Business Associate Agreement

This Business Associate Agreement (the "Agreement") is between the Customer (the "Covered Entity") and Kintara Group ("Kintara", the "Business Associate"). Kintara provides an AI voice receptionist and outbound calling platform to the Covered Entity, and in doing so creates, receives, maintains and transmits Protected Health Information on its behalf.

This Agreement is intended to satisfy the business associate requirements of the Health Insurance Portability and Accountability Act of 1996 and the HITECH Act, and their implementing regulations at 45 CFR Parts 160 and 164 (together, "HIPAA"), in particular 45 CFR 164.504(e) and 164.314(a).

Capitalized terms not defined here (including Breach, Business Associate, Covered Entity, Designated Record Set, Individual, Protected Health Information, Required by Law, Secretary, Security Incident, Subcontractor and Unsecured Protected Health Information) have the meanings given in HIPAA. "PHI" means Protected Health Information, including electronic PHI, that Kintara creates, receives, maintains or transmits for or on behalf of the Covered Entity under the services agreement between the parties.

Kintara Group may use and disclose PHI only to provide the services described in the services agreement (answering and placing calls, scheduling, messaging, transcription and related support), as permitted or required by this Agreement, or as Required by Law. Kintara Group will not use or disclose PHI in a way that would violate 45 CFR Part 164 Subpart E if done by the Covered Entity, except that Kintara Group may use PHI for its own proper management and administration and to carry out its legal responsibilities, and may disclose it for those purposes if disclosure is Required by Law or the recipient gives reasonable assurances of confidentiality and prompt notice of any breach of confidentiality.

Kintara Group will limit uses, disclosures and requests of PHI to the minimum necessary, will not sell PHI or use it for marketing or fundraising, and will not use PHI to train models for the benefit of anyone other than the Covered Entity. De-identification of PHI is permitted only if it meets 45 CFR 164.514(b) and the Covered Entity has approved it in writing.

Kintara Group will use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 CFR Part 164 (164.308, 164.310, 164.312, 164.314 and 164.316) with respect to electronic PHI, to prevent use or disclosure of PHI other than as this Agreement provides. These include encryption of PHI in transit and at rest, role-based access limited to people who need it, multi-factor authentication for staff, audit logging of access to PHI, a documented risk analysis and workforce training.

Kintara Group will report to the Covered Entity at its designated contact any use or disclosure of PHI not permitted by this Agreement, any Security Incident, and any Breach of Unsecured PHI (45 CFR 164.410), without unreasonable delay and in any case no later than 10 business days after discovery. The report will include, to the extent known, the individuals affected, what happened, the PHI involved, and the steps taken or planned to contain and mitigate the harm, and will be supplemented as more is learned. Reports to Kintara's privacy team can be sent to privacy@kintaragroup.com.

Unsuccessful attempts such as pings, port scans and blocked log-in attempts need no separate report. Kintara Group will mitigate, to the extent practicable, any harmful effect of a use or disclosure of PHI that violates this Agreement.

Kintara may use sub-processors that handle Protected Health Information, currently Supabase, Vercel, Vapi, Twilio, Telnyx, Deepgram, ElevenLabs, OpenAI, Anthropic, Resend and Stripe. Kintara has entered into, or will enter into before disclosure, written agreements with each of them that bind them to restrictions and conditions at least as protective as those in this Agreement (45 CFR 164.502(e)(1)(ii) and 164.308(b)(2)). Kintara remains responsible for its sub-processors' compliance.

Within 15 days of a request from the Covered Entity, Kintara Group will make PHI in a Designated Record Set available for access (45 CFR 164.524), make it available for amendment and incorporate amendments (45 CFR 164.526), and provide the information needed to account for disclosures (45 CFR 164.528). If an Individual contacts Kintara Group directly, Kintara Group will forward the request promptly and will not respond on the Covered Entity's behalf unless instructed.

Kintara Group will make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary for determining compliance with HIPAA, and will cooperate with reasonable requests from Kintara to demonstrate its compliance with this Agreement.

This Agreement starts on the date it is signed and continues while Kintara Group handles PHI under the services agreement. Either party may terminate it if the other materially breaches it and does not cure the breach within 30 days of written notice; if cure is not possible, the non-breaching party may terminate immediately. Revoking this Agreement in the Kintara platform ends the services that depend on PHI.

On termination, Kintara Group will return or destroy all PHI it still holds, including copies held by subcontractors, within 60 days, and will certify this in writing on request. If return or destruction is not feasible, Kintara Group will extend the protections of this Agreement to that PHI and limit further use and disclosure to the purposes that make return or destruction infeasible, for as long as it keeps the PHI.

If HIPAA changes in a way that requires a change to this Agreement, the parties will amend it as needed to comply. Any ambiguity is resolved in favor of a meaning that complies with HIPAA. This Agreement prevails over any conflicting term of the services agreement as to PHI. Nothing in it creates third-party beneficiary rights, and it may not be assigned without the other party's written consent except to a successor to the whole business. The parties' obligations that by their nature continue after termination survive it.

Questions about this Agreement can be sent to privacy@kintaragroup.com. By signing electronically, the signer confirms that they are authorized to bind the Customer and that the electronic signature, together with the recorded time, address and version, has the same effect as a handwritten one.