BUSINESS ASSOCIATE AGREEMENT

(a) NoteMD is allowed to use or share Protected Health Information solely as authorized by this Agreement or as mandated by law. Beyond the specific provisions outlined here, NoteMD is prohibited from using or disclosing Protected Health Information in a way that would breach the HIPAA Security and Privacy Rule if conducted by Covered Entity. In particular, NoteMD is permitted to use or disclose Protected Health Information (1) to fulfill its duties under any contracts that demonstrate the business relationship between the Parties, or (2) as necessitated by any applicable law, regulation, or by any accrediting or credentialing body that requires Covered Entity to provide such information, or (3) as otherwise allowed within this Agreement, the business relationship between the Parties (provided it aligns with this Agreement and the HIPAA Security and Privacy Rule), or the HIPAA Security and Privacy Rule, or (4) in a manner that would be allowable under the HIPAA Security and Privacy Rule if such action were taken by Covered Entity.

(b) NoteMD is permitted to de-identify Protected Health Information solely upon the explicit instruction of and for the benefit of Covered Entity. NoteMD is prohibited from selling Protected Health Information unless directed by Covered Entity and in accordance with the HIPAA Security and Privacy Rule.

(c) Despite the restrictions outlined in this Agreement, NoteMD may:

(i) Utilize Protected Health Information for the essential management and administrative operations of NoteMD or to fulfill NoteMD's legal obligations;

(ii) Reveal Protected Health Information for the essential management and administrative operations of NoteMD or to fulfill NoteMD's legal obligations, provided that for any such disclosure (A) The disclosure is legally required; or (B) NoteMD secures verifiable assurances from the recipient that the information will be kept confidential and only used or further disclosed as required by law or for the purpose for which it was disclosed to the recipient, and the recipient informs NoteMD of any known breaches of confidentiality;

(iii) Offer data aggregation services related to the health care operations of Covered Entity under any contracts between the Parties that reflect their business association. Within the context of this Agreement, data aggregation refers to the process by which NoteMD combines Protected Health Information with the Protected Health Information received by NoteMD in its role as a business associate of another covered entity, enabling data analysis that pertains to the health care operations of the involved covered entities.

(a) NoteMD commits to not utilizing or disclosing Protected Health Information except as allowed or mandated by this Agreement or as required by law. When NoteMD is fulfilling Covered Entity's duties under the HIPAA Security and Privacy Rule, NoteMD will adhere to the relevant sections of the HIPAA Security and Privacy Rule as though such actions were undertaken by Covered Entity. Covered Entity will refrain from instructing NoteMD to use or disclose Protected Health Information in any way that would contravene the HIPAA Security and Privacy Rule if performed by Covered Entity, except as specifically outlined in this Agreement. NoteMD agrees to follow Covered Entity's guidelines on the minimal necessary use or disclosure of Protected Health Information.

(b) NoteMD commits to conducting HIPAA training for all its staff who manage Covered Entity’s account or who will have access to Covered Entity’s Protected Health Information.

(c) Upon the conclusion of this Agreement, the business relationship between the Parties, or at the request of Covered Entity, whichever comes first, NoteMD will, if feasible, return (following a process approved by Covered Entity) or destroy all Protected Health Information obtained from Covered Entity, or created, held, or received by NoteMD on behalf of Covered Entity, that NoteMD still possesses in any format, retaining no copies. If return or destruction is not feasible, NoteMD will (i) keep only the Protected Health Information that is necessary under the circumstances; (ii) return or destroy the remaining Protected Health Information in any format that NoteMD still possesses; (iii) extend this Agreement's protections to the kept Protected Health Information; (iv) restrict further uses and disclosures to those situations that make the return or destruction unfeasible; and (v) return or destroy the kept Protected Health Information when it is no longer needed by NoteMD. This clause will survive this Agreement's termination and applies to Protected Health Information created, held, or received by NoteMD and its subcontractors.

(d) NoteMD ensures that its agents, including subcontractors, that create, receive, maintain, or transmit Protected Health Information on behalf of NoteMD, adhere to the same (or more stringent) restrictions and conditions as NoteMD regarding such information, and implement suitable safeguards to protect any Electronic Protected Health Information. NoteMD commits to formalizing agreements with any subcontractors in alignment with the HIPAA Security and Privacy Rule and will take reasonable measures to prevent its employees’ actions or inactions from causing NoteMD to breach this Agreement.

(e) NoteMD will enact appropriate measures to prevent the use or disclosure of Protected Health Information other than as authorized by this Agreement. NoteMD will implement administrative, physical, and technical safeguards to reasonably and appropriately protect the confidentiality, integrity, and availability of any Electronic Protected Health Information it creates, receives, maintains, or transmits on behalf of Covered Entity as required by the HIPAA Security and Privacy Rule.

(f) Where relevant, NoteMD will comply with (i) Covered Entity’s Notice of Privacy Practices; (ii) any limitations that Covered Entity has consented to regarding an Individual’s authorization to use or disclose his or her Protected Health Information; and (iii) any use or disclosure restrictions of Protected Health Information to which Covered Entity has agreed or is obliged to agree.

(g) NoteMD will make available its internal practices, records, and books to the Secretary of the Department of Health and Human Services for the purpose of verifying compliance with the HIPAA Security and Privacy Rule provisions, and upon the Secretary's request, will cooperate with any investigations, compliance reviews, permit information access, and collaborate with any complaints as legally required. Without undue delay and not exceeding 48 hours after receiving the request or notification, NoteMD will inform Covered Entity in writing about any request by a governmental entity, or its delegate, to examine NoteMD’s compliance with the law or this BAA, to address a complaint, or to conduct any audit or assessment.

(h) NoteMD shall notify Covered Entity of any use or disclosure of Protected Health Information not in accordance with this Agreement's terms, as well as any Security Incident or any actual or suspected Breach, of which it becomes aware, without undue delay and no later than three business days following such discovery. Security Incidents and Breaches are considered discovered by NoteMD on the first day they are known to NoteMD or, with reasonable diligence, would have been known to NoteMD. Notifications to Covered Entity will include the details required by 45 C.F.R. § 164.410. Additionally, NoteMD commits to mitigating, as far as practicable, any adverse effect known to NoteMD resulting from a use or disclosure of Protected Health Information by NoteMD in violation of this Agreement's requirements, and to fully cooperate with Covered Entity in case of a review or investigation of such noncompliance or Security Incident.

NoteMD will assist in Covered Entity's breach analysis and/or risk assessment if requested and will collaborate with Covered Entity if it is determined that third parties must be informed of a Breach, provided that NoteMD shall not issue any

(a) NoteMD commits to providing access to Protected Health Information within a Designated Record Set to Covered Entity as necessary and in the manner stipulated by Section 164.524 of the HIPAA Security and Privacy Rule.

(b) NoteMD agrees to make available Protected Health Information within a Designated Record Set for amendment purposes and to integrate any changes to Protected Health Information as dictated by Section 164.526 of the HIPAA Security and Privacy Rule and following the instructions of Covered Entity.

(c) NoteMD shall keep and provide access to the information required for an accounting of disclosures, in line with Section 164.528 of the HIPAA Security and Privacy Rule. NoteMD will adhere to Covered Entity's guidelines concerning the accounting of disclosures.

(d) NoteMD consents to abide by any requests for limitations on specific disclosures of Protected Health Information according to Section 164.522 of the HIPAA Security and Privacy Rule, to which Covered Entity has consented and of which NoteMD has been informed by Covered Entity.

(e) Should an Individual directly approach NoteMD with a request under this Section IV, NoteMD will inform Covered Entity of such request in writing within three (3) business days and will collaborate with, and act according to, Covered Entity's instructions in addressing the request.

This Agreement becomes effective from the date initially mentioned above and will end at the earlier occurrence of (i) the conclusion of all contracts between the parties, or (ii) the termination by Covered Entity on grounds specified in this document. Despite any provisions in this Agreement, Covered Entity is entitled to immediately terminate this Agreement if it determines that NoteMD has breached any essential condition of this Agreement. If Covered Entity has a reasonable belief that NoteMD is likely to breach an important term of this Agreement and, where feasible, notifies NoteMD in writing of such belief within a reasonable timeframe after having this belief, and NoteMD does not provide satisfactory written assurances to Covered Entity that it will not violate the specified term of this Agreement within a reasonable timeframe considering the particular situation, but in any case, before the anticipated breach occurs, then Covered Entity reserves the right to immediately terminate this Agreement.

Beyond what is explicitly stated in this document or the HIPAA Security and Privacy Rule, this Agreement does not aim to bestow any rights upon third-party individuals. The responsibilities of NoteMD under this Agreement shall outlast the expiration, termination, or cancellation of this Agreement and/or the business relationship between the Parties, continuing to obligate NoteMD, along with its agents, employees, contractors, successors, and assigns as described herein.

Amendments or modifications to this Agreement must be made through a written document signed by both Parties. Neither Party can transfer their rights and duties under this Agreement without the written approval of the other Party. This Agreement does not intend to, nor shall it be construed to, create any partnership, joint venture, agency, franchise, or employment relationship between the Parties, other than the relationship of independent entities contracting with each other solely to carry out the provisions of this Agreement and any other agreements that reflect their business relationship.

This Agreement shall be governed by the laws of the State of California. Any waiver, change, or discharge of any liability or obligation under this Agreement on one or multiple instances will not be considered a waiver of any ongoing or different obligation, nor will it prevent the enforcement of any obligation at any other time.

In the case where any documentation of the arrangement under which NoteMD offers services to Covered Entity includes clauses on the use or disclosure of Protected Health Information that are stricter than those in this Agreement, those stricter provisions shall prevail. The clauses of this Agreement are designed to set the minimum standards for NoteMD's use and disclosure of Protected Health Information.

Should any clause of this Agreement be deemed invalid or unenforceable by a competent court, the remaining clauses shall continue to be valid and enforceable. Furthermore, if either party sincerely believes that any part of this Agreement does not comply with the current requirements of the HIPAA Security and Privacy Rule, they must notify the other party in writing. The parties will then have up to thirty days to collaboratively address and possibly amend the Agreement to ensure compliance. If, after this thirty-day period, either party still sincerely believes the Agreement does not comply with the HIPAA Security and Privacy Rule, either party may terminate the Agreement upon written notice to the other party.

(a) NoteMD is allowed to use or share Protected Health Information solely as authorized by this Agreement or as mandated by law. Beyond the specific provisions outlined here, NoteMD is prohibited from using or disclosing Protected Health Information in a way that would breach the HIPAA Security and Privacy Rule if conducted by Covered Entity. In particular, NoteMD is permitted to use or disclose Protected Health Information (1) to fulfill its duties under any contracts that demonstrate the business relationship between the Parties, or (2) as necessitated by any applicable law, regulation, or by any accrediting or credentialing body that requires Covered Entity to provide such information, or (3) as otherwise allowed within this Agreement, the business relationship between the Parties (provided it aligns with this Agreement and the HIPAA Security and Privacy Rule), or the HIPAA Security and Privacy Rule, or (4) in a manner that would be allowable under the HIPAA Security and Privacy Rule if such action were taken by Covered Entity.

(b) NoteMD is permitted to de-identify Protected Health Information solely upon the explicit instruction of and for the benefit of Covered Entity. NoteMD is prohibited from selling Protected Health Information unless directed by Covered Entity and in accordance with the HIPAA Security and Privacy Rule.

(c) Despite the restrictions outlined in this Agreement, NoteMD may: