Business Associate Agreement

1. Definitions

Terms used but not otherwise defined in this BAA shall have the meanings ascribed to them under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and their implementing regulations (collectively, the “HIPAA Rules”).

• Protected Health Information (PHI): individually identifiable health information transmitted or maintained in any form or medium.
• Electronic PHI (ePHI): PHI that is created, received, maintained, or transmitted electronically.
• Breach: acquisition, access, use, or disclosure of PHI in a manner not permitted under the HIPAA Privacy Rule that compromises the security or privacy of the PHI.

2. Obligations of Business Associate

SoloSuds agrees to:

• Not use or disclose PHI other than as permitted by this BAA or required by law.
• Use appropriate safeguards, and comply with the HIPAA Security Rule with respect to ePHI, to prevent unauthorized use or disclosure of PHI.
• Report to the Covered Entity any use or disclosure of PHI not provided for by this BAA, including any security incident or breach, without unreasonable delay and in no case later than 60 days after discovery.
• Ensure that any subcontractors that create, receive, maintain, or transmit PHI on its behalf agree to the same restrictions and conditions.
• Make PHI available for access, amendment, and accounting of disclosures as required by the HIPAA Rules.
• Return or destroy all PHI upon termination of the agreement, where feasible.

3. Permitted Uses and Disclosures

SoloSuds may use or disclose PHI only to:

• Perform the services described in the Terms of Service on behalf of the Covered Entity.
• Provide data aggregation services relating to the health care operations of the Covered Entity.
• Comply with a legal obligation.

4. Obligations of Covered Entity

The Covered Entity agrees to:

• Notify SoloSuds of any restriction on the use or disclosure of PHI that the Covered Entity has agreed to with individuals.
• Not request SoloSuds to use or disclose PHI in any manner that would violate the HIPAA Rules.
• Obtain all necessary authorizations from patients before submitting PHI through the platform.

5. Security Measures

SoloSuds maintains industry-standard administrative, physical, and technical safeguards to protect ePHI, including but not limited to: AES-256 encryption at rest, TLS 1.2+ in transit, role-based access controls, audit logging, and regular security assessments. Data is hosted on SOC 2 Type II certified infrastructure.

6. Breach Notification

In the event of a breach of unsecured PHI, SoloSuds will notify the Covered Entity without unreasonable delay and no later than 60 calendar days after discovery. Notification will include, to the extent possible: the identification of affected individuals; a description of the breach; types of PHI involved; steps individuals should take; and remediation steps taken by SoloSuds.

7. Term and Termination

This BAA is effective upon account creation and remains in effect for the duration of the service relationship. Either party may terminate if the other party materially breaches this BAA and fails to cure within 30 days of written notice. Upon termination, SoloSuds will return or destroy all PHI in its possession within 30 days.

8. Governing Law

This BAA shall be governed by and construed in accordance with applicable federal law, including HIPAA and HITECH. To the extent state law provides greater protection, state law shall apply.

9. Contact

Questions regarding this BAA may be directed to our Privacy Officer at privacy@solosuds.app.