Business Associate Agreement

Recitals

This Business Associate Agreement (“BAA”) is entered into between claima.io (“Business Associate” or “Claima”), a medical billing platform, and the covered entity or other business associate that has accepted these terms (“Covered Entity”) (each a “Party,” collectively the “Parties”).

The Parties enter into this BAA to satisfy the requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and the regulations promulgated thereunder (collectively, “HIPAA Rules”).

1. Definitions

Capitalized terms not otherwise defined herein have the meanings given in 45 C.F.R. Parts 160 and 164.

• “PHI” means Protected Health Information as defined in 45 C.F.R. § 160.103.
• “ePHI” means Electronic Protected Health Information.
• “Services” means the medical billing, claim submission, denial management, eligibility verification, and related services provided by Claima to Covered Entity.
• “Breach” has the meaning set forth in 45 C.F.R. § 164.402.
• “Security Incident” has the meaning set forth in 45 C.F.R. § 164.304.

2. Permitted Uses and Disclosures of PHI

Business Associate may use and disclose PHI only as follows:

• As necessary to perform the Services for or on behalf of Covered Entity, as described in the service agreement between the Parties.
• As required by law.
• For the proper management and administration of Business Associate's operations, provided that any such disclosures are required by law or Business Associate obtains reasonable assurances from the recipient that the PHI will be held confidentially.
• To report violations of law to appropriate authorities, as permitted by 45 C.F.R. § 164.502(j)(1).

Business Associate shall not use or disclose PHI for any purpose other than those set forth in this BAA or as otherwise required or permitted by the HIPAA Rules.

3. Safeguards

Business Associate shall:

• Implement and maintain appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of ePHI, in accordance with 45 C.F.R. Part 164, Subpart C (Security Rule).
• Encrypt all ePHI in transit using TLS 1.2 or higher and at rest using industry-standard encryption.
• Implement access controls so that only authorized workforce members may access PHI.
• Maintain an audit log of access to and changes in PHI systems.
• Conduct regular risk assessments and implement risk management measures.

4. Reporting

Breach Notification: Business Associate shall notify Covered Entity without unreasonable delay, and in no event later than thirty (30) calendar days after discovery, of any Breach of Unsecured PHI, as required by 45 C.F.R. § 164.410.

Security Incidents: Business Associate shall report to Covered Entity any Security Incident of which Business Associate becomes aware. Unsuccessful attempts at unauthorized access, use, disclosure, modification, or destruction of ePHI occur routinely; by accepting this BAA, Covered Entity agrees that this paragraph constitutes ongoing notice of such unsuccessful attempts.

5. Subcontractors

Business Associate shall ensure that any subcontractor or agent that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees to the same restrictions and conditions that apply to Business Associate through a written agreement that complies with the HIPAA Rules. Current subprocessors that may handle PHI are: Microsoft Corporation (Azure — application hosting, database, secrets management, and transactional email), Amazon Web Services, Inc. (Amazon Bedrock — AI inference), Microsoft Corporation (Azure OpenAI Service — AI inference, standby), and Claim.MD, Inc. (clearinghouse — claim submission, remittance, and eligibility). Stripe, Inc. processes payments and, consistent with 45 C.F.R. § 164.502(a) and HIPAA § 1179, receives no diagnosis, procedure, date of service, date of birth, or member identifier, and is therefore not a subprocessor of PHI. Claima will maintain and make available a current list of subprocessors upon request.

6. Individual Rights

To the extent Business Associate maintains a Designated Record Set, Business Associate shall:

• Provide Covered Entity access to PHI necessary for Covered Entity to respond to individuals' requests for access under 45 C.F.R. § 164.524.
• Incorporate any amendments to PHI as directed by Covered Entity under 45 C.F.R. § 164.526.
• Provide Covered Entity with information necessary to respond to accounting of disclosures requests under 45 C.F.R. § 164.528.

7. Minimum Necessary

Business Associate shall use, disclose, or request only the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure, or request.

8. Term and Termination

Term: This BAA is effective as of the date Covered Entity accepts these terms and shall continue until terminated as provided herein.

Termination for Cause: Either Party may terminate this BAA, effective immediately, if the other Party materially breaches a provision of this BAA and does not cure such breach within thirty (30) days of written notice.

Effect of Termination: Upon termination, Business Associate shall, at Covered Entity's election, return or destroy all PHI received from, or created or received on behalf of, Covered Entity that Business Associate still maintains. If return or destruction is infeasible, Business Associate shall continue to protect such PHI in accordance with this BAA.

9. Miscellaneous

• Amendment: Claima reserves the right to amend this BAA from time to time. Continued use of the Services following notice of a material change constitutes acceptance of the amended BAA.
• Interpretation: Any ambiguity in this BAA shall be resolved in favor of a meaning that permits the Parties to comply with the HIPAA Rules.
• Survival: The obligations of Business Associate under Section 8 (Term and Termination) shall survive termination of this BAA.
• No Third-Party Beneficiaries: Nothing in this BAA shall confer any rights or remedies upon any person other than the Parties and their respective successors and permitted assigns.
• Governing Law: This BAA shall be governed by applicable federal law, including HIPAA and HITECH, and the laws of the state in which Covered Entity's principal place of business is located.

10. Acceptance

By checking the “I accept the Business Associate Agreement” checkbox during account creation, or by clicking “Accept BAA” in the Claima application, Covered Entity agrees to be bound by the terms of this BAA. The person accepting on behalf of the Covered Entity represents and warrants that they have authority to bind the Covered Entity.

This electronic acceptance constitutes a valid and binding agreement under the Electronic Signatures in Global and National Commerce Act (E-SIGN) and applicable state laws on electronic signatures.