FinVerified Business Associate Agreement

Version: 2026-09-30 · Exhibit A to the FinVerified Master Service Agreement

This Business Associate Agreement (the "BAA") is entered into between the healthcare practice identified in the FinVerified account (the "Covered Entity" or "Practice") and FinVerified, Inc. (the "Business Associate" or "FinVerified"). It takes effect on the date the Practice accepts it electronically (the "BAA Effective Date").

The parties enter into this BAA to comply with the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act, and their implementing regulations at 45 C.F.R. Parts 160 and 164 (collectively, "HIPAA"), in connection with the Services under the Master Service Agreement (the "MSA").

---

1. Definitions

1.1 Capitalized terms used but not defined in this BAA have the meanings given in HIPAA. These include Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

1.2 "Protected Health Information" or "PHI" has the meaning given at 45 C.F.R. §160.103, limited to PHI that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity. It includes Electronic Protected Health Information ("ePHI").

1.3 "Services" has the meaning given in the MSA.

2. Permitted Uses and Disclosures

2.1 To perform the Services. Business Associate may use and disclose PHI only as necessary to perform the Services for Covered Entity, or as Required by Law.

2.2 Management and administration. Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities. It may disclose PHI for those purposes only if:

(a) the disclosure is Required by Law; or

(b) Business Associate obtains reasonable written assurances from the recipient that the PHI will be held confidentially, used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the recipient will notify Business Associate of any instance in which the confidentiality of the PHI has been breached.

2.3 Data Aggregation. Business Associate may use PHI to provide Data Aggregation services relating to the Health Care Operations of Covered Entity.

2.4 De-identification. Business Associate may de-identify PHI in accordance with 45 C.F.R. §164.514(a)–(c). Information de-identified in this way is not PHI. Business Associate may use and disclose it for any lawful purpose consistent with the MSA, and will not attempt to re-identify it.

2.5 Minimum Necessary. Business Associate will request, use, and disclose only the Minimum Necessary PHI to accomplish the intended purpose, in accordance with 45 C.F.R. §164.502(b) and any guidance issued by the Secretary.

2.6 Prohibited uses. Business Associate will not:

(a) use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except as permitted by Sections 2.2–2.4;

(b) sell PHI or receive remuneration in exchange for PHI, except as permitted by 45 C.F.R. §164.502(a)(5)(ii); or

(c) use or disclose PHI for Marketing, as defined at 45 C.F.R. §164.501.

3. Obligations of Business Associate

3.1 Safeguards. Business Associate will use appropriate administrative, physical, and technical safeguards, and will comply with Subpart C of 45 C.F.R. Part 164 with respect to ePHI, to prevent use or disclosure of PHI other than as provided by this BAA.

3.2 Reporting. Business Associate will report to Covered Entity:

(a) any use or disclosure of PHI not provided for by this BAA, of which it becomes aware;

(b) any Security Incident of which it becomes aware; and

(c) any Breach of Unsecured PHI, as required by 45 C.F.R. §164.410.

Reports under (a) and (b) will be made without unreasonable delay and no later than ten (10) business days after discovery.

Notice of a Breach of Unsecured PHI will be made without unreasonable delay and no later than ten (10) business days after discovery, and in no case later than sixty (60) calendar days after discovery. It will include, to the extent then known and as supplemented when available:

(a) the identity of each Individual affected;

(b) a description of what happened, including the dates of the Breach and of its discovery;

(c) the types of PHI involved;

(d) steps Individuals should take to protect themselves;

(e) what Business Associate is doing to investigate, mitigate, and protect against further Breaches; and

(f) contact information.

Unsuccessful Security Incidents. The parties agree that this Section 3.2 serves as notice, and no further notice is required, of the ongoing existence and occurrence of attempted but unsuccessful Security Incidents. Examples include pings and other broadcast attacks on firewalls, port scans, unsuccessful log-on attempts, denial-of-service attacks, and malware that is blocked, provided none of these results in unauthorized access to, or use or disclosure of, PHI.

3.3 Mitigation. Business Associate will mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure of PHI in violation of this BAA.

3.4 Breach costs. If a Breach of Unsecured PHI results from Business Associate's breach of this BAA, Business Associate will reimburse Covered Entity for the reasonable, documented costs of notifications required by law and of credit-monitoring services customarily offered for that type of Breach. This reimbursement is subject to the limitations of Section 12 of the MSA.

3.5 Subcontractors. In accordance with 45 C.F.R. §§164.502(e)(1)(ii) and 164.308(b)(2), Business Associate will ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on its behalf agrees, in writing, to the same restrictions, conditions, and requirements that apply to Business Associate under this BAA.

3.6 Access. Within fifteen (15) days of a request by Covered Entity, Business Associate will make PHI in a Designated Record Set available to Covered Entity, including in electronic form, so that Covered Entity can meet its obligations under 45 C.F.R. §164.524. If an Individual asks Business Associate directly, Business Associate will forward the request to Covered Entity within five (5) business days.

3.7 Amendment. Within fifteen (15) days of a request by Covered Entity, Business Associate will make any amendment to PHI in a Designated Record Set that Covered Entity directs under 45 C.F.R. §164.526. Because sealed Evidence Records cannot be altered, amendments to them are recorded as linked, time-stamped entries.

3.8 Accounting of disclosures. Business Associate will document disclosures of PHI, and provide the information Covered Entity needs to respond to a request for an accounting under 45 C.F.R. §164.528, within fifteen (15) days of Covered Entity's request.

3.9 Covered Entity's obligations. To the extent Business Associate carries out an obligation of Covered Entity under Subpart E of 45 C.F.R. Part 164, Business Associate will comply with the requirements of Subpart E that apply to Covered Entity in performing that obligation.

3.10 Books and records. Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining compliance with HIPAA.

3.11 Offshore restriction. Business Associate will not store PHI, or permit PHI to be accessed, outside the United States without Covered Entity's prior written consent.

4. Obligations of Covered Entity

4.1 Notice of Privacy Practices. Covered Entity will notify Business Associate of any limitation in its notice of privacy practices, to the extent the limitation may affect Business Associate's use or disclosure of PHI.

4.2 Changes in permission. Covered Entity will notify Business Associate of any change in, or revocation of, an Individual's permission to use or disclose PHI, to the extent the change may affect Business Associate's use or disclosure of PHI.

4.3 Restrictions. Covered Entity will notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to under 45 C.F.R. §164.522, to the extent the restriction may affect Business Associate.

4.4 Permissible requests. Covered Entity will not ask Business Associate to use or disclose PHI in any manner that would not be permissible under HIPAA if done by Covered Entity, except as permitted by Sections 2.2–2.4.

4.5 Minimum Necessary submissions. Covered Entity will submit to the Services only the PHI reasonably necessary for the Services to perform.

5. Term and Termination

5.1 Term. This BAA begins on the BAA Effective Date. It ends when the MSA ends and all PHI has been returned or destroyed under Section 5.3, or, if return or destruction is infeasible, when the protections of Section 5.3 have been extended to that PHI.

5.2 Termination for cause. If either party determines that the other has violated a material term of this BAA, it may give written notice with a reasonable opportunity to cure of no less than thirty (30) days. If the violation is not cured, the non-breaching party may terminate this BAA and the MSA. If cure is not possible, the non-breaching party may terminate immediately on notice.

5.3 Return or destruction. On termination, Business Associate will, at Covered Entity's election, return or destroy all PHI it maintains in any form, and will retain no copies, except as follows:

(a) Evidence Records that Business Associate must retain under the MSA, a legal hold, or law will be retained for the period stated in the MSA and then destroyed. Business Associate determines that returning or destroying them earlier is infeasible for that reason.

(b) For any PHI retained under (a), Business Associate will extend the protections of this BAA to that PHI, and will limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as it retains the PHI.

Destruction will follow NIST SP 800-88 or an equivalent standard.

5.4 Survival. Section 5.3 and Business Associate's obligations for retained PHI survive termination.

6. Miscellaneous

6.1 Regulatory references. A reference in this BAA to a section of HIPAA means that section as in effect or as amended.

6.2 Amendment for changes in law. The parties will take such action as is necessary to amend this BAA to keep it compliant with HIPAA as it changes. FinVerified may make amendments required by a change in law through the process in Section 13.1 of the MSA.

6.3 Interpretation. Any ambiguity in this BAA will be resolved to permit compliance with HIPAA.

6.4 No third-party beneficiaries. Nothing in this BAA gives any person other than the parties any rights, remedies, or obligations.

6.5 Relationship to the MSA. This BAA is part of the MSA. If the MSA and this BAA conflict with respect to PHI, this BAA controls.

6.6 Independent contractor. Business Associate is an independent contractor and is not an agent of Covered Entity.