Business Associate Agreement

Preamble

This Business Associate Agreement ("BAA" or "Agreement") is entered into by and between the healthcare provider, health plan, or healthcare clearinghouse that has executed a subscription agreement or terms of service with Rymeda, Inc. (the "Covered Entity") and Rymeda, Inc., a Delaware corporation with its principal place of business in California (the "Business Associate"), collectively referred to as the "Parties."

This BAA is entered into pursuant to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), 42 U.S.C. §1320d et seq.; the HIPAA Privacy Rule at 45 CFR Part 164, Subpart E; the HIPAA Security Rule at 45 CFR Part 164, Subpart C; the HIPAA Breach Notification Rule at 45 CFR Part 164, Subpart D; and the Health Information Technology for Economic and Clinical Health Act ("HITECH"), 42 U.S.C. §17921 et seq., as amended from time to time (collectively, "HIPAA Rules").

WHEREAS, Business Associate provides clinical documentation, practice management, billing, AI-assisted charting, marketplace, and related healthcare technology services (the "Services") to Covered Entity as described in the Terms of Service; and

WHEREAS, in performing the Services, Business Associate may create, receive, maintain, or transmit Protected Health Information ("PHI") on behalf of Covered Entity; and

WHEREAS, the Parties wish to establish the terms and conditions under which Business Associate will use and disclose PHI in compliance with the HIPAA Rules;

NOW, THEREFORE, in consideration of the mutual promises and obligations set forth herein, the Parties agree as follows:

1. Definitions

Capitalized terms used but not otherwise defined in this BAA shall have the meanings assigned to them under 45 CFR §160.103 and §164.501. The following definitions apply:

2. Obligations of Business Associate

Business Associate (Rymeda, Inc.) agrees to the following obligations with respect to PHI created, received, maintained, or transmitted on behalf of Covered Entity:

2.1 Permitted Use and Disclosure Only

Business Associate shall not use or disclose PHI other than as permitted or required by this BAA or as Required By Law, in accordance with 45 CFR §164.504(e)(2)(i) and §164.504(e)(2)(ii)(A). Business Associate shall not use or disclose PHI in a manner that would violate the HIPAA Privacy Rule if done by Covered Entity, except as expressly permitted under Sections 2.1 and 3 of this BAA.

2.2 Appropriate Safeguards

Business Associate shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI that it creates, receives, maintains, or transmits on behalf of Covered Entity, in accordance with 45 CFR §164.308 (Administrative Safeguards), §164.310 (Physical Safeguards), and §164.312 (Technical Safeguards). Specific safeguards are detailed in Section 4 of this BAA.

2.3 Reporting of Unauthorized Use or Disclosure

Business Associate shall report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which Business Associate becomes aware, including any Breach of Unsecured PHI as required by 45 CFR §164.410. Specifically:

• Security Incidents: Business Associate shall report confirmed Security Incidents (as defined in Section 1.6) to Covered Entity within twenty-four (24) hours of discovery. Business Associate shall provide a written summary of attempted but unsuccessful Security Incidents on a quarterly basis upon Covered Entity's written request.
• Unauthorized Use or Disclosure: Business Associate shall report any unauthorized use or disclosure of PHI to Covered Entity within five (5) business days of discovery.
• Breaches: Business Associate shall report any Breach of Unsecured PHI to Covered Entity in accordance with Section 5 of this BAA, no later than thirty (30) calendar days after discovery of such Breach.

2.4 Subcontractor Agreements

In accordance with 45 CFR §164.502(e)(1)(ii) and 42 U.S.C. §17934(b), Business Associate shall ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees to the same restrictions, conditions, and requirements that apply to Business Associate under this BAA with respect to such PHI. Business Associate shall enter into a written agreement with each such Subcontractor that contains substantially similar terms to this BAA. Current Subcontractors are listed in Section 6 and on the Subprocessor List.

2.5 Access to PHI

Business Associate shall make PHI maintained in a Designated Record Set available to Covered Entity as necessary to satisfy Covered Entity's obligations to provide Individual access to PHI under 45 CFR §164.524. Business Associate shall respond to such requests within fifteen (15) business days of receipt. Where PHI is maintained electronically, Business Associate shall provide such PHI in the electronic form and format requested by the Individual if it is readily producible, or in a readable electronic form and format as agreed to by the Covered Entity and the Individual, in accordance with 45 CFR §164.524(c)(2)(ii).

2.6 Amendment of PHI

Business Associate shall make PHI maintained in a Designated Record Set available to Covered Entity for amendment and shall incorporate any amendments to PHI as directed by Covered Entity, in accordance with 45 CFR §164.526. Business Associate shall respond to amendment requests within thirty (30) calendar days, with a single thirty (30)-day extension permitted upon written notice to Covered Entity.

2.7 Accounting of Disclosures

Business Associate shall maintain and make available to Covered Entity the information required for Covered Entity to provide an accounting of disclosures of PHI in accordance with 45 CFR §164.528. Business Associate shall maintain records of disclosures for a period of six (6) years from the date of the disclosure. Rymeda's immutable, append-only audit trail system records all PHI access events, disclosures, and modifications, enabling comprehensive accounting of disclosures.

2.8 Availability to Secretary

Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining Covered Entity's compliance with the HIPAA Rules, in accordance with 45 CFR §164.504(e)(2)(ii)(H). This obligation shall survive the termination of this BAA.

2.9 Minimum Necessary Standard

Business Associate shall limit its use, disclosure, or request of PHI, to the extent practicable, to the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure, or request, in accordance with 45 CFR §164.502(b) and 42 U.S.C. §17935(b). Rymeda enforces the minimum necessary standard through its role-based access control system, which restricts PHI access based on clinical role: Physicians, Nurse Practitioners, and Physician Assistants have full clinical chart access; Registered Nurses and Therapists have scoped clinical access; Billers access only billing-related data; and Front Desk staff access only scheduling-related data. Organization Admins and Owners have operational access but no direct clinical chart access.

2.10 Return or Destruction of PHI

Upon termination of this BAA for any reason, Business Associate shall, at the election of Covered Entity, return or destroy all PHI received from Covered Entity or created or received by Business Associate on behalf of Covered Entity. This obligation is further detailed in Section 8.4 of this BAA.

2.11 Prohibition on Sale of PHI

Business Associate shall not directly or indirectly receive remuneration in exchange for PHI, except as permitted under 42 U.S.C. §17935(d)(2), including treatment and payment activities, health care operations activities, and with a valid authorization from the Individual.

2.12 Prohibition on Marketing Use

Business Associate shall not use or disclose PHI for fundraising or marketing purposes without a valid authorization from the Individual as required by 42 U.S.C. §17936.

3. Permitted Uses and Disclosures

Except as otherwise limited in this BAA, Business Associate may use or disclose PHI as follows:

3.1 Services Performance

Business Associate may use and disclose PHI as necessary to perform the Services set forth in the Terms of Service, provided that such use or disclosure would not violate the HIPAA Privacy Rule if done by Covered Entity. This includes:

• Treatment Activities: Facilitating care team coordination, clinical chart management, SOAP note documentation, voice note transcription, clinical decision support via ORIS AI, appointment scheduling, secure messaging between providers and patients, and care plan management.
• Payment Activities: Invoice creation and management with CPT codes, insurance claims processing (submission, adjudication, appeals), billing lifecycle management, and payment processing through Stripe.
• Healthcare Operations: Quality assessment, auditing and compliance monitoring, credentialing and verification (NPI/NPPES validation, license verification, DEA verification), staff management, provider onboarding, and analytics dashboards.

3.2 Management and Administration

Business Associate may use PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, in accordance with 45 CFR §164.504(e)(4). Business Associate may disclose PHI for such purposes only if: (a) the disclosure is Required By Law; or (b) Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and will be used or further disclosed only as Required By Law or for the purposes for which it was disclosed, and that the person will notify Business Associate of any instances of which it becomes aware in which the confidentiality of the information has been breached.

3.3 Data Aggregation

Business Associate may use PHI to provide data aggregation services to Covered Entity as permitted by 45 CFR §164.504(e)(2)(i)(B), provided that all aggregated data is de-identified in accordance with 45 CFR §164.514(a)-(c) using either the Expert Determination method (§164.514(b)(1)) or the Safe Harbor method (§164.514(b)(2)). Business Associate shall not re-identify any de-identified data without Covered Entity's prior written consent.

3.4 Required By Law

Business Associate may use or disclose PHI as Required By Law, as defined in 45 CFR §164.103. Business Associate shall notify Covered Entity promptly of any such required disclosure, unless prohibited by law from doing so.

3.5 AI-Assisted Clinical Documentation

4. Safeguards

Business Associate shall implement and maintain the following safeguards in compliance with 45 CFR Part 164, Subpart C (Security Rule):

4.1 Administrative Safeguards (45 CFR §164.308)

4.2 Physical Safeguards (45 CFR §164.310)

4.3 Technical Safeguards (45 CFR §164.312)

4.4 PHI Redaction Pipeline

Business Associate operates an automated PHI detection and redaction pipeline that identifies and removes or masks PHI before data reaches external processing layers. The pipeline uses multi-stage ML-powered entity recognition to detect patient identifiers, clinical data, and other PHI elements, ensuring that Subcontractors receive only the minimum necessary data to perform their designated functions.

4.5 Tenant Isolation

Business Associate maintains complete data separation between tenants (Covered Entity organizations) with isolated compute, storage, and network boundaries. Zero cross-tenant data visibility or data leakage paths are maintained. Each tenant's ePHI is encrypted with dedicated per-tenant AWS KMS keys.

5. Breach Notification

5.1 Discovery of Breach

A Breach shall be treated as discovered by Business Associate as of the first day on which such Breach is known to Business Associate or, by exercising reasonable diligence, would have been known to Business Associate. Business Associate shall be deemed to have knowledge of a Breach if the Breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the Breach, who is a workforce member or agent of Business Associate, as set forth in 45 CFR §164.410(a)(2).

5.2 Notification Timeline

5.3 Content of Notification

Business Associate's notification to Covered Entity shall include, to the extent available:

• The identification of each Individual whose Unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed during the Breach;
• A brief description of what happened, including the date of the Breach and the date of discovery;
• A description of the types of Unsecured PHI involved (e.g., patient names, clinical notes, diagnosis codes, insurance information, voice recordings);
• Any steps Individuals should take to protect themselves from potential harm;
• A brief description of what Business Associate is doing to investigate the Breach, mitigate harm, and prevent future Breaches;
• Contact procedures, including a toll-free telephone number, email address, and postal address.

5.4 Four-Factor Risk Assessment

Business Associate shall conduct a risk assessment per 45 CFR §164.402(2) to determine whether an impermissible use or disclosure constitutes a Breach, considering at minimum:

1. Nature and extent of PHI involved: Types and amount of identifiers involved, likelihood of re-identification;
2. Unauthorized person who used the PHI or to whom the disclosure was made: Whether the recipient is subject to HIPAA or other privacy obligations;
3. Whether the PHI was actually acquired or viewed: Forensic evidence of access versus mere exposure;
4. Extent to which the risk to the PHI has been mitigated: Assurances obtained from the recipient, data recovery actions taken, encryption status at time of incident.

5.5 Breach Log

Business Associate shall maintain a log of all Breaches and suspected Breaches, including those affecting fewer than 500 Individuals, in accordance with 45 CFR §164.408(c). The Breach log shall be provided to Covered Entity upon request and shall include the four-factor risk assessment, notification actions taken, and remediation steps. Additional detail is available in the Breach Notification Policy.

5.6 California-Specific Breach Requirements

For California residents, Business Associate shall additionally comply with:

• Cal. Civ. Code §1798.82 (SB 446): Notification within thirty (30) days of discovery when a breach affects personal information of California residents.
• CMIA (Cal. Civ. Code §56.36): Notification to the California Department of Public Health and affected patients within fifteen (15) business days of detecting a breach of medical information.
• Cal. Health & Safety Code §1280.15: Reporting to the California Department of Public Health (CDPH) within fifteen (15) business days for breaches involving patient medical information maintained by a licensed healthcare facility.
• California Attorney General notification: Required when a breach affects more than 500 California residents.

6. Subcontractors

6.1 Current Subcontractors

The following Subcontractors currently create, receive, maintain, or transmit PHI on behalf of Business Associate in connection with the Services:

A complete and current list of subprocessors is maintained at the Subprocessor List page.

6.2 Flow-Down Requirements

Business Associate shall ensure that each Subcontractor listed above (and any future Subcontractor that will create, receive, maintain, or transmit PHI) has entered into a written agreement containing substantially the same restrictions and conditions as this BAA, including the implementation of appropriate safeguards for ePHI, as required by 45 CFR §164.502(e)(1)(ii) and 42 U.S.C. §17934(b). Business Associate shall monitor Subcontractor compliance and conduct periodic assessments of Subcontractor security posture.

6.3 Prior Written Approval

Business Associate shall provide Covered Entity with thirty (30) days' advance written notice before engaging a new Subcontractor that will have access to PHI. The notice shall include: (a) the identity of the Subcontractor; (b) the nature of the services to be provided; (c) the categories of PHI to be processed; and (d) the location(s) where PHI will be processed.

6.4 Objection Rights

Covered Entity may object in writing to the engagement of a new Subcontractor within the thirty (30)-day notice period. If Covered Entity raises a reasonable objection, Business Associate shall: (a) work with Covered Entity in good faith to find a mutually acceptable alternative; or (b) if no alternative is available, permit Covered Entity to terminate this BAA and the underlying Services agreement without penalty, with Business Associate providing a pro-rata refund of any prepaid fees and cooperating in the orderly transition of PHI as set forth in Section 8.4.

7. Obligations of Covered Entity

Covered Entity agrees to the following obligations:

7.1 Notice of Privacy Practices

Covered Entity shall provide Business Associate with its Notice of Privacy Practices produced in accordance with 45 CFR §164.520, as well as any changes to such Notice, to the extent that such changes may affect Business Associate's use or disclosure of PHI.

7.2 Permission Changes and Revocations

Covered Entity shall notify Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose their PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI.

7.3 Restrictions on Use or Disclosure

Covered Entity shall notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 CFR §164.522, to the extent that such restriction may affect Business Associate's use or disclosure of PHI.

7.4 Permissible Requests

Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Covered Entity, except as specifically permitted under Section 3 of this BAA (management and administration, data aggregation).

7.5 Minimum Necessary Cooperation

Covered Entity shall make reasonable efforts to limit the PHI provided to Business Associate to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request, in accordance with 45 CFR §164.502(b). Covered Entity is responsible for configuring appropriate access controls within the Rymeda platform, including assigning correct clinical roles to staff members and maintaining accurate care team relationships for patient records.

7.6 Authorization for AI Processing

Covered Entity acknowledges that the Services include AI-assisted clinical documentation features (voice transcription, AI-generated SOAP notes, suggested ICD-10 codes) as described in Section 3.5. Covered Entity is responsible for obtaining appropriate patient authorizations for AI processing of PHI and voice recording consent in accordance with the Patient Consent requirements, California Penal Code §632 (two-party recording consent), and California AB 3030 (AI disclosure in healthcare).

8. Term and Termination

8.1 Effective Date

This BAA shall be effective as of the date Covered Entity first accepts the Terms of Service or executes a separate subscription agreement with Business Associate (the "Effective Date"), and shall remain in effect for the duration of the underlying Services agreement, unless terminated earlier as provided herein.

8.2 Termination for Material Breach

Either Party may terminate this BAA if the other Party materially breaches any provision of this BAA and the breach remains uncured for thirty (30) calendar days after the non-breaching Party provides written notice specifying the nature of the breach and the actions required to cure it.

If cure is not possible, the non-breaching Party may terminate this BAA immediately upon written notice. If neither termination nor cure is feasible, the non-breaching Party shall report the breach to the Secretary.

8.3 Effect of Termination of Underlying Agreement

Termination of the underlying Services agreement (Terms of Service or subscription agreement) shall automatically terminate this BAA, subject to the PHI return/destruction obligations set forth in Section 8.4.

8.4 Return or Destruction of PHI

Upon termination of this BAA for any reason, Business Associate shall:

• At the election of Covered Entity, return or destroy all PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity, that Business Associate maintains in any form. Business Associate shall retain no copies of such PHI.
• Provide Covered Entity with a thirty (30)-day data export window during which Covered Entity may export all PHI in machine-readable format through the platform's export functionality.
• Provide written certification of the destruction of PHI within thirty (30) days of completing the destruction, specifying the methods used (cryptographic erasure for electronic media, NIST SP 800-88 compliant methods for physical media).

8.5 Infeasibility of Return or Destruction

If Business Associate determines that the return or destruction of PHI is not feasible (for example, PHI embedded in immutable audit logs required for regulatory compliance or backup systems with fixed retention periods), Business Associate shall:

• Extend the protections of this BAA to the retained PHI for as long as it is maintained;
• Limit further uses and disclosures of such PHI to the purposes that make return or destruction infeasible;
• Continue to comply with all applicable HIPAA Rules with respect to the retained PHI;
• Provide written notice to Covered Entity identifying the specific PHI retained and the reasons return or destruction is infeasible.

8.6 Minimum Retention Period

Notwithstanding the foregoing, Business Associate shall retain PHI for a minimum of six (6) years from the date of creation or the date when it was last in effect, whichever is later, in accordance with 45 CFR §164.530(j). During this retention period, all protections of this BAA remain in full force and effect.

9. Miscellaneous

9.1 Regulatory References

Any reference in this BAA to a section of the HIPAA Rules shall mean the section as in effect or as amended from time to time. This BAA shall be interpreted in a manner consistent with the HIPAA Rules, including the HITECH Act (42 U.S.C. §17921 et seq.), the Omnibus Rule (78 Fed. Reg. 5566, Jan. 25, 2013), and any subsequent amendments or successor regulations.

9.2 Amendment

The Parties agree to take such action as is necessary to amend this BAA from time to time as necessary for compliance with the requirements of the HIPAA Rules and any other applicable law. No amendment to this BAA shall be effective unless agreed to in writing and signed by both Parties, except that Business Associate may update this BAA to comply with changes to applicable law upon thirty (30) days' written notice to Covered Entity. If Covered Entity does not object within the notice period, the amendment shall be deemed accepted.

9.3 Survival

The respective rights and obligations of Business Associate and Covered Entity under Sections 2.7 (Accounting of Disclosures), 2.8 (Availability to Secretary), 5 (Breach Notification), 8.4 (Return or Destruction of PHI), 8.5 (Infeasibility), 8.6 (Minimum Retention Period), and 9 (Miscellaneous) shall survive the termination or expiration of this BAA.

9.4 No Third-Party Beneficiaries

Nothing express or implied in this BAA is intended to confer, nor shall anything herein confer, upon any person other than the Parties and their respective successors and permitted assigns, any rights, remedies, obligations, or liabilities whatsoever. Individuals whose PHI is the subject of this BAA are not third-party beneficiaries of this BAA, notwithstanding that certain provisions are intended to protect their interests.

9.5 Governing Law

This BAA shall be governed by and construed in accordance with the HIPAA Rules (federal law). To the extent not preempted by HIPAA, this BAA shall be governed by the laws of the State of Delaware, without regard to conflict of laws principles. California-specific requirements, including the Confidentiality of Medical Information Act (Cal. Civ. Code §56 et seq.), California breach notification laws (Cal. Civ. Code §1798.82, Cal. Health & Safety Code §1280.15), and California recording consent requirements (Cal. Penal Code §632), shall apply to PHI of California residents where they provide protections more stringent than HIPAA, as required by 45 CFR §160.203.

9.6 Entire Agreement

This BAA, together with the Terms of Service, Privacy Policy, and Data Processing Agreement, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior and contemporaneous understandings, agreements, representations, and warranties, both written and oral, with respect to such subject matter.

9.7 Severability

If any provision of this BAA is found to be invalid or unenforceable by a court of competent jurisdiction, the remaining provisions shall remain in full force and effect. The invalid or unenforceable provision shall be modified to the minimum extent necessary to make it valid and enforceable while preserving the intent of the Parties.

9.8 Waiver

The failure of either Party to enforce any provision of this BAA shall not constitute a waiver of the right to enforce such provision or any other provision in the future.

9.9 Interpretation

Any ambiguity in this BAA shall be resolved to permit compliance with the HIPAA Rules. In the event of a conflict between the terms of this BAA and the Terms of Service or any other agreement between the Parties, the terms of this BAA shall control with respect to the protection of PHI.

9.10 Notices

All notices, requests, and other communications under this BAA shall be in writing and shall be deemed to have been duly given when delivered personally, sent by certified mail (return receipt requested), or sent by nationally recognized overnight courier service to the following addresses:

10. Contact Information

For questions regarding this BAA, to report a Security Incident or Breach, or to exercise any rights hereunder:

Related Policies

This BAA should be read in conjunction with the following documents, which are incorporated by reference: