Business Associate Agreement

This Business Associate Agreement ("BAA") is entered into as of [Effective Date] by and between:

• Covered Entity: [Covered Entity Name], a [State] [entity type] ("Covered Entity"); and
• Business Associate: SSP DEVELOPMENT LLC, d/b/a UM-AI, a Florida limited liability company ("Business Associate").

This BAA is incorporated into and made part of the [Reference to MSA / Subscription Agreement / SOW] ("Underlying Agreement") between the parties.

Capitalized terms used but not defined in this BAA have the meanings ascribed to them under HIPAA. As used herein:

• "Breach" has the meaning set forth at 45 CFR § 164.402.
• "Business Associate" has the meaning set forth at 45 CFR § 160.103.
• "Covered Entity" has the meaning set forth at 45 CFR § 160.103.
• "HIPAA" means the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health (HITECH) Act, together with all implementing regulations, including the Privacy Rule (45 CFR Part 164, Subparts A and E), the Security Rule (45 CFR Part 164, Subparts A and C), and the Breach Notification Rule (45 CFR Part 164, Subpart D), each as amended from time to time.
• "PHI" means Protected Health Information as defined at 45 CFR § 160.103, limited to PHI created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity.
• "Security Incident" has the meaning set forth at 45 CFR § 164.304.
• "Subcontractor" means a person to whom Business Associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of Business Associate.
• "Unsecured PHI" has the meaning set forth at 45 CFR § 164.402.

Business Associate may Use PHI for the proper management and administration of Business Associate or to carry out its legal responsibilities. Business Associate may Disclose PHI for such purposes if:

• The Disclosure is Required by Law; or
• Business Associate obtains reasonable assurances, in writing, from the person to whom the Disclosure is made that the PHI will be held confidentially and Used or further Disclosed only as Required by Law or for the purpose for which it was Disclosed, and that the person will notify Business Associate of any instances of which it becomes aware in which the confidentiality of the PHI has been breached.

Covered Entity shall:

• Notify Business Associate of any restriction on the Use or Disclosure of PHI that Covered Entity has agreed to or is required to abide by under the Privacy Rule, to the extent such restriction may affect Business Associate's Use or Disclosure of PHI.
• Not request that Business Associate Use or Disclose PHI in any manner that would not be permissible under the Privacy Rule if done by Covered Entity.
• Obtain any Authorization required by the Privacy Rule before disclosing PHI to Business Associate for Use or Disclosure that requires such Authorization.
• Notify Business Associate of any changes in, or revocation of, an Individual's Authorization, to the extent such changes may affect Business Associate's Use or Disclosure of PHI.

6.1 Term. This BAA shall commence on the Effective Date and shall remain in effect until the Underlying Agreement terminates, unless earlier terminated under this Section 6. The obligations of Business Associate under Sections 2 and 7 shall survive termination of this BAA.

6.2 Termination for Cause. Upon Covered Entity's knowledge of a material breach of this BAA by Business Associate, Covered Entity shall provide Business Associate with written notice of the breach and a thirty (30) day period to cure. If Business Associate fails to cure within that period, Covered Entity may immediately terminate this BAA and the Underlying Agreement. If termination is not feasible, Covered Entity shall report the breach to the Secretary of HHS.

6.3 Effect of Termination. Upon termination of this BAA for any reason, Business Associate shall, at Covered Entity's election, either return or destroy all PHI received from, or created or received by Business Associate on behalf of, Covered Entity. If return or destruction is not feasible, Business Associate shall continue to extend the protections of this BAA to PHI and limit further Use or Disclosure to those purposes that make return or destruction infeasible. Business Associate shall provide written certification of return or destruction within thirty (30) days of termination.

8.1 No Third-Party Beneficiaries. Nothing in this BAA confers upon any person other than the parties any rights, remedies, or obligations of any nature whatsoever.

8.2 Regulatory References. A reference in this BAA to a section of HIPAA means the section as in effect or as amended from time to time. The parties agree to take such action as is necessary to amend this BAA to comply with HIPAA amendments promptly upon notice.

8.3 Amendments. This BAA may be amended only by a writing signed by both parties.

8.4 Interpretation. Any ambiguity in this BAA shall be resolved in favour of a meaning that permits the parties to comply with HIPAA.

8.5 Severability. If any provision of this BAA is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.

8.6 Governing Law. This BAA shall be governed by HIPAA and applicable federal law. State law applies to the extent not preempted by federal law.

8.7 Integration. This BAA, together with the Underlying Agreement, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior negotiations, representations, and agreements relating to such subject matter.

8.8 Counterparts; Electronic Signatures. This BAA may be executed in counterparts and by electronic signature, each of which shall be deemed an original and all of which together shall constitute one and the same instrument.