Business Associate Agreement

This Business Associate Agreement ("BAA") is entered into as of the Effective Date (defined below) by and between Unisona Health Inc, a Wyoming corporation ("Business Associate"), and the individual or entity that creates a Unisona Health account or otherwise accepts this BAA ("Customer"). Business Associate and Customer are each a "Party" and together the "Parties."

Recitals

WHEREAS, Customer is either (a) a "covered entity" or (b) a "business associate" of one or more covered entities, as those terms are defined under the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), as amended ("HIPAA"), and the Health Information Technology for Economic and Clinical Health Act (the "HITECH Act");

WHEREAS, Business Associate provides Services to Customer, and in providing the Services Business Associate may create, receive, maintain, or transmit Protected Health Information on behalf of Customer; and

WHEREAS, the Parties intend to protect the privacy and provide for the security of Protected Health Information in compliance with HIPAA, the HITECH Act, the HIPAA Rules, and other applicable law, and to satisfy the requirements of 45 C.F.R. §§ 164.314(a), 164.502(e), and 164.504(e).

NOW, THEREFORE, in consideration of the mutual promises below and other good and valuable consideration, the receipt and sufficiency of which are acknowledged, the Parties agree as follows:

Article I — Definitions

Capitalized terms used but not defined in this BAA have the meanings given in the HIPAA Rules. References to a section of the HIPAA Rules mean that section as in effect or as amended.

• "Breach" has the meaning given in 45 C.F.R. § 164.402.
• "Data Aggregation" has the meaning given in 45 C.F.R. § 164.501.
• "Designated Record Set" has the meaning given in 45 C.F.R. § 164.501.
• "Effective Date" means the earlier of (a) the date Customer creates a Unisona Health account or electronically accepts this BAA, and (b) the date Business Associate first creates, receives, maintains, or transmits PHI on behalf of Customer.
• "HIPAA Rules" means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Parts 160 and 164.
• "Individual" has the meaning given in 45 C.F.R. § 160.103 and includes a person who qualifies as a personal representative under 45 C.F.R. § 164.502(g).
• "Protected Health Information" or "PHI" has the meaning given in 45 C.F.R. § 160.103, limited to information created, received, maintained, or transmitted by Business Associate on behalf of Customer. PHI includes Electronic Protected Health Information ("ePHI").
• "Required by Law" has the meaning given in 45 C.F.R. § 164.103.
• "Secretary" means the Secretary of the U.S. Department of Health and Human Services or the Secretary's designee.
• "Security Incident" has the meaning given in 45 C.F.R. § 164.304.
• "Services" means the services Business Associate provides to Customer under the Underlying Agreement.
• "Subcontractor" has the meaning given in 45 C.F.R. § 160.103.
• "Underlying Agreement" means the Unisona Health Terms & Conditions, any Customer Agreement or order form, and any other agreement between the Parties under which Business Associate provides Services, each as in effect from time to time.
• "Unsecured PHI" has the meaning given in 45 C.F.R. § 164.402.

Article II — Permitted Uses and Disclosures

2.1 Services

Business Associate may use and disclose PHI only as necessary to perform the Services, as permitted or required by this BAA, or as Required by Law.

2.2 Management and Administration

Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities. Business Associate may disclose PHI for those purposes only if (a) the disclosure is Required by Law, or (b) Business Associate obtains reasonable assurances from the recipient that the PHI will be held confidentially and used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and the recipient agrees to notify Business Associate of any instance of which it is aware in which the confidentiality of the PHI has been breached.

2.3 Data Aggregation

Business Associate may use PHI to provide Data Aggregation services relating to the health care operations of Customer (or, where Customer is a business associate, of the applicable covered entity), as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B).

2.4 De-identification

Business Associate may de-identify PHI in accordance with 45 C.F.R. § 164.514(a)–(c). De-identified information is not PHI and is not subject to this BAA, and Business Associate may use it for any lawful purpose, including analytics and improving its services, except that Business Associate will not use PHI, or information de-identified from PHI, to train, fine-tune, or otherwise develop artificial intelligence or machine learning models.

2.5 Minimum Necessary

Business Associate will limit its uses, disclosures, and requests for PHI to the minimum necessary to accomplish the intended purpose, in accordance with 45 C.F.R. § 164.502(b) and any guidance issued by the Secretary.

2.6 Limitation

Except as permitted in Sections 2.2 through 2.4, Business Associate will not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Customer.

2.7 No Sale of PHI; No Marketing or Fundraising

Business Associate will not (a) directly or indirectly receive remuneration in exchange for PHI except as permitted by 45 C.F.R. § 164.502(a)(5)(ii), or (b) use or disclose PHI for marketing or fundraising. Fees paid to Business Associate under the Underlying Agreement, including any fee calculated as a percentage of amounts recovered, are compensation for the Services and not remuneration in exchange for PHI.

Article III — Obligations of Business Associate

3.1 Safeguards

Business Associate will use appropriate administrative, physical, and technical safeguards, and will comply with Subpart C of 45 C.F.R. Part 164 with respect to ePHI, to prevent use or disclosure of PHI other than as provided by this BAA.

3.2 Reporting

(a) Non-permitted uses and Security Incidents. Business Associate will report to Customer in writing any use or disclosure of PHI not provided for by this BAA, and any Security Incident, of which it becomes aware, no later than three (3) business days after becoming aware of it.

(b) Unsuccessful attempts. The Parties agree that this Section constitutes notice by Business Associate to Customer of the ongoing existence and occurrence of attempted but unsuccessful Security Incidents, such as pings and other broadcast attacks on firewalls, port scans, unsuccessful log-on attempts, and denial-of-service attacks, so long as no such incident results in unauthorized access, use, or disclosure of PHI. No further notice of such unsuccessful attempts is required.

(c) Breaches of Unsecured PHI. Business Associate will notify Customer of any Breach of Unsecured PHI without unreasonable delay and in no event later than thirty (30) calendar days after discovery, as determined under 45 C.F.R. § 164.410(a)(2). The notice will include, to the extent known, the identification of each Individual whose Unsecured PHI has been, or is reasonably believed to have been, involved, and the other information Customer is required to include in notifications under 45 C.F.R. § 164.404(c). Business Associate will supplement the notice as information becomes available and will reasonably cooperate with Customer's investigation.

(d) Notification costs. If a Breach of Unsecured PHI results from Business Associate's breach of this BAA or the HIPAA Rules, Business Associate will reimburse Customer's reasonable, documented costs of notifications Required by Law, and of credit monitoring for affected Individuals for up to twelve (12) months where reasonably appropriate, subject to Section 6.3. Customer will control the content and timing of notifications to Individuals, the media, and the Secretary unless the Parties agree otherwise in writing.

3.3 Mitigation

Business Associate will mitigate, to the extent practicable, any harmful effect known to Business Associate of a use or disclosure of PHI by Business Associate or its Subcontractors in violation of this BAA.

3.4 Subcontractors

In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate will ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to the same restrictions, conditions, and requirements that apply to Business Associate under this BAA, including the requirement to implement appropriate safeguards. This includes any provider of artificial intelligence or machine learning services that processes PHI, as further provided in Section 3.13. Business Associate will make a list of its Subcontractors that process PHI available to Customer on request.

3.5 Access

To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate will, within fifteen (15) days after a request by Customer, make the PHI available to Customer, in the form and format requested where readily producible, as necessary for Customer to meet its obligations under 45 C.F.R. § 164.524.

3.6 Amendment

To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate will, within fifteen (15) days after a request by Customer, make the PHI available for amendment and incorporate any amendments as directed by Customer in accordance with 45 C.F.R. § 164.526.

3.7 Accounting of Disclosures

Business Associate will document disclosures of PHI, and information related to those disclosures, as would be required for Customer to respond to a request for an accounting under 45 C.F.R. § 164.528. Within thirty (30) days after a request by Customer, Business Associate will provide that information to Customer.

3.8 Requests from Individuals

If an Individual submits a request for access, amendment, or an accounting directly to Business Associate, Business Associate will forward the request to Customer within ten (10) business days. Customer is responsible for responding to the Individual.

3.9 Customer's Privacy Rule Obligations

To the extent Business Associate carries out one or more of Customer's obligations under Subpart E of 45 C.F.R. Part 164, Business Associate will comply with the requirements of Subpart E that apply to Customer in the performance of those obligations.

3.10 Books and Records

Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining compliance with the HIPAA Rules.

3.11 Security Assurances

On Customer's reasonable written request, not more than once per year, Business Associate will provide a written summary or attestation of its safeguards for ePHI. Business Associate will reasonably cooperate with any additional verification or notification requirements imposed on business associates by amendments to the HIPAA Rules.

3.12 Part 2 Records

To the extent Business Associate receives records subject to 42 C.F.R. Part 2, Business Associate acknowledges that it is fully bound by Part 2 with respect to those records, will not use or disclose them except as permitted by Part 2, and will resist in judicial proceedings any efforts to obtain access to them except as permitted by Part 2.

3.13 Artificial Intelligence

With respect to any artificial intelligence or machine learning features or services ("AI Services") used in performing the Services:

(a) Business Associate will use AI Services to process PHI only to perform the Services and as otherwise permitted by this BAA.

(b) Neither Business Associate nor any Subcontractor will use PHI, or information de-identified from PHI, to train, fine-tune, or otherwise develop artificial intelligence or machine learning models.

(c) Any third-party provider of AI Services that creates, receives, maintains, or transmits PHI will be a Subcontractor bound by Section 3.4 and by subsection (b) of this Section.

(d) Where a provider of AI Services offers settings that limit or prevent retention of PHI after processing, or human review of PHI by the provider, Business Associate will use those settings to the extent commercially available.

(e) On Customer's request, Business Associate will identify the providers of AI Services that process Customer's PHI.

Article IV — Obligations of Customer

4.1 Notice of Privacy Practices

Customer will notify Business Associate of any limitation in the notice of privacy practices applicable to the PHI, to the extent the limitation may affect Business Associate's use or disclosure of PHI.

4.2 Changes in Permission and Restrictions

Customer will notify Business Associate of (a) any change in, or revocation of, an Individual's permission to use or disclose PHI, and (b) any restriction on the use or disclosure of PHI that Customer has agreed to or must comply with under 45 C.F.R. § 164.522, in each case to the extent it may affect Business Associate's use or disclosure of PHI.

4.3 Permissible Requests

Customer will not request Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 C.F.R. Part 164 if done by Customer, except as permitted by Sections 2.2 through 2.4.

4.4 Minimum Necessary; Authority

Customer will provide Business Associate only the minimum PHI necessary for the Services and represents that it has obtained any consents or authorizations required for Business Associate to perform the Services.

4.5 Customer as Business Associate

If Customer is a business associate of a covered entity, Customer represents that its business associate agreement with that covered entity permits the disclosure of PHI to Business Associate for the Services, and Business Associate will be a Subcontractor of Customer under this BAA. Customer will notify Business Associate of any restriction in that agreement that is more stringent than this BAA.

Article V — Term and Termination

5.1 Term

This BAA begins on the Effective Date and continues until the Underlying Agreement terminates and all PHI has been returned, destroyed, or protected under Section 5.4, unless terminated earlier under Section 5.2.

5.2 Termination for Cause

If either Party determines that the other Party has violated a material term of this BAA, the non-breaching Party may give written notice describing the violation. If the breaching Party does not cure the violation within thirty (30) days after the notice, the non-breaching Party may terminate this BAA and the Underlying Agreement. If cure is not possible, the non-breaching Party may terminate immediately on written notice.

5.3 Effect on Underlying Agreement

Termination of this BAA terminates the portions of the Underlying Agreement under which Business Associate creates, receives, maintains, or transmits PHI. Termination of the Underlying Agreement terminates this BAA, subject to Sections 5.4 and 7.8.

5.4 Return or Destruction of PHI

Within thirty (30) days after termination, Business Associate will return to Customer or destroy all PHI that Business Associate or its Subcontractors maintain in any form, retain no copies, and certify destruction in writing on request. If Business Associate determines that return or destruction is infeasible (for example, PHI held in backup systems or subject to a legal hold or record retention obligation), Business Associate will notify Customer of the conditions that make return or destruction infeasible, extend the protections of this BAA to that PHI, and limit further uses and disclosures to those purposes that make return or destruction infeasible, for so long as Business Associate maintains the PHI.

Article VI — Indemnification and Limitation of Liability

6.1 Indemnification

Each Party (the "Indemnifying Party") will defend, indemnify, and hold harmless the other Party and its officers, directors, employees, and agents from and against third-party claims, and resulting losses, damages, fines, penalties, costs, and reasonable attorneys' fees, to the extent arising from (a) the Indemnifying Party's breach of this BAA, or (b) the negligence or willful misconduct of the Indemnifying Party or its workforce, agents, or Subcontractors in connection with PHI.

6.2 Procedure

The indemnified Party will (a) give the Indemnifying Party prompt written notice of the claim (provided that delay relieves the Indemnifying Party of its obligations only to the extent it is prejudiced), (b) allow the Indemnifying Party to control the defense and settlement, provided that no settlement imposing an admission of fault or non-monetary obligation on the indemnified Party may be made without its consent, not to be unreasonably withheld, and (c) provide reasonable cooperation at the Indemnifying Party's expense. The indemnified Party may participate with counsel of its choice at its own expense.

6.3 Limitation of Liability

EXCEPT FOR LIABILITY ARISING FROM A PARTY'S GROSS NEGLIGENCE, WILLFUL MISCONDUCT, OR FRAUD, (a) NEITHER PARTY WILL BE LIABLE UNDER THIS BAA FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, AND (b) EACH PARTY'S TOTAL LIABILITY ARISING OUT OF OR RELATING TO THIS BAA WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER TO BUSINESS ASSOCIATE UNDER THE UNDERLYING AGREEMENT IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM; PROVIDED THAT FOR CLAIMS ARISING FROM A BREACH OF UNSECURED PHI OR A SECURITY INCIDENT, INCLUDING COSTS UNDER SECTION 3.2(d), SUCH LIMIT WILL BE ONE MILLION DOLLARS ($1,000,000). This Section 6.3 governs over any limitation of liability or disclaimer in the Underlying Agreement with respect to claims arising out of this BAA.

6.4 No Limitation of Regulatory Obligations

Nothing in this Article VI limits either Party's obligations under the HIPAA Rules or any liability a Party may have directly to a governmental authority.

6.5 Insurance

Business Associate will maintain, during the term of this BAA, cyber liability insurance, including first-party and third-party coverage for privacy and network security events, with limits of not less than One Million Dollars ($1,000,000) in the aggregate, and will provide a certificate of insurance on request.

Article VII — General Provisions

7.1 Order of Precedence

This BAA is incorporated into the Underlying Agreement. If there is a conflict between this BAA and the Underlying Agreement with respect to PHI, this BAA controls.

7.2 Amendment

The Parties will amend this BAA as necessary to comply with changes to HIPAA, the HITECH Act, or the HIPAA Rules. Any provision required by a change in law that is mandatory for the Parties is deemed incorporated into this BAA as of its compliance date. Business Associate may otherwise update this BAA by giving Customer at least thirty (30) days' written notice; if Customer objects in writing during that period, Customer may terminate the Underlying Agreement and this BAA without penalty, and the prior version will govern until termination. Otherwise, this BAA may be amended only in a writing signed or electronically accepted by both Parties.

7.3 Interpretation

Any ambiguity in this BAA will be resolved to permit the Parties to comply with the HIPAA Rules. A reference to a regulation means that regulation as in effect or as amended.

7.4 Notices

Notices under this BAA must be in writing and delivered by email, nationally recognized courier, or certified mail. Notices to Business Associate must be sent to: Privacy and Security Officer, Unisona Health Inc, 2125 Biscayne Blvd, Suite 303, Miami, FL 33137, privacy@unisonahealth.com. Notices to Customer will be sent to the email address associated with Customer's account administrator, which Customer is responsible for keeping current. Email notice is effective when sent, absent a delivery failure message.

7.5 No Third-Party Beneficiaries

Nothing in this BAA confers any rights or remedies on any person other than the Parties and their permitted successors and assigns.

7.6 Relationship of the Parties

Business Associate is an independent contractor and is not an agent of Customer.

7.7 Assignment

Neither Party may assign this BAA except together with an assignment of the Underlying Agreement as permitted by the Underlying Agreement.

7.8 Survival

Sections 3.2 (as to incidents occurring before termination), 5.4, Article VI, and Sections 7.3, 7.4, 7.5, 7.8, 7.9, and 7.10 survive termination of this BAA, as do Business Associate's obligations with respect to any PHI it continues to maintain after termination.

7.9 Severability; Waiver

If any provision of this BAA is held invalid or unenforceable, the remaining provisions remain in full force. A failure to enforce any provision is not a waiver of it.

7.10 Governing Law and Venue

This BAA is governed by applicable federal law and, to the extent not preempted, the laws of the State of Wyoming, without regard to conflict-of-laws principles. The Parties consent to the exclusive jurisdiction of the state and federal courts located in the State of Wyoming for any action arising out of this BAA.

7.11 Electronic Acceptance; Counterparts

This BAA may be accepted electronically, including by creating an account or clicking to accept, and may be executed in counterparts, each of which is an original and all of which together are one instrument. Electronic acceptance has the same effect as a handwritten signature.