, and will be supplemented as more is learned. Reports to Kintara's privacy team can be sent to privacy@kintaragroup.com.

Unsuccessful attempts such as pings, port scans and blocked log-in attempts need no separate report. the Agency will mitigate, to the extent practicable, any harmful effect of a use or disclosure of PHI that violates this Agreement.

The Agency may disclose Protected Health Information to Kintara and to Kintara's sub-processors, currently Supabase, Vercel, Vapi, Twilio, Telnyx, Deepgram, ElevenLabs, OpenAI, Anthropic, Resend and Stripe, only under written agreements that bind each of them to restrictions and conditions at least as protective as those in this Agreement (45 CFR 164.502(e)(1)(ii) and 164.308(b)(2)). The Agency has a Subcontractor Business Associate Agreement in force with Kintara and will keep it in force while this Agreement lasts.

Within 15 days of a request from the Covered Entity, the Agency will make PHI in a Designated Record Set available for access (45 CFR 164.524), make it available for amendment and incorporate amendments (45 CFR 164.526), and provide the information needed to account for disclosures (45 CFR 164.528). If an Individual contacts the Agency directly, the Agency will forward the request promptly and will not respond on the Covered Entity's behalf unless instructed.

the Agency will make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary for determining compliance with HIPAA, and will cooperate with reasonable requests from the Agency (and, through the Agency, Kintara) to demonstrate its compliance with this Agreement.

This Agreement starts on the date it is signed and continues while the Agency handles PHI under the services agreement. Either party may terminate it if the other materially breaches it and does not cure the breach within 30 days of written notice; if cure is not possible, the non-breaching party may terminate immediately. Revoking this Agreement in the Kintara platform ends the services that depend on PHI.

On termination, the Agency will return or destroy all PHI it still holds, including copies held by subcontractors, within 60 days, and will certify this in writing on request. If return or destruction is not feasible, the Agency will extend the protections of this Agreement to that PHI and limit further use and disclosure to the purposes that make return or destruction infeasible, for as long as it keeps the PHI.

If HIPAA changes in a way that requires a change to this Agreement, the parties will amend it as needed to comply. Any ambiguity is resolved in favor of a meaning that complies with HIPAA. This Agreement prevails over any conflicting term of the services agreement as to PHI. Nothing in it creates third-party beneficiary rights, and it may not be assigned without the other party's written consent except to a successor to the whole business. The parties' obligations that by their nature continue after termination survive it.

Questions about this Agreement can be sent to privacy@kintaragroup.com. By signing electronically, the signer confirms that they are authorized to bind the Customer and that the electronic signature, together with the recorded time, address and version, has the same effect as a handwritten one.